EKALAVYA ACADEMY | SHORT BOOKS

Rules, risk and what you must know

Law, guidance and policy, how to judge risk, the six essential practices and the records worth keeping. Awareness, not legal advice.

Ekalavya Academy by Almost Magic
Short Book 7 of 10 | Free to read and share

How to read this book

Before You Start

1. Learn
A few slides explain one idea in full sentences.

2. See it
A short, made-up example gives the idea a face.

3. Try it
A ten-minute exercise in the tools you already use.

4. Check it
Three questions. Guidance is at the back, not next to the question.

5. Keep it
A four-sentence summary to come back to.

Two levels in every chapter. The main slides are written so a first-time reader can follow them. A "Going deeper" slide gives the same idea at the level an experienced reader would argue about.

This book works with any AI tool you already have. It never asks you to buy or sign up for a particular product.

Where this book sits in the series

The Plan

Book 1	What AI is, and what it is not	Foundations
Book 2	Productivity with AI: writing, summaries, research, meetings	Practical use
Book 3	From one task to a repeatable workflow, and AI deputies	Workflow automation, agents
Book 4	Handling data safely	Data handling
Book 5	When a data shortcut becomes the rule	Data quality and governance
Book 6	Staying secure with AI	Security
Book 7	Rules, risk and what you must know	Risk and compliance awareness
Book 8	Your AI rules on one page	Policy and accountability
Book 9	When AI gets it wrong	Recovering from AI mistakes
Book 10	When not to use AI, and who stays in charge	Judgement and oversight

Each book works on its own. Read them in order or pick the one you need.

In this book

Contents

Chapter 1
Why rules matter, and where they come from

Chapter 2
Same tool, different risk

Chapter 3
The six essential practices

Chapter 4
Records and openness

At the back
Guidance and answers for every question and exercise

Why rules matter, and where they come from

Chapter 1

By the end of this chapter you will be able to:

Tell law from guidance and from your own policy.

Name the kinds of rules that can touch AI use.

Explain what the EU AI Act says about AI literacy.

Know when to ask an adviser.

Time: about 40 minutes, including the exercise.

Three layers: law, guidance, your rules

Learn

Law is binding. Guidance explains good practice, and is not binding by itself, but it is a useful guide to what is reasonable. Your own policy is what you decide to do.

A small business needs to know which layer a rule sits in. You must follow the law. You should consider the guidance. You choose your policy, and then you follow it.

This book is awareness, not legal advice.

IN PLAIN WORDS

Law you must, guidance you should, policy you choose.

Kinds of rules that can touch AI use

Learn

Privacy
Rules on collecting, using, storing and sharing personal information.

Employment
Rules on hiring, monitoring and treating staff fairly.

Anti-discrimination
Rules against unfair treatment, which can apply to AI-assisted decisions.

Consumer protection
Rules on honest claims and fair dealing with customers.

Copyright and secrets
Rules on using other people's work and protecting confidential material.

Sector rules
Extra rules in fields such as health, finance and education.

What the EU AI Act says about AI literacy

Learn

Article 4 of the EU AI Act, as shown on the European Commission's AI Act Service Desk, asks providers and deployers of AI systems to take measures to support the AI literacy of their staff and others using AI on their behalf.

It takes account of their knowledge, experience and the context of use, and it does not require anyone to guarantee a specific level of literacy for any individual.

It applies to organisations in scope of the Act, which depends on where and how you operate. Ask an adviser.

REMEMBER

Supporting your people's AI literacy is sensible whether or not the Act applies to you.

When to ask an adviser

Learn

Decisions about people
Hiring, firing, pay, credit, health or access to services.

Sensitive data
Health, children, biometric or financial data.

New markets
Selling or operating in another country or sector.

A complaint or incident
Anyone says they were harmed, or data leaked.

Rules change faster than books

Going Deeper

Check the date
Rules and guidance are updated. Look at when a source was last changed before you rely on it.

Where you operate matters
Your duties depend on place, size and sector. Advice from one country may not fit another.

The law is the floor
Legal minimums are not the same as good practice, or what your customers expect.

