# Inova AI Solutions: full answers > Answer-first content from inovasolutions.ai. Every fact carries its source. Product: BLDR (https://www.bldr.bot/). ## Is ChatGPT safe for company data in Australia? URL: https://www.inovasolutions.ai/insights/is-chatgpt-safe-for-company-data-australia.html Region: APAC Short answer: Not for personal or sensitive information. Australia's privacy regulator, the OAIC, recommends as best practice that organisations do not enter personal information, and especially sensitive information, into publicly available generative AI tools. For confidential company data, the safer path is a governed AI platform that runs where you decide and logs every use. Key facts: - The OAIC recommends not entering personal or sensitive information into publicly available generative AI tools. (Source: OAIC, Guidance on privacy and the use of commercially available AI products (Oct 2024), https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products) - From 10 December 2026, privacy policies must explain certain uses of personal information in automated decision-making. (Source: Gilbert + Tobin, Automated decision-making transparency under the Privacy Act, https://www.gtlaw.com.au/insights/automated-decision-making-transparency-under-the-privacy-act) - 36% of Australian employees have entered confidential data into AI tools that may lack formal oversight. (Source: IT Brief Australia, One in three Australians upload sensitive data to AI tools (Sept 2025), https://itbrief.com.au/story/one-in-three-australians-upload-sensitive-data-to-ai-tools-report-finds) - About one in three Australian workers use AI without their employer's knowledge. (Source: HRD Australia, Australian workers still hiding AI use from employers (Employment Hero research), https://www.hcamag.com/au/specialisation/employee-engagement/australian-workers-still-hiding-ai-use-from-employers-studies-find/581494) ### What does Australian law say? The Privacy Act 1988 applies to any use of AI that involves personal information. In October 2024 the Office of the Australian Information Commissioner (OAIC) published guidance for organisations using commercially available AI products, including free, publicly accessible chatbots. Its headline advice is simple: as a matter of best practice, don't put personal information, and particularly sensitive information, into public generative AI tools. The OAIC also says AI products should not be used simply because they are available. You are expected to ask whether using personal information with an AI system is necessary and the best solution. ### What about confidential company data that isn't personal? Board packs, contracts, pricing, source code and tender responses aren't always personal information, but they are the data competitors and attackers want most. When staff paste them into a public chatbot, the data leaves your environment and is handled under the provider's terms, not yours. In Australia this is already happening at scale. A 2025 survey of 500 Australian technology decision-makers found 36% of employees had entered confidential data, including strategic plans and financials, into AI tools that may not have formal oversight. Separate Employment Hero research found about one in three Australian workers use AI without their employer knowing. ### What changes on 10 December 2026? New Australian Privacy Principles 1.7 to 1.9 come into force. If your organisation uses personal information in automated decisions that could significantly affect people, your privacy policy must say so. That covers AI systems built into everyday workflows, approved or not, so knowing where AI is used across your organisation becomes a compliance task, not just an IT one. ### So what should an Australian enterprise do? Give people a better option than a public chatbot: a governed assistant connected to your own systems, deployed where you decide, with every use logged. Write a clear AI policy, keep an AI register, and map where AI touches personal information before 10 December. Our team in Sydney does exactly this through the AI Governance service, and BLDR provides the platform. FAQ: - Q: Is ChatGPT Enterprise different from free ChatGPT? A: Enterprise plans offer stronger contractual terms than consumer tools. The OAIC's advice still applies: assess whether personal information needs to go into any third-party AI product, and make sure the product meets your privacy obligations. - Q: Can we just block ChatGPT? A: Blocking alone rarely works, because staff work around blocks. Pair a clear policy with a sanctioned, governed alternative people want to use. - Q: Who can help in Sydney? A: Inova AI Solutions is headquartered in Parramatta, Sydney. Our AI Governance service sets policy, approvals and a shadow AI programme for Australian organisations. ## What is sovereign AI, and does your organisation need it? URL: https://www.inovasolutions.ai/insights/what-is-sovereign-ai.html Region: Global Short answer: Sovereign AI is AI your organisation controls end to end: where it runs, which models it uses, what data it can reach, and who approves what it does. You need it when your data is sensitive or regulated, when switching AI vendors would be hard, or when an outage at someone else's company