Your AI policy gap isn't a risk. It's already someone's asset.

I've talked about shadow AI before. This is what it looks like when it's not hypothetical:

 "Hi! I work for private company, and I have been using Claude for 4 months now. My company does not have AI policy, and do not provide AI tool yet, so I am using my Claude account on my own. I am building my accounting process with Cowork, but what if the company provides Claude account as company and require to use it? I don't want to share my skills built and strategies that I invested my own time and effort. Anyone facing this issue?"

Four months. Their own account, their own time, no policy from the business telling them what they could or couldn't do. Now they're staring down the day their employer catches up and wants everything they built handed over.

This is shadow AI, and it's not rare. 84% of Australian workers have already used at least one AI tool, but only 7% show advanced AI literacy, and more than half are still at beginner level. Jobs and Skills Australia found 21 to 27% of employees are using AI without their manager even knowing. Banning it doesn't fix that number, it just pushes it further out of sight. A ban doesn't stop someone solving a problem with a tool that works, it just stops them telling you about it.

Most business owners hear "AI policy" and picture a document. Draft it, get it signed off, done. That's the easy 20% of the job and most businesses still haven't done even that. This starts with leadership, not IT and not whoever's already quietly solving the problem. Someone senior has to actually own writing it, rolling it out, and checking it's still being followed. 

They weren't really asking a neutral question. They said it plainly: they don't want to share what they built. They built genuine skill and a working process, on their own time, before the business ever got involved, and they don't think that becomes company property just because the business finally shows up with an account to hand them. Most businesses have no answer for that, because it's never come up before.

They solved a real operational problem the business hadn't solved itself. Treating that as a threat to shut down is the wrong instinct. The better move is bringing what they built into a system the whole team can use, with them getting credit for it. Punishing initiative teaches people to keep doing this quietly instead of telling you about it.

Job ads requiring AI skills in Australia doubled between 2024 and 2025, after four years of barely moving. People with AI skills are now earning a 62% wage premium, up from 57% last year.

For a small business owner, I'd interpret that as a build versus buy signal. Hiring for AI skills is getting more expensive, and it means starting from scratch with someone who doesn't know your business yet. Building that capability in the team you've already got keeps the domain knowledge you can't easily replace, and it doubles as professional development for people who are already invested in the business.

It also backs up another finding in the same report: the new tasks landing on AI-exposed roles lean more on judgement and human skills, not less. That's exactly the kind of knowledge already sitting in your team.

That's the cheaper path, and it's the one most businesses haven't started on yet.

There's a deadline attached to all this too. If your business turns over more than $3 million a year, from 10 December 2026 you're required to disclose it in your privacy policy whenever software makes or significantly assists in a decision that affects someone's rights or interests and involves their personal information. An accounting process built quietly in someone's personal AI account is exactly the kind of thing that catches businesses out when a requirement like that lands. More on what this actually means for your privacy policy in the next post.

If you're a business owner reading this, the real test isn't whether you have an AI policy. It's whether anyone's checking, month to month, that it still matches what your team is actually doing. And whether you've thought about who owns the skill and process someone builds along the way, before someone in your business tells you what this person just told a room full of strangers: it's not the company's to take.

What working together looks like.

The work I do with businesses starts with understanding the full picture before anything is recommended or built. That might mean a Technology Opportunity Assessment, a structured review of your systems and workflows that delivers an opportunity matrix and blueprint before you spend anything on licences or training, so you know exactly where investing in AI will impact your business. Or it might start with an AI Alignment Session with your leadership team, creating a shared understanding of AI, what it means for your business, and what needs to be in place to move forward well.

If you're in Cairns or FNQ and want to talk through where your business is at, book a call.

Kate Fabian is the founder of Adoptech, a Cairns-based technology and AI adoption consultancy. She works with business owners across Far North Queensland on AI strategy, implementation, and training.

Sources: ACS Australia's Digital Pulse 2026 (Deloitte Access Economics). Jobs and Skills Australia, via The Conversation, August 2025. PwC 2026 AI Jobs Barometer. Privacy and Other Legislation Amendment Act 2024 (APP 1.7–1.9).