An AI governance policy takes a minute [/1,000 tokens] to write. Making it work takes longer.

Some of the best AI stories in Australian agriculture this year have been pleasantly unglamorous. Macquarie Valley cotton, beef and sheep producer Andrew Gill uploaded data from his John Deere tractor to an AI farm assistant he was trialling. It proactively flagged that one paddock had used about 17 litres of fuel a hectare, compared to roughly four litres for the others. On the NSW Mid North Coast, the Mackenzie family behind Macka's Pastoral uses AI to boil down research papers, weather and farm data so they can make faster calls on genetics and soil health.

This year Beanstalk started running AI lunch and learns for Australian agribusinesses. The sessions were designed to build practical capability with AI tools, and in the early sessions most questions were about which tools to use and where to start. But more recently boards and executives have increasingly asked a second question as well, which is how their use of AI should be governed. We are bullish on AI for agribusiness, and that is exactly why we are bullish on governance, because an organisation that knows where its AI is used and who is accountable for it can say yes to useful applications with far more confidence.

Australia has no standalone AI law, and the National AI Plan released by the federal government in December 2025 confirmed that it will rely on existing legislation. This leaves boards and general counsel to work out how privacy, consumer, anti-discrimination, workplace and copyright law apply to AI and the new ways of working it brings.

What changes on 10 December

One of those existing laws is about to change. From 10 December 2026, organisations covered by the Privacy Act 1988 must explain in their privacy policy where a computer program uses personal information to make a decision that could significantly affect an individual's rights or interests, or does something substantially and directly related to making that decision. The policy has to describe the kinds of personal information those programs use and the kinds of decisions involved. The requirement was introduced by the Privacy and Other Legislation Amendment Act 2024, and the Office of the Australian Information Commissioner (OAIC), Australia's privacy regulator, finalised its guidance on 30 September 2026. It is a transparency requirement and does not prohibit any use of AI, but it applies to decisions made after 10 December through existing systems, as well as new ones.

The Act generally applies to businesses with annual turnover above $3 million, which captures most of the agribusinesses we work with. The OAIC reads the test broadly, so a program can be in scope even when a person makes the final call, and the OAIC guidance confirms that a computer program includes rule-based tools and spreadsheets as well as AI. In an agribusiness, that could cover software that sets grower payment or credit terms, screens applicants for seasonal roles, builds staff rosters, or approves new customers and suppliers.

How much governance a business needs

The level of governance a business needs depends on what its AI tools can access and who their outputs affect. A grower-owned co-operative holds members' production and payment records, a vertically integrated processor may roster hundreds of seasonal workers, and a farmland investment manager handles investor information and asset valuations. An AI tool that develops marketing copy is low risk in each of these businesses, while a tool that scores grower credit applications or shortlists job candidates will likely fall under the new disclosure requirement. Governance is therefore best set one use case at a time, according to the data involved and the consequences if the tool gets something wrong.

In our experience, adoption also moves at different speeds within the same organisation, depending on the person, the team and how comfortable they are with the risk. One team can wait months for permission to trial a marketing tool while another connects an AI tool to a shared mailbox without telling anyone.

“We are bullish on AI for agribusiness, and that is exactly why we are bullish on governance, because an organisation that knows where its AI is used and who is accountable for it, can say yes to useful applications with far more confidence.”

Writing the policy is the easy part

Today's reality is that generating an AI policy can be done in less than 60 seconds, and more to the point, in less than 1,000 tokens! Putting it into practice takes longer, because staff need access to approved tools they want to use or they will find their own, and someone needs to keep a register of where AI is used, including AI features built into software the business already pays for, such as Xero. AI agents that act on a staff member's behalf, for example by sending emails or updating records, also need clear limits on what they can access and logs of what they do, set up before they are deployed, since accountability for their actions stays with the business. Cyber security belongs in the same conversation, particularly since the Australian Signals Directorate (ASD) warned this month that frontier AI is changing the cyber threat environment, and the AICD's summary for boards suggests directors ask how quickly their organisation patches known vulnerabilities.

AI guidance worth reading

The National AI Centre (NAIC), the federal body set up in 2021 to support responsible AI use, published its Guidance for AI Adoption in October 2025. It sets out six practices for organisations:

1. assign accountability

2. understand impacts

3. manage risks

4. share information

5. test and monitor

6. maintain human control

The Australian Institute of Company Directors (AICD) published Version 2 of its Director's Guide to AI Governance in June 2026, produced with the Human Technology Institute at the University of Technology Sydney. It gives boards an operating model covering strategy, structure, practices and enablers, with questions and red flags for each. Read together, the NAIC guidance describes what good practice looks like inside the business and the AICD guide shows boards how to oversee it.

The role of AI champions

We also see a larger role for AI champions than the one the AICD describes. The AICD's checklist for smaller organisations recommends identifying internal champions to advocate for responsible AI use. In the businesses we work with, this is definitely part of their role, but the most effective champions also coach colleagues, find and test new use cases, keep track of which tools and agents their team is using, and pass that information to whoever owns governance, which is the step that connects the board to day-to-day practice. The AICD guide notes that responsibility for AI is often blurred across cyber security, data governance and IT. Named champions elevate people with visibility across teams that otherwise work separately, so there are empowered eyes and ears on the ground the policy reflects how AI is being used on the ground and the board can see where the risk sits. Businesses that establish the role properly can move quickly, capture value and bring the whole workforce along while keeping governance practical.

What’s next?

As an agribusiness director, preparing for the new privacy requirement and putting basic AI governance in place a sensible place to begin is with a few plain questions.

• Where is AI already in use, including inside software the business pays for and tools staff have adopted on their own?

• What data is being shared, and what do providers do with it?

• Which decisions can a tool make alone, and which need a person to sign off?

• Which of those uses could materially affect people, customers or reputation, given how the organisation is structured and who it partners with?

• How much risk is the board willing to carry for the value AI offers, and has it been clear about this?

• Who owns each system, and how would the board find out when one gets something wrong?

• Do existing risk processes already capture AI, including the next tool that arrives as a vendor update?

The question for directors is a simple one: do you know where automation is already shaping decisions about people in your business? If the honest answer is "not entirely", now is a good time to find out.

We'll go deeper on AI governance in next month's newsletter, but we’d also like to hear from you.

If there are specific questions you'd like us to answer, whether about the 10 December changes or AI governance and safety more broadly, send them through here and we'll do our best to cover them.