would stop your work. Key facts: - 71% of executives say switching their primary AI vendor or model would be difficult. (Source: IBM Institute for Business Value, The Calculus of AI Sovereignty (17 Jun 2026), https://newsroom.ibm.com/2026-06-17-ibm-study-limited-control-and-rising-dependencies-leave-enterprises-exposed-in-the-age-of-ai) - Only 9% of executives fully understand their dependencies on AI vendors, models and infrastructure. (Source: IBM Institute for Business Value, The Calculus of AI Sovereignty (17 Jun 2026), https://newsroom.ibm.com/2026-06-17-ibm-study-limited-control-and-rising-dependencies-leave-enterprises-exposed-in-the-age-of-ai) - 68% find meeting data residency and sovereignty requirements across geographies challenging. (Source: IBM Institute for Business Value, The Calculus of AI Sovereignty (17 Jun 2026), https://newsroom.ibm.com/2026-06-17-ibm-study-limited-control-and-rising-dependencies-leave-enterprises-exposed-in-the-age-of-ai) - 94% of IT organisations are concerned about vendor lock-in. (Source: Parallels, 2026 State of Cloud Computing Survey, https://www.parallels.com/newsroom/news/press-releases/20260217-cloud-survey/) ### A simple definition Sovereign AI means the intelligence your organisation runs on answers to you. Your data stays where you decide, your models can be swapped, your rules decide what agents may do, and your logs show what they did. It is the opposite of renting intelligence by the token from a provider whose prices, terms and models can change without your say. ### Why it suddenly matters AI has moved from answering questions to taking actions inside core systems. IBM's 2026 study of 1,000 executives found 71% say switching their primary AI vendor or model would be difficult, and only 9% fully understand their AI dependencies. When AI runs procurement, finance or citizen services, that dependency becomes a continuity risk. ### How do you know if you need it? Ask four questions. Is the data regulated or sensitive (personal information, government data, financial records)? Would a week-long outage at your AI vendor stop work? Could you move to another model in a month? Can you show an auditor what every AI agent did and who approved it? A 'no' to any of these is a sovereignty gap. ### Sovereign AI in APAC and the Gulf In Australia, the Privacy Act, the OAIC's AI guidance and the government's Hosting Certification Framework push sensitive data toward controlled, onshore environments. In Saudi Arabia, the Personal Data Protection Law, NCA controls and SAMA rules do the same for the Kingdom. Inova builds sovereign AI for both markets from Sydney and Dubai. FAQ: - Q: Is sovereign AI the same as on-prem AI? A: Not quite. On-prem is one deployment option. Sovereign AI is about control: it can run on-prem, in a private cloud or in-country, as long as you control the data, models and rules. - Q: Does sovereign AI mean building our own model? A: No. Most organisations use open-weight or chosen models inside a platform they control. The sovereignty comes from the platform, the deployment and the governance. - Q: What is BLDR? A: BLDR is Inova's sovereign agent OS: one governed layer to build, run and audit AI agents across your systems, inside your walls and your country. ## What do Australia's new automated decision-making rules mean for your AI? URL: https://www.inovasolutions.ai/insights/privacy-act-automated-decision-making-december-2026.html Region: APAC Short answer: From 10 December 2026, organisations covered by Australia's Privacy Act must explain in their privacy policy when they use personal information in automated decisions that could significantly affect someone's rights or interests. The rules apply to decisions made after that date, even if the system or data existed before, so you need to know where AI and automation make or shape decisions. Key facts: - New APPs 1.7, 1.8 and 1.9 commence on 10 December 2026, introduced by the Privacy and Other Legislation Amendment Act 2024. (Source: Gilbert + Tobin, Automated decision-making transparency under the Privacy Act, https://www.gtlaw.com.au/insights/automated-decision-making-transparency-under-the-privacy-act) - The obligation applies to decisions made after commencement, even if the personal information was collected earlier. (Source: Gilbert + Tobin, Automated decision-making transparency under the Privacy Act, https://www.gtlaw.com.au/insights/automated-decision-making-transparency-under-the-privacy-act) - Privacy policies must include information about how personal information is used in automated decision-making tools or processes. (Source: Lander & Rogers, Australian privacy law update: what APP entities need to know in 2026, https://landers.com.au/legal-insights-news/australian-privacy-law-update-what-app-entities-need-to-know-in-2026) - About one in three Australian workers use AI without their employer's knowledge, so not every automated decision is on IT's map. (Source: HRD Australia, Australian workers still hiding AI use from employers (Employment Hero research), https://www.hcamag.com/au/specialisation/employee-engagement/australian-workers-still-hiding-ai-use-from-employers-studies-find/581494) ### What is changing? The Privacy and Other Legislation Amendment Act 