As Australia’s economy accelerates towards digital transformation, driven by artificial intelligence (AI) and automation, an uncomfortable truth has emerged — we are not just innovating faster than ever, we are also increasing our exposure faster than ever.
For business leaders, Boards, and technology decision-makers, the real question is no longer if sensitive data will be exposed in AI systems; it’s when, how, and most importantly, what are you doing about it?
Dr. Kiran Kewalramani, founder and CEO of Cyber Ethos, a leading cybersecurity business based in Queensland, Australia, offers invaluable insights and a timely perspective on the data security imperative facing Australian organisations in the AI era.
“AI has changed the rules of engagement for cybersecurity,” Dr. Kewalramani explains. “It’s no longer just about defending your network, it’s about defending your data wherever it flows, learns, or lands. Boards and business leaders need to understand this is not a future problem, it’s already here.”
According to Dr. Kewalramani, the organisations that will thrive in this new environment are those that treat AI governance not as an IT issue but as a strategic business capability.
“Building trust around how your organisation manages sensitive data in an AI-driven world will soon become a differentiator in the market. Not just for regulators, but for customers, partners, and investors,” he says.
“AI without governance is speed without control. And that’s a risk no Board can afford to ignore.”
The Productivity Paradox of AI: Speed vs Security
AI tools like ChatGPT, Copilot, Deepseek, and Claude have become the digital assistants of modern workplaces. From drafting reports and analysing complex data to assisting with customer service, AI systems offer undeniable speed and efficiency – no doubt about that.
But this convenience comes with a catch.
Recent research from cybersecurity firm Harmonic Security found that 8.5% of employee prompts submitted to public generative AI tools included sensitive information, spanning customer records, personal employee data, financial details, and even security configurations. Alarmingly, over half of these exposures were traced to free, consumer-grade AI platforms, where uploaded content may be retained, analysed, or used to train future models outside an organisation’s control. [Source: Harmonic Security, 2024 AI Data Leak Report]
And this isn’t just a corporate risk. We’ve already seen this pattern play out in the consumer world.
“Consider the recent popularity of “Ghibli Art” generators or AI-powered filters on ChatGPT and other platforms. Many individuals, seeking a fun or personalised image, unknowingly uploaded their personal photographs into AI systems. While the intent was harmless creativity, the reality is stark: these images can now be part of training data for AI models, potentially laying the foundation for misuse in areas like deep fakes or synthetic identity creation,” said Dr. Kewalramani.
The lesson for business? The same behaviour happens in the workplace, just with much higher stakes.
Efficiency without boundaries is no longer a competitive advantage, it’s a governance disaster waiting to happen. Every piece of sensitive corporate data casually entered into an AI tool today could form part of an uncontrolled training dataset tomorrow.
Why AI Data Leakage is Different and More Dangerous
In Australia, data privacy and security obligations are already well-defined under laws like the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), which govern how personal information must be collected, stored, and used by organisations. These apply to most Australian businesses with an annual turnover of $3 million or more, as well as certain smaller organisations like health service providers.
Additionally, emerging guidance, such as Australia’s AI Ethics Principles and the draft Artificial Intelligence Framework, signals a clear expectation from regulators. Organisations using AI must ensure responsible data handling, transparency, and privacy safeguards, not just in how data is stored but in how it flows through AI tools and models.
However, the risks of AI data leakage extend far beyond Australia’s borders.
Many Australian businesses, especially those operating globally or handling international customer data, must also navigate privacy laws like:
- GDPR (General Data Protection Regulation) – applies to any organisation handling the personal data of EU citizens, regardless of where that organisation is based.
- DPDPA (Digital Personal Data Protection Act, India) – applies to companies processing personal data of individuals in India.
- HIPAA (Health Insurance Portability and Accountability Act, USA) – applies to healthcare providers, insurers, and associated service providers handling protected health information in the US.
Non-compliance with these laws can result in significant financial penalties, legal action, and reputational harm.
The key message is clear: AI-driven data leakage is not just an IT risk, it’s a legal and regulatory risk, both domestically and globally.
Australian organisations must take a proactive stance, understanding where their data goes, who has access, and whether their use of AI meets both local and international privacy obligations.
Dr. Kewalramani’s View: The five critical AI data risks no business can ignore
According to Dr. Kewalramani, “Australian organisations must understand that leveraging AI without clear governance can create hidden risks that surface only after damage is done. These risks aren’t hypothetical. They are already playing out in boardrooms, courtrooms, and headlines around the world.”
In his view, these are the five critical risks every business leader must actively manage in the age of AI:
1. Data Privacy Breaches
The risk of exposing personally identifiable information (PII), protected health data (PHI), sensitive customer records, or confidential business information into AI systems often unknowingly. “In Australia, this has direct consequences under the Privacy Act and Australian Privacy Principles, but globally, it also triggers GDPR, DPDPA (India), and HIPAA obligations,” Dr. Kewalramani explains.
2. Security Vulnerabilities
AI models and tools are increasingly being fed sensitive internal data, like network configurations, security test results, or proprietary information that, if leaked or misused, can become a blueprint for attackers. “Cybercriminals love unguarded AI inputs because they reveal exactly what to target,” Dr. Kewalramani cautions.
