Most Australian firms that say they are “using AI” have, for now, stopped at the digital assistant — relying on off‑the‑shelf tools such as ChatGPT or Microsoft Copilot rather than building the data, cloud and governance plumbing needed to embed AI into core business processes.
The Reserve Bank of Australia’s November bulletin, based on liaison interviews with medium‑to‑large firms, delivers a blunt snapshot: about two‑thirds of surveyed firms reported some level of AI use, but adoption has been shallow — nearly 40 percent described their use as minimal, typically limited to digital assistants used for summarising emails, drafting copy, or quick research. Only roughly 30 percent reported moderate or deeper integration into business processes such as forecasting, inventory management, or fraud detection. That finding sits alongside other government and industry surveys that paint a similar picture for parts of the Australian economy. The federal AI Adoption Tracker — a monthly SME survey run for the Department of Industry, Science and Resources — shows rising but uneven adoption among small and medium enterprises, with roughly 40–41 percent of SMEs reporting they are “adopting” AI as of mid‑2025. The tracker also emphasises that adoption varies markedly by sector and firm size, and that many smaller firms still lack practical knowledge of how to deploy AI safely or effectively. Independent press reporting has summarised the RBA bulletin’s key lines: adoption is often employee‑led, piecemeal and concentrated at the “copilot” stage — a reality that raises questions about whether Australia is building the industrial capabilities needed to convert AI experimentation into systemic productivity gains.
Source: AFR RBA survey reveals ‘shallow’ AI adoption as businesses stop at ChatGPT
Background / Overview
The Reserve Bank of Australia’s November bulletin, based on liaison interviews with medium‑to‑large firms, delivers a blunt snapshot: about two‑thirds of surveyed firms reported some level of AI use, but adoption has been shallow — nearly 40 percent described their use as minimal, typically limited to digital assistants used for summarising emails, drafting copy, or quick research. Only roughly 30 percent reported moderate or deeper integration into business processes such as forecasting, inventory management, or fraud detection. That finding sits alongside other government and industry surveys that paint a similar picture for parts of the Australian economy. The federal AI Adoption Tracker — a monthly SME survey run for the Department of Industry, Science and Resources — shows rising but uneven adoption among small and medium enterprises, with roughly 40–41 percent of SMEs reporting they are “adopting” AI as of mid‑2025. The tracker also emphasises that adoption varies markedly by sector and firm size, and that many smaller firms still lack practical knowledge of how to deploy AI safely or effectively. Independent press reporting has summarised the RBA bulletin’s key lines: adoption is often employee‑led, piecemeal and concentrated at the “copilot” stage — a reality that raises questions about whether Australia is building the industrial capabilities needed to convert AI experimentation into systemic productivity gains.What “shallow” adoption looks like in practice
The Copilot / ChatGPT end‑state: useful but limited
For many workers the immediate productivity gains are real: AI assistants accelerate document drafting, summarisation, and research tasks. These gains are valuable at the individual level, but the RBA stresses they do not automatically translate into firm‑level productivity unless complemented by integrated data pipelines, model governance, and architectural investment. In other words, a thousand desk‑level Copilot users does not equal an enterprise‑grade forecasting pipeline.Employee‑led “shadow AI”
Multiple studies and industry coverage show that much generative AI adoption is shadowy: employees experimenting with public ChatGPT or free Copilot tiers, often without formal procurement or legal review. One widely reported SME survey found a substantial share of businesses using free tools — and many admitted using them with confidential inputs — creating a data‑exposure risk that procurement and security teams may not fully understand.Three adoption tiers the RBA identifies
- Minimal use: off‑the‑shelf digital assistants and occasional prompts (nearly 40% of liaison firms).
- Moderate adoption: targeted process use such as demand forecasting or inventory optimisation (around 30%).
- Deep integration: model‑based systems embedded across business lines for critical tasks (small minority).