Contracts count too
Your agreements with customers and suppliers may add duties beyond the law.

A short example

See It

Sasha runs a small recruitment firm in Australia and has clients in Europe. She assumed rules were someone else's concern.

She lists the rules that could touch her AI use: privacy, discrimination and her clients' contracts. She then asks an adviser two focused questions, rather than a general one.

She gets clear answers in one short meeting.

THE LESSON

Know your questions before you ask an adviser.

This is a made-up example for teaching.

List the rules that may apply

Try It

1. List the AI tools and uses in your business.

2. For each, note which kinds of rules could touch it.

3. Mark the ones that affect people or use sensitive data.

4. Write two focused questions for an adviser.

YOUR TOOLS

Use paper or any notes tool. This is a list of questions, not a legal analysis.

GUIDANCE

What to look for is in the Guidance section at the end.

Check yourself

Check It

Question 1
What is the difference between law, guidance and your own policy?

Question 2
Name two kinds of rules that can touch your AI use.

Question 3
Why should you ask an adviser about hiring decisions?

Answer in your own words before you read the Guidance section at the end.

Chapter 1 in four sentences

Keep It

KEEP THIS

Law binds, guidance explains good practice and policy is your own choice. Privacy, employment, discrimination, consumer, copyright and sector rules can all touch AI use. The EU AI Act asks organisations in scope to support their staff's AI literacy. Ask an adviser about decisions on people and sensitive data.

Same tool, different risk

Chapter 2

By the end of this chapter you will be able to:

Explain why the same AI tool can be low or high risk.

Screen your AI uses by who is affected.

Spot where bias can enter.

Set up a way for people to challenge a result.

Time: about 40 minutes, including the exercise.

Risk lives in the use

Learn

The National AI Centre makes a simple point: the same AI tool can create different risks depending on how you use it. Drafting a marketing email is not the same as assessing job applications.

So ask about each use, not each tool. What is it for? Who could it affect? What would happen if it were wrong?

Source: National AI Centre, "Guidance for AI adoption: foundations" (ai.gov.au).

IN PLAIN WORDS

Judge the use, not just the tool.

A quick risk screen

Learn

Who is affected?
Customers, staff, applicants or the public.

How serious is a mistake?
Annoying, costly, or harmful to a person.

Can it be undone?
Is it easy to fix, or permanent?

Is a person in the loop?
Does someone check before it takes effect?

Is the data sensitive?
Personal, financial, health or confidential.

How bias gets in

Learn

AI learns patterns from data. If the data reflects unfair patterns from the past, the tool can repeat them, and apply them at scale.

The National AI Centre gives an example: a tool used to shortlist job applicants could unfairly reject many qualified people before anyone notices.

A person overseeing the decision, and a way for people to challenge it, are the main safeguards.

REMEMBER

Bias at scale looks like a normal process.

Ways to challenge a result

Learn

A named contact
A person or address that people can use to question a decision.

A plain explanation
Be able to say, in plain words, how the decision was made.

A fix that works
If the result was wrong, you can actually change it.

A record of the complaint
Keep a note of what was raised and what you did.

Risk is not fixed

Going Deeper

Autonomy raises it
The same chatbot is low risk in business hours with a person watching, and higher risk running all day with no oversight.

Scale raises it
A single human error affects one case. A tool's error can affect every case it touches.

Look for patterns
One odd result is a case. Ten similar complaints are a system problem. Read feedback for patterns.

Overreliance
People tend to trust a tool that is usually right. Plan for that, with checks that do not depend on attention.

A short example

See It

Marco runs a small property agency. He uses AI in two ways: to draft listing descriptions and to rank tenant applications.

Screening the two, he sees the first is low risk and he checks it himself. The second affects people's housing and could treat applicants unfairly.

He stops using the tool to rank. He uses it only to organise documents, and keeps the decision with a person who can explain it.

THE LESSON

The more it affects people, the more a person must decide.

This is a made-up example for teaching.

Screen your uses

Try It

1. List up to five ways you use AI.

2. Run the quick risk screen on each.

3. Mark which uses affect people and need a person to decide.

4. For one of them, write how someone could challenge a result.

YOUR TOOLS

Use paper or any notes tool. Do not paste real applicant or customer data anywhere.

