MOORE, Ms Tracy, General Manager, Data and Artificial Intelligence, MYOB PAQUOLA, Ms Lia, General Manager, Strategic Communications, MYOB SLOANE, Ms Courtney, Head, Government Relations, MYOB [14:22] CHAIR: Welcome. I understand that information on parliamentary privilege and the protection of witnesses giving evidence to this inquiry has been provided to you. I now invite you to make a short—emphasis on 'short'—opening statement, at the conclusion of which we'll move to questions from the committee. Ms Sloane : Certainly. We've provided copies of our opening statement, but I'll present a shorter version. Thank you, firstly, for the opportunity to contribute to this inquiry. Today MYOB is bringing two perspectives: our experience as an Australian technology company that uses AI and provides AI powered products and services; and the experience of our customers, which are largely small and medium-sized businesses. Our view is, firstly, that AI can materially improve SME productivity and growth; and, secondly, that safe adoption depends on trust, it depends on skills and it depends on human oversight. Thirdly, the challenge, we believe, is not awareness of AI; it is helping diverse SMEs adopt it effectively. The approaches that have seen success in other jurisdictions include segmenting SMEs by digital readiness, developing practical sector use cases, connecting businesses with trusted or preapproved providers, building digital skills and addressing finance and infrastructure constraints. We encourage the committee to consider two objectives together: to make safe and useful AI adoption easier for SMEs through practical guidance, capability building and trusted support, and to set clear and proportionate expectations for trust, accountability, privacy, security and redress. We welcome your questions. CHAIR: Excellent. Thank you very much. A recurring theme in your submission is uncertainty about who is accountable when something goes wrong. Where do you think responsibility should sit when harm arises from an AI enabled accounting or business management tool—the software provider, the model developer, the adviser or the business itself using the tool? What's your advice for governments that are considering that level of uncertainty? Ms Sloane : I think that's a great question, and it really goes to the heart of trust in AI, which is, as you know, absolutely vital for growing uptake. My colleague Tracy can talk more about this, but I would say firstly that today most of this question is answered through terms and conditions as data flows through the ecosystem. I think there's some benefit to providing some clearer expectations from government about where the accountability sits. I was lucky to hear CPA earlier. They talked about their expectations around who is responsible for advice given, and we certainly don't seek to step over where the law is very clear in that regard. But I'll hand over to Tracy to say a bit more about that topic. Ms Moore : When we think about designing products for our customers and for advisers we have three principles that we publish. The first is security and privacy at all costs, the second is human in control and the third is transparency, so we don't have AI doing things invisibly or things that might surprise someone. Those three principles anchor around having the human in control and showing small-business customers and their advisers where an AI tool has made suggestions and giving them an explanation and a right to either accept or not. CHAIR: Does that mean, regarding applications of agentic where there is a bit more autonomous activity, there is a need for some thinking around that specific capability? Ms Moore : Yes. We think deeply about that. As we're trying to continually make our tools more helpful and are using more agentic things in the background, we talk daily about the human in the loop and the human in control—how we ensure that the decision rests with the human and how we use good user experience design to help the user to understand what decision they're being asked to make and what their inputs to that decision were. CHAIR: Thank you. I appreciate that. Deputy Chair, over to you. Senator DUNIAM: Thank you very much for attending today, and sorry I can't be there in person. Regarding the role for government in this—which is sort of what we're trying to find a way to assist them in being able to provide—what sort of guidance can you give us to in turn give to government around what is required to ensure that we engender in the business community trust when adopting or seeking to take up AI as part of their business operations? Ms Sloane : Firstly, I think government can play an important coordinated role when it comes to AI. We have excellent expertise in this country. We have great use cases in this country. Government can help bring some of that together. In terms of SMEs specifically, we believe that three structural barriers stand in the way between SMEs and greater AI adoption, and they've been touched on previously. They are: access to skills and expertise, access to time and access to the capital to invest in new tools. In other jurisdictions that have seen some success in growing AI adoption, what's been successful has been government providing pre-approved lists of trusted platforms that businesses might be able to use. They're concentrated on different use cases. Those jurisdictions have also carefully segmented the small and medium business ecosystem into smaller parts based on the industry that each business operates in, or it might be their legal structure or the number of staff they employ, and also based on digital readiness. That diversity across SMEs does make providing single use cases very difficult for the government, but segmenting them and personalising them to those various segments has been very successful. Senator DUNIAM: As to your survey, am I right in saying that it references the fact that 46 per cent of respondents neither use nor plan to use AI? Did you then ask why that might be the case for those in that 46 per cent? Ms Sloane : Yes, we did, and most of the time it was those barriers that I just mentioned. Some businesses conveyed that they didn't see how it would be helpful in their circumstances, and I guess you don't know what you don't know, which is why use cases can be really invaluable in providing some inspiration. Senator DUNIAM: That's interesting, because we had some academics earlier on who basically said to the committee that there was no real concern around lack of knowledge or understanding of what might be achieved from AI and therefore it wasn't a barrier to uptake; it was just their not knowing what they might be able to do once they've got it. So that's very different evidence. It sort of accords with my own personal experience and anecdotal feedback from people you engage with through work and privately as well. Perhaps it's a matter to take on notice, but are there particular models you think the government could look at? I've been turning my mind to what specifically the government could do to assist in removing those barriers, whether it be funded education programs, incentives for uptake or providing some sort of limited time reserve compute capacity and therefore access to models for SMEs to take up. Anything of that nature would be helpful for our thought