3. Regulatory Non-Compliance
Failure to manage data exposure properly could see organisations in breach of both local and international regulations, from Australia’s Privacy Act to GDPR (EU), HIPAA (US healthcare), DPDPA (India), Essential 8 and SMB1001 compliance. “Compliance is no longer just about your internal systems; it’s about every AI tool your people touch,” Dr. Kewalramani notes.
4. Reputational Damage
The erosion of trust from customers, investors, and regulators following an AI-related data leak can be swift and unforgiving, often harder to repair than the technical breach itself. “In today’s environment, trust is not built through glossy marketing; it’s built through robust data governance,” says Dr. Kewalramani.
5. Data Poisoning & Bad Insights
When poor quality, biased, or sensitive data is fed into AI models, it can lead to flawed outputs, poor business decisions, and, in some cases, embedded systemic bias within the AI itself. “If AI is the brain, then your data is the oxygen. Polluted data leads to polluted decisions,” Dr. Kewalramani warns.
The Future Belongs to Zero Trust Data Governance
As AI continues to reshape the way Australian organisations operate, one thing has become abundantly clear: traditional security models, built on the idea of “trust but verify,” are simply no longer fit for purpose. It’s rather, “never trust, always verify”.
In an AI-powered world, data doesn’t sit still. It moves across systems, platforms, and borders, often without visibility or control.
As Dr. Kewalramani often states: “You can’t protect what you can’t see and you certainly can’t govern what you don’t control.”
This is precisely why the future of cybersecurity belongs to Zero Trust Data Governance, an approach that doesn’t just secure networks but secures the data itself, wherever it goes.
At its core, Zero Trust is more than a security framework, it’s a business philosophy rooted in data privacy, accountability, and transparency. It’s about controlling data access at the most granular level, continuously verifying every request, and ensuring all interactions with sensitive data are monitored, auditable, and policy-enforced.
This is especially important when AI tools are now part of daily business operations, often ingesting sensitive customer records, employee data, or intellectual property. “AI thrives on data. But without data privacy guardrails, it quickly turns from enabler to exposure,” Dr. Kewalramani warns.
In fact, Dr. Kewalramani recently explored this in depth in his Cyber Matters article, “Data Privacy Best Practices for Australian Organisations & Their Employees”, where he urged Australian businesses to build privacy-by-design principles into their cybersecurity and AI strategies from the outset.
“This is not just about compliance; it’s about trust,” Dr. Kewalramani said.
Zero Trust Data Governance isn’t optional in the age of AI. It’s essential for protecting sensitive information, meeting the expectations of regulators, and earning the trust of customers, partners, and employees alike.
In the end, trust is the new currency of the business.
AI Governance is Now a Board-Level Conversation
For too long, AI has been treated as just another shiny new tool in the technology stack. But the reality is stark: AI isn’t just a technical opportunity anymore. It’s a governance challenge.
As Dr. Kewalramani puts it: “AI risk doesn’t sit in the IT department; it sits squarely in the Boardroom. If Boards don’t own the narrative around responsible AI today, they’ll be managing the fallout tomorrow.”
Global regulators have already set the tone. The US Executive Order on AI, the NIST AI Risk Management Framework, and Europe’s evolving AI Act all signal one clear message: governance, transparency, and accountability are non-negotiable.
And Australia is moving in the same direction. “Waiting for legislation to catch up before acting on AI risk is like waiting for a flood warning before building a dam,” Dr. Kewalramani warns. “By then, the damage is already done.”
Boards and Executive teams must now elevate AI risk to the same strategic level as financial oversight, operational resilience, and cybersecurity.
Organisations that move early, embedding AI governance into their risk frameworks, privacy programs, and culture, won’t just avoid regulatory pain. They’ll differentiate themselves in the market.
Because in today’s data-driven economy, trust is more than a value. “Trust is your brand. Trust is your licence to operate. And in the age of AI, trust must be earned every single day,” Dr. Kewalramani reminds us.
Final Thought: In an AI World, Trust is Everything
AI will reshape industries. It will unlock new business models, turbocharge productivity, and accelerate decision-making at a scale we’ve never seen before. But here’s the brutal truth: speed without trust is a liability. Data without governance is a risk. And AI without guardrails is a headline waiting to happen.
As Dr. Kewalramani puts it, “AI will separate the businesses that lead from those that learn the hard way. And the gap between the two won’t be technology, it will be trust.”
Australian organisations stand at a defining crossroads.
This is not just a technology conversation. This is a leadership decision. The organisations that embed trust, privacy, and security into the DNA of their AI strategy won’t just survive regulatory scrutiny, they’ll earn something even more valuable.
“Trust isn’t just the cost of doing business in the AI era; it is the business. Because in a world powered by AI, trust is the only currency that never devalues”, Dr. Kewalramani says.
The choice for Australian businesses in 2025 (and beyond) is clear:
- Lead with trust. OR
- Be led by crisis.
Choose wisely.
To connect with Dr. Kewalramani, visit the Cyber Ethos website or connect with him on LinkedIn.
Branded content.