2024 added three new Australian Privacy Principles: APP 1.7, 1.8 and 1.9. From 10 December 2026, if your organisation uses a computer program to make, or substantially help make, decisions that could significantly affect individuals, and those decisions use personal information, your privacy policy must describe that use. ### Who does it affect? Any organisation covered by the Privacy Act, which includes most businesses with annual turnover above A$3 million and Australian Government agencies. In practice that is every large Australian enterprise using AI in lending, insurance, hiring, customer service, eligibility or pricing. ### Why AI makes this harder AI agents and automations spread fast, often without central approval. You can only disclose what you know about. The first job is an inventory: every system, agent and workflow where software makes or shapes a decision about a person, including tools staff adopted on their own. ### How to prepare in the next month Map decision flows across your systems. Classify which involve personal information and could significantly affect people. Update the privacy policy. Then put the governance in place so new agents are registered, approved and logged before they go live. On BLDR, every agent action is logged with who approved it, which makes the disclosure and any later review straightforward. FAQ: - Q: Does this apply to a chatbot that answers questions? A: Only if it makes or substantially contributes to decisions that could significantly affect individuals using their personal information. Answering FAQs usually doesn't; deciding eligibility or prioritising claims might. - Q: What happens if we get it wrong? A: Failing to meet the privacy policy requirements can attract OAIC compliance action and civil penalties. Get legal advice for your specific case. - Q: Can Inova help? A: Our Sydney team runs AI Governance engagements that map automated decisions, design approvals and configure audit trails in BLDR. We are not a law firm; we work alongside your legal advisers. ## How do Australian organisations keep AI data onshore? URL: https://www.inovasolutions.ai/insights/keep-ai-data-in-australia.html Region: APAC Short answer: Run the AI where your data already lives. Deploy the AI platform on-prem, in an Australian private cloud or with an Australian hosting provider, use models that can run inside that environment, and route every model call through a gateway you control. For Australian Government data, check the hosting requirements of the Hosting Certification Framework. Key facts: - The Hosting Certification Framework applies to government customers procuring hosting for high-value data, whole-of-government systems or PROTECTED systems. (Source: Digital Transformation Agency, Hosting Certification Framework, https://www.dta.gov.au/our-projects/hosting-strategy/hosting-certification-framework) - The OAIC advises against entering personal information into publicly available generative AI tools. (Source: OAIC, Guidance on privacy and the use of commercially available AI products (Oct 2024), https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products) - Under the National AI Plan, every Australian Government agency will nominate a Chief AI Officer. (Source: ACS, Australia's new National AI Plan: top 9 highlights, https://membership.acs.org.au/member-insight/2025-12-02-Australia-s-New-National-AI-Plan-Top-9-Highlights.html) - 68% of executives find data residency and sovereignty requirements challenging. (Source: IBM Institute for Business Value, The Calculus of AI Sovereignty (17 Jun 2026), https://newsroom.ibm.com/2026-06-17-ibm-study-limited-control-and-rising-dependencies-leave-enterprises-exposed-in-the-age-of-ai) ### Why 'onshore' is harder with AI Traditional systems keep data in a database you choose. AI adds a new data path: every prompt, document and answer travels to a model. If that model runs on a provider's infrastructure overseas, your data travels with it, whatever your database settings say. ### Three ways to keep it in Australia On-prem: the platform and models run in your own data centre. Private cloud: a dedicated environment with an Australian provider. In-country managed: a single-tenant deployment in an Australian region with contractual and technical residency controls. The right choice depends on data classification, scale and your security team's requirements. ### What government teams need to know The Australian Government's Hosting Certification Framework, now run by the Department of Home Affairs, sets requirements for hosting high-value government data, whole-of-government systems and PROTECTED systems. Under the National AI Plan, agencies are also appointing Chief AI Officers, which makes AI hosting decisions a governance matter, not just procurement. ### Questions to ask any AI vendor Where do the models run, exactly? Which other companies process our prompts? Can we choose or swap the model? Is the deployment single-tenant? Where are logs stored and who can read them? If the answers aren't specific, the data probably isn't staying onshore. ### How BLDR does it BLDR deploys as a dedicated platform on-prem, in a private cloud or in-country. You choose where your AI runs, and every model call passes through the