Why Australia’s adoption profile looks cautious
The RBA and other national trackers converge on several root causes that explain why many firms have stopped at Copilot-style productivity tools.1) Data and cloud foundations are incomplete
Enterprise AI at scale requires clean, instrumented data pipelines, single sources of truth, and cloud platforms capable of model hosting, observability, and secure inference. Many firms’ recent IT investments prioritised resilience and SaaS adoption rather than the model‑ready data engineering work needed to deploy production ML safely. The RBA noted that upgrading CRM/ERP and modernising systems is not the same as creating an AI‑ready platform.2) Skills shortage and competition for talent
Finding data engineers, MLOps practitioners and platform engineers was consistently cited as a binding constraint. The RBA and Jobs & Skills Australia both highlight that competition for these skills is global, and mid‑market Australian firms often lack the pay or recruitment reach of hyperscale companies. That talent bottleneck slows the move from pilot to production.3) Uncertainty over governance and regulation
Firms are cautious about exposing regulated customer data to third‑party public LLMs. The absence of stable industry norms (and a patchwork of vendor terms around data retention and non‑training guarantees) increases legal and compliance risk — especially in finance, health and government. The Responsible AI Index and other national studies found many organisations overestimate their responsible‑AI maturity, indicating weak governance readiness across the board.4) Cost, integration friction and legacy systems
The upfront cost of rearchitecting systems, plus the integration time to connect models to ERP, procurement and billing systems, favours incremental, low‑risk digital assistant deployments rather than wholesale process redesign. Legacy environments create friction: where integrations are hard, teams default to simple desktop copilots.5) Vendor concentration and procurement inertia
A small set of vendors dominates model provision and cloud infrastructure; for many firms this concentration creates lock‑in concerns and procurement headaches. At the same time, close integration — notably Microsoft embedding Copilot across Microsoft 365 and Windows — lowers friction and explains why such assistants proliferate even if they fall short of enterprise model architecture.The business and policy consequences
Productivity upside remains unrealised — for now
Analysts and policy studies point to significant potential economic gains from AI adoption, but those gains depend on systemic adoption: data platforms, MLOps, governance and changed decision processes. Absent that, time‑savings at the desk risk being one‑off and hard to measure at the firm level. The RBA warns that if Australia lags in converting pilots into integrated systems, there will be potential flow‑on effects to competitiveness.Data security and compliance risks escalate
When confidential inputs are pasted into consumer models, sensitive IP and customer data may be exposed. Several SME studies have flagged alarmingly common behaviours — including the use of free public chat models for confidential tasks — that amplify the risk picture. Without controls (DLP, private endpoints, contractual non‑training terms) these behaviours can create breaches and regulatory exposure.Uneven labour impacts and reskilling needs
Most evidence so far suggests augmentation rather than mass displacement, but the distributional impacts matter: roles heavily reliant on routine document processing are most exposed. National capacity building, reskilling and targeted micro‑credentials for data engineering, MLOps and AI governance are central policy levers suggested by the RBA and skills agencies.Cross‑referencing the claims: what the data supports (and what needs caution)
- The RBA’s liaison bulletin is the principal, verifiable source that explicitly states two‑thirds of surveyed firms reported AI use and nearly 40 percent reported minimal use. That remains the primary empirical finding driving media coverage.
- The Department of Industry’s AI Adoption Tracker confirms slower, uneven SME adoption (roughly 40–41 percent adoption among SMEs), supporting the RBA’s cautionary tone about smaller firms’ readiness.
- Independent indices and industry reports (AI Index analyses and the Responsible AI Index) corroborate a broader pattern: Australia ranks lower on investment, talent concentration and, in some measures, public trust compared with leading AI economies — a structural backdrop to adoption patterns. These sources converge on the observation that where AI is being industrialised — such as in finance and large telcos — it often reflects stronger data maturity and executive sponsorship.
- Single survey percentages can be sensitive to question wording and sample. Benchmarks like “use of AI” mean different things in different surveys (from occasional prompts to production model inference). Treat headline shares as directional.
- Vendor user‑count assertions, traffic metrics and privately negotiated enterprise deployments can diverge. Public referral traffic (e.g., StatCounter or Comscore snapshots) captures visible usage but may undercount behind‑the‑firewall enterprise contracts. Be cautious about extrapolating public web metrics to enterprise deployment levels.
What leaders should do now — practical, sequential guidance for CIOs and IT teams
The strategic gap the RBA identifies is not solved by banning copilots or by one‑off pilots; it is closed by deliberate, productised programs that couple technical work with governance and measurement. The following sequence is pragmatic and low‑regret for Windows‑centric IT organisations and broader corporate leadership.- Build or validate the data foundation first
- Audit data sources, lineage and access controls. Treat data readiness as the gating criterion for any model deployment.
- Prioritise a single cloud‑first data platform or a well‑configured hybrid alternative to ensure model access is auditable and secure.
- Establish AI governance and risk frameworks (quick wins)
- Create an AI steering committee with legal, security, HR and product representation.
- Publish an “acceptable use” and “shadow AI” policy that permits safe experimentation via approved endpoints.