processes. But, if you want to take that on notice, that's fine. Ms Sloane : Absolutely. I'd be happy to do that. Senator DUNIAM: Thank you. CHAIR: Senator Sheldon. Senator SHELDON: I know you broadly touched on this, but is there any evidence of AI-enabled cyberthreats emerging more quickly than SMEs can defend against? Ms Sloane : That's a great question. It's very difficult, looking at our own data, to determine the difference between an AI-powered cyberthreat and a human cyberthreat. They often present the same way: as a phishing email, as invoice interception et cetera. Overseas, we know that, as AI adoption grows, so too do cybersecurity threats. We think that's why it's absolutely vital that AI policy is located within a broader digital capability program—that includes cybersecurity—and not to treat AI as an add-on or a nice-to-have for digitised businesses. Senator SHELDON: Are there examples of businesses using AI to improve their defensive capabilities when it comes to cyber or fraud detection more generally? Ms Moore : We do not have evidence from our customers, but I can speak to our own business. We are certainly investing in a range of AI tools—approaches—using the frontier models and using different techniques as well, to make sure we're in the best place we can be to defend our business and all of the small-business data that resides on our platforms. Senator SHELDON: I appreciate there is a degree of confidentiality and all that, but can you give us a flavour of what sorts of challenges there have been and what sorts of responses you have been able to manage with the new assistance, with AI. Ms Moore : Perhaps one example, without oversharing, is that we know, as to the new frontier models, each generation brings a new generation of threat. So we have strong partnerships with a number of hyperscalers as well as model companies. So we have a range of ongoing experiments, where we implement different kinds of models to scan our own vulnerabilities, as well as to continually increase the coverage of monitoring and the speed of incident response if we did spot anything untoward. Senator SHELDON: How is that lending itself to your real experience, as to how you position your product or as to changes to how your product might be rolled out to SMEs? Ms Moore : We continue to work with our small-business customers to help them protect their own data. Maybe one example is passkeys, an advanced form of multifactor authentication for when they're logging into their software. Another example is one we just finished rolling out yesterday, which is very timely. You might have heard the phrase MCP. You might not have. It's another acronym. We learned from our customer research that some of them enjoy working inside Claude or ChatGPT. They had been taking screenshots of their data or taking extracts from MYOB to put into these tools, and we saw that that was introducing vulnerabilities. So building this MCP safe permission plumbing layer helps the customers who want to work inside ChatGPT or Claude with the safe plumbing that they can turn on or off as they wish. Senator SHELDON: Thank you. That's great deal of assistance. CHAIR: Senator Dolega. Senator DOLEGA: Thanks for coming along today. I have just a couple of questions about MYOB and the services you might provide to small and medium businesses. I've never used it myself. I have worked for the tax office. I've known and spoken to a lot of businesses that have used the product. Do you have an AI assistant? Is it challenging? How are you monitoring to make sure, as you talked about in your opening statement, that you stay within your lane, because there are really strict rules about who can provide taxation advice in Australia to people? How were you able to monitor and maintain, in this growing age, when agents can become very, very smart very quickly, as we've seen, to make sure that they're staying within the lane of what they're allowed? I have another question, if you know the answer. Is an AI allowed, under taxation law, to provide taxation advice to Australians? Ms Moore : I might briefly touch on the AI assistant chat product and then hand to my colleague to talk about the tax advice. I mentioned that our small-business customers are a really diverse bunch. Some of them like their AI to show up in traditional workflows like bookkeeping, and some are more ambitious and like to do all of their day-to-day work inside. For the people in the middle of the spectrum, our AI assistant helps them use natural language to say things like, 'Go find my top-three outstanding invoices,' or, 'Who should I chase that is past their due date?' And the AI assistant helps them do that without clicking through lots of reports. Behind the scenes, the AI assistant has a whole infrastructure of what we call guardrails. Those are checks and balances that say, 'Here are the types of questions that we do not have permission to answer'—financial advice, tax advice and a whole range of them. And then we have guardrails and evaluation mechanisms that check that our guardrails are continuing to be effective. Senator DOLEGA: Thank you. Ms Sloane : On tax advice, we're very clear that we support accredited and trusted professionals to be that intermediary between the tax office and their clients. MYOB does not provide tax advice, and we're very clear about that internally and externally. We work closely with bookkeepers and accountants, many of whom are our customers themselves and many of whom are small businesses. Our technology is designed to be assistive, really—to free up their time to provide higher-order advice or, as one of our bookkeeper customers fed back, to actually get some time back for their own lives. Yes, there's always a human in the loop. It's always the accredited professional making the final decision and being the representative to the tax office. Senator DOLEGA: If you're happy not to answer the question, because you don't know, that's okay. Given the tax rules in Australia, like that you have to be a tax agent or a bookkeeper assisted by a tax agent to be able to provide that tax service, do you think an AI is able to do that, or is that a gap that currently we should or need to look at as a committee, as well? Ms Sloane : It's actually a live conversation. The Tax Practitioners Board, the ATO and digital service providers like us are all in conversations right now about this very topic. Our view is that the Tax Agent Services Act's greatest strength is that it's technology neutral. Senator DOLEGA: Yes. Ms Sloane : And the strength is that it can absorb new technology waves as they emerge. The TPB, or the Tax Practitioners Board, regularly releases guidance to help DSPs, accountants and tax agents understand their obligations under that act, and we think that the law is robust enough to absorb AI. Senator DOLEGA: Great. Thank you. CHAIR: I'm just going to check back online to see if there are any further questions from committee members. There being none, I might bring this session to a close. Thank you so very much for making yourselves available to provide evidence today. If there have been any further requests, or if there is additional information that you would like to provide to the committee, do so via the secretariat in the next couple of weeks. Thanks very much. We'll move to our next session..