BLDR gateway, logged and governed by your policy. Product and engineering are based in Sydney, with Australian support. FAQ: - Q: Does using an Australian cloud region make AI onshore? A: Only if the AI models and every processing step also run in that region. Check where inference happens and which sub-processors touch your data. - Q: Do private companies need Hosting Certification Framework providers? A: The framework applies to government customers, but many regulated private organisations use certified providers as a benchmark. - Q: Where is Inova based in Australia? A: Our headquarters is at 40 Inkerman Street, Parramatta, in Sydney's west. ## How do you stop employees pasting company data into ChatGPT? URL: https://www.inovasolutions.ai/insights/how-to-stop-employees-pasting-data-into-chatgpt.html Region: APAC Short answer: You won't stop it by blocking alone. Give people a governed AI assistant that is better than the public one, connected to your own data and deployed where you decide; publish a clear policy on what data may go where; and log every use. Then measure shadow AI over time instead of pretending it isn't there. Key facts: - 69% of organisations suspect or have evidence that staff use prohibited public generative AI. (Source: Gartner survey of 302 cybersecurity leaders, 2025 (via dope.security), https://dope.security/post/shadow-ai-statistics) - Organisations with high shadow AI paid about US$670,000 more per data breach. (Source: IBM Cost of a Data Breach Report 2025 (via Acronis), https://www.acronis.com/en/blog/posts/what-is-shadow-ai/) - 36% of Australian employees have entered confidential data into AI tools that may lack oversight. (Source: IT Brief Australia, One in three Australians upload sensitive data to AI tools (Sept 2025), https://itbrief.com.au/story/one-in-three-australians-upload-sensitive-data-to-ai-tools-report-finds) - About one in three Australian workers use AI without their employer's knowledge. (Source: HRD Australia, Australian workers still hiding AI use from employers (Employment Hero research), https://www.hcamag.com/au/specialisation/employee-engagement/australian-workers-still-hiding-ai-use-from-employers-studies-find/581494) ### Why it happens People use public chatbots because they work and nothing better is on offer. Gartner found 69% of organisations suspect or have evidence of prohibited GenAI use. In Australia, about one in three workers use AI without telling their employer. ### Why blocking fails Blocks push use onto personal phones and accounts, where you have no visibility at all. The risk doesn't go away; it just leaves your logs. ### A plan that works First, a sanctioned assistant on a governed platform, connected to the documents and systems people need. Second, a one-page policy: which data classes may be used with which tools. Third, logging and an AI register so you know what's in use. Fourth, a quarterly review. This is the shadow AI programme inside our AI Governance service. ### The cost of doing nothing IBM's 2025 Cost of a Data Breach research found organisations with high levels of shadow AI paid about US$670,000 more per breach. In Australia, unmanaged AI also makes the Privacy Act's new automated decision-making disclosures harder to get right. FAQ: - Q: Is a policy enough? A: No. Policy without a better tool is ignored. Policy with a governed alternative and logging works. - Q: What does a governed assistant look like? A: An AI assistant inside your environment that can reach approved documents and systems, follows your data rules, and logs every request and answer. - Q: Can BLDR replace public chatbots for staff? A: Yes. BLDR runs governed assistants and agents on your systems, deployed on-prem, in a private cloud or in-country. ## What's the difference between an AI agent and a chatbot? URL: https://www.inovasolutions.ai/insights/ai-agents-vs-chatbots.html Region: Global Short answer: A chatbot answers questions in a conversation. An AI agent takes actions: it reads documents, calls systems, follows a workflow and produces an outcome, such as checking a supplier's documents or routing an invoice. Because agents act inside your systems, they need permissions, approvals and an audit trail that a chatbot never did. Key facts: - Gartner expects over 40% of agentic AI projects to be cancelled by the end of 2027 on cost, unclear value or weak risk controls. (Source: Gartner, Over 40% of agentic AI projects will be canceled by end of 2027 (25 Jun 2025), https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027) - Gartner estimates only about 130 of thousands of vendors claiming agentic AI are genuine. (Source: Gartner, Over 40% of agentic AI projects will be canceled by end of 2027 (25 Jun 2025), https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027) - 95% of organisations saw no measurable P&L return from generative AI pilots. (Source: MIT Project NANDA, The GenAI Divide: State of AI in Business 2025 (via Computing), https://computing.co.uk/news/2025/ai/mit-report-95pc-corporate-generative-ai-pilots-fail) ### Chatbots answer A chatbot takes a question and returns text. Useful for search and drafting, but the work still happens in people's hands. ### Agents act An agent takes a goal and works through steps: read the tender, check the supplier against the register, score the bid, flag anything suspicious, and send it for approval. Agents connect to systems such as SAP, document stores and email, which is where their value and their risk come from. ### What changes for governance Agents need identities, permissions and limits. High-impact actions need a human approval. Every action needs a log. Without these, agentic projects become the ones Gartner expects to be cancelled. ### Watch out for agent washing Gartner estimates only about 130 of the thousands of vendors claiming agentic AI deliver genuine agentic capability. Ask to see agents running on real systems, with approvals and logs, not a scripted demo. FAQ: - Q: Are agents safe? A: They are as safe as the controls around them: permissions, approvals, human takeover and audit. - Q: What are good first agents? A: Back-office workflows with clear rules and measurable volume: document checks, vendor onboarding, invoice queries, tender search. - Q: What does BLDR do? A: BLDR is a platform to build, govern and run AI agents across your systems, with approvals and a full audit trail. ## Why do enterprise AI pilots fail to reach production? URL: https://www.inovasolutions.ai/insights/why-enterprise-ai-pilots-fail.html Region: Global Short answer: Most pilots stall because the AI can't reach the data and systems where the work happens, nobody can measure the result in money, and governance arrives after the demo instead of before it. Start with one back-office workflow, connect it to real systems, set the rules first, and measure it against today's cost. Key facts: - 95% of organisations saw no measurable P&L return from generative AI pilots. (Source: MIT Project NANDA, The GenAI Divide: State of AI in Business 2025 (via Computing), https://computing.co.uk/news/2025/ai/mit-report-95pc-corporate-generative-ai-pilots-fail) - Back-office automation returned more than the sales and marketing tools that received about half of budgets. (Source: MIT Project NANDA, The GenAI Divide: State of AI in Business 2025 (via Computing), https://computing.co.uk/news/2025/ai/mit-report-95pc-corporate-generative-ai-pilots-fail) - Only 16% of GCC CEOs say their most-used AI tools can reach all the relevant documents and data. (Source: PwC 29th Global CEO Survey, Middle East findings (via Middle East AI News), https://www.middleeastainews.com/p/middle-east-ceos-lead-globally-in) - 79% of finance leaders had AI cost overruns in the past 12 months. (Source: DoiT survey by Sapio Research, Feb 2026 (via Insentra), https://www.insentragroup.com/us/insights/not-geek-speak/generative-ai/token-spending-and-ai-roi-are-you-actually-getting-your-moneys-worth/) ### What the research says MIT's Project NANDA found 95% of organisations saw no measurable profit-and-loss return from their generative AI pilots, and that back-office automation outperformed the sales and marketing tools that took most of the budget. In the Gulf, PwC found only 16% of CEOs say their AI can reach all the relevant data. ### The four causes we see The AI can't reach the data. There is no number to beat. Governance arrives late, so security blocks go-live. And the pilot sits beside the work instead of inside the system where the work happens. ### How to pick a first workflow Choose high-volume, rule-heavy back-office work: vendor onboarding, document checks, invoice queries. Measure today's cost and time. Connect the agent to the real systems. Agree the approvals with security before you build. ### What a production path looks like Readiness to choose the workflow, governance to set the rules, a proof of value on the real systems, then production. That is the sequence of our three services, and an enterprise build across SAP Ariba, SAP ERP and an on-prem ERP is underway in Saudi Arabia on this path. FAQ: - Q: How long should a proof of value take? A: Weeks, not quarters, if the systems are reachable and the rules are agreed up front. - Q: Do we need a data lake first? A: No. Agents can work with the systems you already have through connectors. - Q: Where should an Australian enterprise start? A: With a readiness assessment that ranks workflows by value and risk, run by our team in Sydney. ## How do you avoid AI vendor lock-in? URL: https://www.inovasolutions.ai/insights/how-to-avoid-ai-vendor-lock-in.html Region: Global Short answer: Keep the parts you own separate from the parts you rent. Put your agents, workflows, knowledge and logs on a platform you control, route every model call through a gateway so models can be swapped, write data-exit rights into contracts, and test that you can actually move. Key facts: - 71% of executives say switching their primary AI vendor or model would be difficult. (Source: IBM Institute for Business Value, The Calculus of AI Sovereignty (17 Jun 2026), https://newsroom.ibm.com/2026-06-17-ibm-study-limited-control-and-rising-dependencies-leave-enterprises-exposed-in-the-age-of-ai) - Organisations reported an average of six AI-related disruptions in two years; 81% say a seven-day vendor outage would be severe or critical. (Source: IBM Institute for Business Value, The Calculus of AI Sovereignty (17 Jun 2026), https://newsroom.ibm.com/2026-06-17-ibm-study-limited-control-and-rising-dependencies-leave-enterprises-exposed-in-the-age-of-ai) - 