Tim Lumsden

Directions Website Contact the business

Tim Lumsden Helping small business actually get work done with AI. Adelaide based, working Australia wide.

19/10/2026

The AI rules you're waiting for will never be finished.

I keep hearing it from service business owners: "We'll look at AI once regulation is sorted out." I understand the caution. But the rules don't settle. They get discussed, revised, looked at again. The waiting quietly turns into falling behind.

The basics are manageable today, and they come down to three things:

1. Scope access. An AI employee can be configured to see only what its task requires, nothing else.
2. Choose providers who can actually demonstrate how they protect your data.
3. Match access to genuine need, then review it as things change.

I'm not a lawyer and this isn't legal advice. It's simply how I'm setting things up in my own business and with clients: making adoption safe enough to start now, while everything around it keeps shifting.

AI is massively powerful. The power and the responsibility arrive as one package. You can't take one without the other.

So what's keeping you on the sidelines right now: the rules, or the uncertainty?

18/10/2026

Waiting for the AI rules to settle sounds careful... except they never settle.

There is a lot of noise right now about what the regulations will become.

But regulation is a moving thing, and it will keep moving for years.

So the finish line you are waiting for does not exist.

The groundwork, though?

Completely manageable today. This is the part I spend most of my week setting up with business owners.

1. Scope the access, so your AI employee only sees the data its task actually needs.

2. Pick providers who can explain, in plain language, how they protect your information.

3. Start with one low-risk workflow and learn there before touching anything sensitive.

Quick note, I am not a lawyer and none of this is legal advice. The three points above are just sensible housekeeping.

My bet is that in two years, the owners who started small will be miles ahead of the ones still waiting for permission that is never coming.

AI is insanely powerful, and the power and the responsibility arrive as one package... you cannot take one without the other.

15/10/2026

If your business stores customer data on an overseas server and it gets breached, guess who is liable?

I assumed it was the platform. Big company, their servers, their problem. Then I started looking into it properly, and I was wrong.

Under Australian privacy law, the obligation stays with the business that collected the data. You chose the platform, you agreed to their terms, and you own the relationship with the customer. The accountability doesn't travel offshore with the data.

So if you run an allied health clinic and your practice management software stores patient records in the US or Ireland, a breach on their end still lands on you. Same for a law firm storing client files or an accounting practice storing financial records. The Notifiable Data Breaches scheme requires you to report it.

Not a reason to panic or rip out your tools. It's a reason to ask two questions:

1. Where does my data physically live? Not where the company is headquartered, where the servers are.
2. What contractual protections does the provider offer if something goes wrong? Some will have a data processing agreement you can request.

I'm not a lawyer and I'm still working through the details myself. But ask your providers those two questions this week. Most will answer in a single email. And if they can't answer clearly, that's information worth having too.

I used to think the platform carried the data risk.If our business software stored records on an overseas server and som...
14/10/2026

I used to think the platform carried the data risk.

If our business software stored records on an overseas server and something went wrong over there... surely that was their problem, right?

I went digging into this for my own business, and for the businesses I work with, including allied health clinics. I was looking at offshore servers, and who actually wears the consequences.

What I found genuinely surprised me.

If an Australian business stores data offshore and there is a breach, the Australian business is the one liable. The overseas platform sits outside the reach of our privacy laws. Your accountability stays here, with you.

For a business, especially a clinic holding patient records, that is massive.

Quick note before anyone panics. I am not a lawyer. This is me sharing my own research, not legal advice.

And offshore storage is not automatically bad. Handled properly, with the right provider standards and agreements in place, it can be perfectly fine. The work is verifying it rather than assuming it.

So the questions I am now asking every provider: where does the data physically live, what protections sit around it, and can you show me in writing?

Have you ever asked your software provider where your patient data is actually stored?

12/10/2026

Your AI platform stores your client data overseas. Legally, that data is still your problem.

I'm working through this right now for my own business and for my clients. Australian privacy law is genuinely confusing here, but two things keep coming up every time.

First, your public privacy policy. If AI touches client data anywhere in your business, say so in plain words. Not buried in legalese, not hidden in a sub-clause. If people have to guess what happens to their information, you haven't done it properly.

Second, if the platform sits overseas, check it has a Data Processing Agreement (DPA). That's the written contract binding them to protect your data in line with the Australian Privacy Principles, and it needs to go further than a terms-of-service checkbox. The accountability is on you either way, but without that agreement you can't even show you took reasonable steps.

I'm not a lawyer and this isn't legal advice. But I wouldn't wait for the rules to settle. Fold these two checks into your next business review. It's not complicated, it's just the thing most people are skipping right now.

The privacy side of AI had me confused for weeks.Most of the AI tools I use are hosted offshore. Client data goes to the...
11/10/2026

The privacy side of AI had me confused for weeks.