- Require contractual non‑training and data‑residency clauses for enterprise model contracts where confidentiality matters.
- Start with measurable pilots tied to business KPIs
- Select 1–3 high‑impact workflows (e.g., claims triage, invoice processing, demand forecasting). Measure end‑to‑end economic outcomes, not just time saved.
- Design pilots with production intent: deployment plan, monitoring, rollback criteria, and budget for ongoing maintenance.
- Harden security and data controls around copilots
- Implement DLP rules, private model endpoints, tenant‑scoped deployments and telemetry that flags anomalous prompts or data exfiltration attempts.
- Use least‑privilege IAM and conditional access; integrate model usage logs into SIEM and SOC processes.
- Invest in MLOps and lifecycle management, not one‑off experiments
- Treat models as products with versioning, canary deployments, monitoring for drift and a remediation playbook.
- Build small cross‑functional teams (data engineer + product owner + compliance + SRE) to stabilise each production use case.
- Prioritise reskilling and talent pipelines
- Fund micro‑credentials in data engineering, MLOps and model‑ops governance. Partner with universities, bootcamps and government reskilling initiatives to expand supply.
- Create a multi‑vendor resilience plan
- Avoid single‑vendor lock‑in where mission‑critical workflows are involved. Use adapters and interface layers that allow switching model backends without reengineering downstream processes.
Security and compliance checklist for Windows‑centric environments
- Enforce endpoint hardening and current OS patch baselines before enabling integrated copilots. Legacy, unpatched Windows estates increase exposure when employees interact with LLMs.
- Require enterprise‑grade Copilot/ChatGPT subscriptions with tenant controls and administrative policies rather than consumer accounts for business use.
- Configure Data Loss Prevention (DLP) to block sensitive payloads from being sent to public models and to log attempts for audit.
- Instrument and centralise prompt telemetry so unusual patterns can trigger automated investigation.
- Ensure contractual clarity on model training and retention: prefer non‑training guarantees or private endpoints for regulated data.
Pockets of leadership and where Australia is making progress
Not all firms are standing still. The RBA notes sectors where deeper adoption is occurring: financial services, telecommunications and parts of professional services where data maturity is higher and the ROI case for embedding AI is clearer. These exemplars share traits worth emulating: executive sponsorship, modern cloud platforms, cross‑functional teams, and explicit programs for governance and skills. Government and industry initiatives — such as the AI Adoption Tracker, national Responsible AI programs and targeted reskilling funding — are helping to lower the adoption friction for smaller organisations. Yet the RBA’s message is a caution: policy support and private investment must accelerate if Australia is to convert pilot enthusiasm into durable competitive capability.Risks and trade‑offs to watch
- Operational risk: poorly validated models deployed at scale can propagate errors rapidly, with reputational and legal consequences.
- Data leakage: using consumer model endpoints for regulated data is an immediate hazard; contractual and technical controls are not optional.
- Concentration and vendor risk: heavy dependence on a few cloud/model providers amplifies systemic fragility and negotiating leverage.
- Skills mismatch and inequality: uneven access to AI skills risks amplifying concentration of gains in a small set of firms and regions.
A realistic timeline for conversion from Copilot to core AI
- Short term (0–12 months): tighten governance around current digital assistant use, stand up a small number of ROI‑driven pilots, and build telemetry to replace shadow AI with approved alternatives.
- Medium term (12–30 months): roll successful pilots into production, invest in MLOps and model lifecycle tooling, and scale reskilling programs for data and platform roles.
- Long term (2–5 years): firms that commit to platform investments, multi‑vendor resilience and continuous governance will be positioned to capture structural productivity gains; laggards may experience competitive erosion.
Conclusion
The RBA’s liaison survey crystallises a central tension in Australia’s AI story: widespread exposure to generative assistants has arrived, but deep enterprise integration has not. For many businesses, Microsoft Copilot and ChatGPT are powerful productivity crutches — immediate and appealing — but they are not substitutes for the platform, governance and talent investments required to make AI a durable, competitive advantage. Turning shallow adoption into systemic capability demands sequential, managerial discipline: audit the data, govern the use, measure outcomes, and invest in people and MLOps. Without that, the national picture will remain one of experimentation rather than industrial adoption — useful for some productivity pockets today, but unlikely to deliver the widespread, sustained productivity gains that policy makers and business leaders hope for tomorrow.Source: AFR RBA survey reveals ‘shallow’ AI adoption as businesses stop at ChatGPT