94% of IT organisations are concerned about vendor lock-in. (Source: Parallels, 2026 State of Cloud Computing Survey, https://www.parallels.com/newsroom/news/press-releases/20260217-cloud-survey/) ### Why AI lock-in is deeper With software, you depend on a product. With AI, you also depend on a model that can change behaviour, price or availability on the vendor's schedule. IBM's 2026 study found executives faced an average of six AI disruptions in two years, including price increases, usage restrictions and model deprecations. ### The architecture that keeps you free Agents, prompts, workflows, knowledge and logs live on your platform. Models sit behind a gateway, so changing one doesn't mean rebuilding everything. Deployment is single-tenant, on infrastructure you choose. ### The contract that keeps you free Data-exit rights, export formats, notice periods for model changes, and the right to audit. Then test extraction before you need it. ### Where BLDR fits BLDR is the layer you own: agents, approvals, knowledge and audit across every system, with models routed through the BLDR gateway and deployment where you decide. FAQ: - Q: Is multi-vendor the answer? A: Only if it's deliberate. Accidental multi-vendor sprawl adds risk without adding freedom. - Q: Can we switch models later? A: On a gateway architecture, yes, with testing. Without one, switching often means a rebuild. - Q: Does this matter for Australian and Gulf organisations? A: Yes, because residency rules and sovereignty requirements reduce the number of providers you can switch to, which makes control more important. ## What should you ask an AI vendor before you sign? URL: https://www.inovasolutions.ai/insights/questions-to-ask-an-ai-vendor.html Region: Global Short answer: Ask where the models run, who processes your data, whether you can swap models, how agents are permissioned and approved, what is logged and where, how you exit, what it costs over three years, which systems it connects to today, what certifications it actually holds, and to see it running on real systems. Key facts: - Gartner estimates only about 130 of thousands of agentic AI vendors are genuine. (Source: Gartner, Over 40% of agentic AI projects will be canceled by end of 2027 (25 Jun 2025), https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027) - 71% of executives say switching their primary AI vendor would be difficult. (Source: IBM Institute for Business Value, The Calculus of AI Sovereignty (17 Jun 2026), https://newsroom.ibm.com/2026-06-17-ibm-study-limited-control-and-rising-dependencies-leave-enterprises-exposed-in-the-age-of-ai) - 79% of finance leaders had AI cost overruns in the last 12 months. (Source: DoiT survey by Sapio Research, Feb 2026 (via Insentra), https://www.insentragroup.com/us/insights/not-geek-speak/generative-ai/token-spending-and-ai-roi-are-you-actually-getting-your-moneys-worth/) ### The ten questions 1. Where exactly do the models run, and can we choose? 2. Which companies process our prompts and documents? 3. Can we swap the model without rebuilding our agents? 4. How are agent permissions set, and which actions need a human approval? 5. What is logged, where is it stored and who can read it? 6. How do we export our data, agents and logs if we leave? 7. What will it cost over three years, including model usage? 8. Which of our systems does it connect to today, not on the roadmap? 9. Which certifications do you hold now, and which are on a roadmap with dates? 10. Can we see it running on real systems, not a demo? ### What good answers sound like Specific places, named sub-processors, a gateway that separates models from agents, an approval model you can configure, logs you own, an exit clause, a cost model per agent or workflow, live connectors, honest certification status, and a reference you can call. ### How we answer them We publish our answers on our Trust page and in the security pack: dedicated deployment where you decide, a governed gateway for every model call, approvals and audit built in, connectors to SAP Ariba, SAP ERP and on-prem ERPs, and a certification roadmap rather than a claim. FAQ: - Q: Who should ask these questions? A: Procurement, security and IT together. Each owns different answers. - Q: Should certifications be a hard requirement? A: For many regulated buyers, yes. Ask what is certified today and what is on a dated roadmap. - Q: Can we get Inova's answers in writing? A: Yes. Request the security pack at team@inovasolutions.ai. ## What does Australia's Guidance for AI Adoption ask of your organisation? URL: https://www.inovasolutions.ai/insights/australia-guidance-for-ai-adoption.html Region: APAC Short answer: The Guidance for AI Adoption, published by the National AI Centre on 21 October 2025, replaces the 2024 Voluntary AI Safety Standard and condenses its ten guardrails into six practices: decide who is accountable, understand impacts and plan accordingly, measure and manage risks, share essential information, test and monitor, and maintain human control. Key facts: - The Guidance for AI Adoption was published on 21 October 2025 and sets out six essential practices. (Source: Department of Industry, Science and Resources, Guidance