AI Risks and Governance for Australian Retailers: A Guide

Retailers using AI in Australia are already covered by existing law: consumer law applies to AI-written claims, the Privacy Act applies to personal information put into or produced by AI, and from 10 December 2026 businesses covered by the Privacy Act must explain significant automated decisions in their privacy policies. The Australian Government's Guidance for AI Adoption sets out six essential practices to manage this. For most online sellers, good governance comes down to knowing where AI is used, keeping a person accountable and checking outputs before customers see them.

This article is general information, not legal advice.

The risks are real, and mostly ordinary

AI risk in retail is rarely dramatic. It looks like a product description that claims a certification the product does not have, a generated image that shows a feature the item lacks, a chatbot that promises a refund policy you do not offer, or customer data pasted into a public AI tool.

These problems are common. McKinsey's 2025 global survey found 51% of respondents from organisations using AI had seen at least one negative consequence, and nearly one-third of all respondents reported consequences from AI inaccuracy. Inaccuracy was one of the two risks organisations most often said they were working to mitigate.

The National AI Centre is clear that traditional laws apply to AI systems: misleading statements in AI-driven advertising or promotions could breach consumer law, and an AI system that leaks customer information could breach privacy and cyber security obligations. Using a tool supplied by a third party does not remove your responsibility.

Australia's six essential practices

In October 2025 the National AI Centre released the Guidance for AI Adoption, which streamlines the earlier Voluntary AI Safety Standard into six essential practices. There is a short "foundations" version for SMEs and a more detailed implementation version. Here is what each practice means for an online retailer:

1. Decide who is accountable. Name the person responsible for each AI use, including tools from suppliers.
2. Understand impacts and plan accordingly. Consider who could be affected: shoppers, staff, marketplace partners.
3. Measure and manage risks. A listing-copy tool carries different risk from an AI that approves refunds or flags fraud.
4. Share essential information. Tell people when AI has been used in ways that affect them.
5. Test and monitor. Check accuracy before launch and keep checking, because models and marketplace rules change.
6. Maintain human control. Keep a person able to review, override and stop the system.

The implementation guidance also recommends keeping an AI register and clear records of governance decisions, testing and incidents. For a small retailer that can be a one-page list: tool, purpose, owner, data used, how outputs are checked.

Privacy obligations

The Office of the Australian Information Commissioner's guidance on commercial AI products makes two points retailers should act on. First, privacy obligations apply to personal information put into an AI system and to AI outputs that contain personal information. Second, as best practice the OAIC recommends organisations do not enter personal information, particularly sensitive information, into publicly available generative AI tools.

In practice: do not paste customer names, addresses or order histories into free chatbots, and check where any AI vendor stores and uses your data.

Automated decision-making transparency from December 2026

From 10 December 2026, entities covered by the Privacy Act must include information in their privacy policy where a computer program makes, or does something substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests, using their personal information. The policy must describe the kinds of personal information used and the kinds of decisions involved.

Retailers should review whether any automated systems, such as fraud screening that blocks orders, credit or buy-now-pay-later decisions, or account suspensions, could fall within this. Many small businesses are exempt from the Privacy Act, but marketplace contracts and payment providers may still expect similar standards. Get advice if you are unsure.

Transparency with customers is the gap

Australian SMEs are better at internal checks than at telling customers. The National AI Centre's tracker found the most common safeguard is checking AI outputs before they affect customers, used by about half of current users, but transparency with customers about AI use and formal ways for customers to raise concerns lag well behind. The Centre expects this gap to become a source of risk as scrutiny grows.

Simple fixes include a line in your privacy policy, a note that chat support is AI-assisted with an option to reach a person, and a clear contact for complaints. For service-specific advice see AI customer service for online retailers.

Key figures

• 51% of organisations using AI have seen at least one negative consequence; nearly one-third of respondents report consequences from AI inaccuracy (McKinsey, 2025).
• About half of Australian SME AI users check outputs before they affect customers (National AI Centre, 2026).
• 65% of non-adopting SMEs cite distrust of AI decisions or a preference for human control (National AI Centre, 2026).
• ADM transparency obligations in privacy policies apply from 10 December 2026 (OAIC, 2026).

How eComChannels helps

eComChannels is designed around human approval, which is the core of practice 6. AI listing optimisation is trained on each marketplace's listing rules and drafts content for people to approve before anything is published, so claims are checked before shoppers or marketplaces see them, reducing the risk of misleading listings and policy breaches. AI graphics creates image sets to each marketplace's image rules on the same approve-once, publish-everywhere basis.

AI social media outreach drafts posts for Facebook, Instagram, TikTok, LinkedIn and other networks that your team reviews before they go live, so your brand voice and claims stay under your control while you post more consistently. Approval steps give you a clear record of who signed off what. Book a demo or start a 30-day free trial.

FAQ

Is there an AI law in Australia that retailers must follow?

There is no single AI act for retailers. Existing laws, including the Australian Consumer Law and Privacy Act, apply to AI use, and the government's Guidance for AI Adoption sets out recommended practices.

Do I have to tell customers I use AI?

Not in every case, but transparency builds trust, and from 10 December 2026 Privacy Act entities must disclose certain automated decisions in their privacy policies. Disclosing AI-assisted chat and offering a human option is good practice.

What is the simplest governance step for a small seller?

Keep a short register of every AI tool you use, who owns it, what data it touches and how outputs are checked, and require a person to approve anything customer-facing.