Most of the AI tools I use are hosted offshore. Client data goes to the US, gets processed, comes back.

Here is the part that stopped me. If something goes wrong, the liability lands on the Australian business. The data can sit on a server in Virginia and the problem is still yours.

I am not a lawyer. This is a fellow traveller sharing homework, not legal advice.

But after weeks of digging, the actual work comes down to two documents:

1. Your public privacy policy. Update it so it is honest about the fact you use AI and where that data gets processed. Anyone can read it, so make it true.

2. A Data Processing Agreement with the platform. The provisions need to line up with the Australian Privacy Principles. If a provider cannot show you one... that tells you something.

That is the whole foundation, as far as I can tell right now.

My understanding is still evolving. I keep finding new corners of this.

But those two steps turned AI from something I was getting nervous about into something I can recommend with a straight face. Massive tool, small bit of homework first.

Have you updated your privacy policy since you started using AI?

08/10/2026

I set up an AI employee in my own business about four months ago. Last month I realised I didn't actually know where my data was sitting.

Turns out it's on an overseas server, most likely in the United States. My SOPs, my tasks, client details, all of it lives somewhere I never picked.

Here's the bit that matters if you're an Australian business owner: the Privacy Act still holds you accountable for that data, even when it crosses a border. The storage moved. The responsibility didn't.

I'm not a lawyer, and I'm working this out in real time for my own operation and for clients. So far the basics look manageable:

1. Know where the data actually lives.
2. Check the provider handles it to the Australian standard.
3. Control who and what can reach it.
4. Be upfront with your clients that it exists and where it goes.

Once those four are covered, it stops sounding like a crisis and starts sounding like housekeeping.

The AI employee is still worth running. Massive upside. But if you're running one right now, do you actually know where your data sits?

I could not answer a basic question about my own business this week.Where does my data actually live?I run an AI employe...
07/10/2026

I could not answer a basic question about my own business this week.

Where does my data actually live?

I run an AI employee. It holds my SOPs, my client notes, my task management... the whole operating context of the business.

All of that sits on a server overseas. Most likely the United States. I did not choose that. It just happened when I signed up.

Under the Australian Privacy Act, that matters. The responsibility for that data stays with me. Even though the server sits in another country.

I am not a lawyer. Not giving legal advice here.

But I am working through this right now, with two hats on. One as an owner, one for the clients I build these systems for.

So far the basics look manageable:

1. Know where the data actually lives
2. Check the provider handles it to the Australian standard
3. Control who and what can reach it
4. Be upfront with clients about it

Once those are covered, it stops sounding like a horror story and starts sounding like housekeeping.

If you run an AI tool in your business... do you know where your data sits?

06/10/2026

I work in AI and I honestly have no idea where it will be in five years.

What I can tell you is exactly where it's at today for small business - what's ready, what's half-baked, what's actually worth putting into your business right now. That part I know well. I've tested it, broken it, rebuilt it.

But those confident five-year AI roadmaps flooding your feed? They're guesses. Dressed up nicely, packaged confidently, still guesses. And the people selling them know it.

I've rebuilt what I do before: life coaching, then digital marketing, and now this. Each time the ground moved underneath me and I had to move with it. I was nervous both times. Grew both times too. The nervousness wasn't a warning sign, it was the signal I was in the right place.

Even the AI-native businesses I see today will look totally different in five years. The AI employees I'm recommending right now might be irrelevant by 2028. And where I fit into that future? No clue. I'm starting to think that's okay.

Because the people I trust most in this space aren't the ones with the clearest roadmap. They're the ones willing to say: this is moving faster than any of us expected, and I'm learning as I go.

Anyone handing you certainty about 2030 is selling you something.

Does that kind of honesty make you more or less likely to trust someone in this space?

05/10/2026

Anyone confidently predicting where AI will be in five years is guessing.

Me included.

When I talk about AI, I am talking about where it sits right now. That knowledge has a short shelf life.

Even the AI-native business I describe today will look totally different in five years.

And here is the bit I rarely hear anyone admit... my own place in all of this will look different too.

I say that with nervousness and massive excitement at the same time.

This is a transformation I have never lived through before.

There is a common belief that an expert has to know the destination.

I think we might be looking at this the wrong way. The people worth listening to are the ones honest enough to say the destination keeps moving.

What stays constant is the guiding. Helping business owners take the next small step, whatever tools happen to win.

That need holds no matter what arrives.

So I am not selling a map of the future. I am walking through it alongside my clients, one step at a time.

Where do you honestly think you will fit in five years from now?

Address

Adelaide, SA
5066

Website

Alerts

Be the first to know and let us send you an email when Tim Lumsden posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Contact The Business

Send a message to Tim Lumsden:

Shortcuts

Share