for AI Adoption (21 Oct 2025), https://www.industry.gov.au/publications/guidance-for-ai-adoption) - It streamlines the Voluntary AI Safety Standard's ten guardrails into six practices. (Source: Department of Industry, Science and Resources, Guidance for AI Adoption (21 Oct 2025), https://www.industry.gov.au/publications/guidance-for-ai-adoption) - The National AI Plan was released on 2 December 2025. (Source: Australian Government, National AI Plan (2 Dec 2025), https://www.industry.gov.au/publications/national-ai-plan) - Under the plan, every Australian Government agency nominates a Chief AI Officer. (Source: ACS, Australia's new National AI Plan: top 9 highlights, https://membership.acs.org.au/member-insight/2025-12-02-Australia-s-New-National-AI-Plan-Top-9-Highlights.html) ### Where it fits Australia has taken a guidance-first approach to AI. The National AI Centre's Guidance for AI Adoption, published in October 2025, is the main framework for organisations, with a Foundations version for those starting out and an Implementation Practices version for governance and technical teams. The National AI Plan followed in December 2025. ### The six practices Decide who is accountable. Understand impacts and plan accordingly. Measure and manage risks. Share essential information. Test and monitor. Maintain human control. Each comes with templates, such as an AI register and policy templates. ### Turning practices into systems Most organisations can write a policy. The hard part is making it true inside the systems where AI runs. Accountability needs named owners per agent. Human control needs approvals and takeover. Testing and monitoring need logs. Sharing information needs a record of what AI did. ### How Inova helps Our Sydney team maps your AI use against the six practices, designs the governance model, and configures it in BLDR so approvals, human takeover and audit are part of the platform, not a separate document. FAQ: - Q: Is the guidance mandatory? A: No, it is voluntary. It aligns with existing laws such as the Privacy Act, which are mandatory. - Q: What happened to the Voluntary AI Safety Standard? A: The Guidance for AI Adoption updates and replaces it, and the National AI Centre publishes a crosswalk between the two. - Q: Does it apply to government agencies? A: Agencies also follow the Digital Transformation Agency's policy for the responsible use of AI in government and the APS AI Plan. ## Is ChatGPT Enterprise safe for government data in Saudi Arabia? URL: https://www.inovasolutions.ai/insights/chatgpt-enterprise-government-data-saudi-arabia.html Region: Gulf Short answer: For sensitive government and regulated data, the rules point to processing inside the Kingdom on infrastructure you control. Saudi Arabia's Personal Data Protection Law restricts cross-border transfers, NCA's Essential and Cloud Cybersecurity Controls govern government and critical-infrastructure workloads, and SAMA requires in-Kingdom data for regulated finance. Key facts: - Saudi PDPL has been fully enforced since September 2024 and restricts cross-border transfers of personal data. (Source: CMS, AI laws and regulation in the Kingdom of Saudi Arabia, https://cms.law/en/int/expert-guides/ai-regulation-scanner/kingdom-of-saudi-arabia) - NCA Essential and Cloud Cybersecurity Controls govern government and critical-infrastructure workloads. (Source: CMS, AI laws and regulation in the Kingdom of Saudi Arabia, https://cms.law/en/int/expert-guides/ai-regulation-scanner/kingdom-of-saudi-arabia) - Saudi Arabia declared 2026 its Year of Artificial Intelligence. (Source: DGA Group, Saudi Arabia's New Digital Economy (Jul 2026), https://dgagroup.com/wp-content/uploads/2026/07/Saudi-Arabias-New-Digital-Economy-The-Kingdom-Makes-Strides-in-Data-Monetization-Cybersecurity-and-AI-Policy-3.pdf) - Only 10% of Middle East organisations have made AI sovereignty a CEO or board-level concern. (Source: Accenture AI sovereignty report, Sept 2026 (via Consultancy-me), https://www.consultancy-me.com/news/14375/middle-east-leads-on-ai-sovereignty-but-must-close-the-compute-gap-accenture-finds) ### The rules that apply The Personal Data Protection Law, enforced by SDAIA, governs personal data and restricts transfers outside the Kingdom. The National Cybersecurity Authority's Essential Cybersecurity Controls and Cloud Cybersecurity Controls set how government and critical-infrastructure entities host workloads. SAMA requires regulated financial data to stay in the Kingdom. ### Why this matters for public AI services Every prompt and document sent to an AI service travels to wherever its models run. For sensitive government or regulated data, that path has to satisfy the same residency and security rules as the data itself. ### The in-Kingdom alternative Deploy the AI platform inside the Kingdom, dedicated to your organisation, with models running in that environment and every call governed and logged. Write it in Arabic first, so it works for the people who use it. ### How Inova does it Inova AI Gulf in the DIFC leads delivery across the GCC. An enterprise deployment across SAP Ariba, SAP ERP and an on-prem ERP is underway in Saudi Arabia, with Arabic-to-English master data, vendor scoring and tender search among the agents. FAQ: - Q: Is any cloud AI acceptable? A: It depends on data classification and the controls that apply to your entity. Classify first, then choose the deployment. - Q: Does BLDR support Arabic? A: Yes. Arabic-first delivery and Arabic-to-English master data agents are part of current deployments. - Q: Who do we contract with in the GCC? A: Inova AI Gulf Ltd in the DIFC, or one of our partners. ## How did we put an AI employee inside WhatsApp? Lessons from building Gus URL: https://www.inovasolutions.ai/insights/how-we-built-gus-ai-employee-whatsapp.html Region: APAC Short answer: We put the AI where the work already happens. Gus is an AI employee for Australian service businesses that owners talk to on WhatsApp. It drafts quotes and invoices, logs expenses from a receipt photo, answers questions about the diary and prepares social posts, while a separate dashboard holds documents and connected apps. Nothing is sent until the owner reviews it. The lesson for any organisation ready to start: pick one workflow, meet people in the channel they already use, connect to the systems of record, and keep a human approval on every action that matters. Key facts: - Gus is used through WhatsApp; a separate dashboard holds documents, photos, visits and connected apps. (Source: Gus AI by Inova AI Solutions, higus.ai product page (Nov 2026), https://www.higus.ai/) - Gus drafts quotes and invoices, and logs expenses by text or receipt photo. (Source: Gus AI by Inova AI Solutions, higus.ai product page (Nov 2026), https://www.higus.ai/) - Gus connects to Google Calendar, Xero, Facebook, Instagram, WhatsApp and Meta Ads. Xero is optional. (Source: Gus AI by Inova AI Solutions, higus.ai product page (Nov 2026), https://www.higus.ai/) - Owners review before anything is sent, and paid actions need their approval. (Source: Gus AI by Inova AI Solutions, higus.ai product page (Nov 2026), https://www.higus.ai/) - Setup is three steps: describe the business, activate WhatsApp and link apps, then request a first draft. (Source: Gus AI by Inova AI Solutions, higus.ai product page (Nov 2026), https://www.higus.ai/) ### The problem we set out to solve Owners of trades and service businesses spend their evenings on admin: quotes, invoices, receipts, the diary and social posts. They do not want another app to learn. They already run their business from their phone, and most of their conversations happen in WhatsApp. ### Decision 1: put the AI in the channel people already use Instead of asking owners to log in to new software, Gus lives in WhatsApp. An owner sends a message or a photo and gets a draft back in the same chat. The dashboard exists for the things a chat is bad at: reviewing documents, photos, visits and connected apps in one place. The same principle drives our enterprise work: the agent goes to the systems and channels people already use, not the other way round. ### Decision 2: drafts first, a person approves Gus prepares quotes and invoices as drafts the owner checks. Expenses are logged from a text or a receipt photo, and invoice drafts are reviewed in Gus and in Xero. Paid actions, such as an ad budget, need the owner's approval and the relevant connected accounts. This is the same human-in-the-loop pattern BLDR applies to enterprise agents: the AI does the work, a person signs off, and the action is recorded. ### Decision 3: connect to the system of record An assistant that only chats creates more copy and paste. Gus connects to Google Calendar for the diary, Xero for invoices and bills, and Facebook, Instagram and Meta Ads for marketing. With Xero connected, Gus can create draft invoices, show invoice and bill status, and compare invoiced revenue with tracked costs by project. Xero is optional, so an owner can start in Gus and connect it later, and disconnect it at any time. ### Decision 4: make the first win fast Setup is three steps: tell Gus about the business, area and contact details; activate WhatsApp and link apps; then request a first draft, check it and choose what happens next. The first useful output arrives in the first session, not after a project. ### What this means if you are ready to start The same four decisions apply to an enterprise rollout. Start with one workflow that has a clear owner and a measurable outcome. Deliver it in the channel people already work in, whether that is WhatsApp, Microsoft Teams, email or an ERP screen. Connect it to the system of record so it removes work instead of moving it. And keep a person approving every action that carries risk, with a log of what happened. For enterprises, we do this on BLDR, deployed where you decide, so the agents, approvals and logs stay under your control. FAQ: - Q: Is Gus available now? A: Gus is launching at higus.ai for Australian service businesses. - Q: Does Gus send anything without approval? A: No. Quotes and invoices are drafts the owner reviews first, and paid actions need the owner's approval. - Q: Do I need Xero to use Gus? A: No. You can create quotes and invoices in Gus and connect Xero later. - Q: Can Inova build a WhatsApp or Teams agent for an enterprise? A: Yes. For enterprises we build and run agents on BLDR, connected to your systems, with approvals and audit built in. Book a briefing at team@inovasolutions.ai.