GUIDANCE

What to look for is in the Guidance section at the end.

Check yourself

Check It

Question 1
Why judge the use, not just the tool?

Question 2
How can bias at scale go unnoticed?

Question 3
Name two parts of a way to challenge a result.

Answer in your own words before you read the Guidance section at the end.

Chapter 2 in four sentences

Keep It

KEEP THIS

The same tool can be low or high risk depending on the use. Screen each use by who is affected, how serious a mistake is, whether it can be undone, whether a person checks and whether the data is sensitive. Bias at scale looks like a normal process. Keep decisions about people with a person, and give people a way to challenge a result.

The six essential practices

Chapter 3

By the end of this chapter you will be able to:

Name the six practices in the National AI Centre guidance.

Pick the getting-started actions that fit a small business.

Match each practice to something you already do.

Choose two to start with.

Time: about 40 minutes, including the exercise.

Practices 1 and 2

Learn

1. Decide who is accountable

Name a senior person as owner of AI use and write an AI policy. Later, name a person for each AI system.

2. Understand impacts and plan

Work out who your AI use may affect, and create ways for people to raise problems or challenge results.

Practices 3 and 4

Learn

3. Measure and manage risks

Screen your AI uses for risk, and give extra attention to the risky ones.

4. Share essential information

Keep a register of the AI you use. Tell people when AI is involved, especially when it affects decisions or could be mistaken for a human.

Practices 5 and 6

Learn

5. Test and monitor

Ask suppliers for proof of testing, test before you use it and watch it afterwards. Extend your data and security habits to it.

6. Maintain human control

Make sure a person oversees the AI in proportion to its autonomy and the stakes, with points where a person can pause or override it.

Start small

Learn

The guidance says you do not need to do everything at once. Begin with the "getting started" actions in each practice, then move to the "next steps" as your use grows.

Adapt each practice to your size, uses and risk. Keep records of what you do under each one.

Source: National AI Centre, "Guidance for AI adoption: foundations", published May 2026 (ai.gov.au).

REMEMBER

Start with getting started.

Using guidance well

Going Deeper

Guidance, not law
These practices are guidance, not law. They can help you show you took care, and they do not replace legal advice.

Where you are
Other countries publish their own guidance. The ideas overlap: accountability, impact, risk, openness, testing and human control.

Fit to size
A five-person business needs a one-page version, not a framework.

Evidence helps
Records of what you did under each practice make reviews and customer questions much easier.

A short example

See It

Imani runs a ten-person accounting firm. She goes through the six practices with one page for each.

She names herself as owner, writes a short policy, lists three AI uses in a register and sets a rule that a person signs off every client-facing output. She puts a quarterly review in her calendar.

The whole exercise takes an afternoon.

THE LESSON

One page per practice is enough to start.

This is a made-up example for teaching.

Map the six practices

Try It

1. Write the six practices as headings on one page.

2. Under each, note what you already do.

3. Mark the gaps.

4. Choose two to start this month.

YOUR TOOLS

Use paper or any notes tool.

GUIDANCE

What to look for is in the Guidance section at the end.

Check yourself

Check It

Question 1
Name the six essential practices.

Question 2
Why does the guidance say you do not need to do everything at once?

Question 3
Why keep records under each practice?

Answer in your own words before you read the Guidance section at the end.

Chapter 3 in four sentences

Keep It

KEEP THIS

The National AI Centre lists six essential practices: decide who is accountable, understand impacts, measure and manage risks, share essential information, test and monitor, and maintain human control. Start with the getting-started action in each. Fit them to your size and keep records. Guidance helps, but it does not replace legal advice.

Records and openness

Chapter 4

By the end of this chapter you will be able to:

Keep a simple AI register.

Say when you use AI, and to whom.

Keep evidence of checks and sign-offs.

Review your records on a schedule.

Time: about 40 minutes, including the exercise.

An AI register

Learn

What it is
A list of every AI tool and use, including AI built into other software.

Who owns it
The named person for each use.

What data
What goes in, using the labels from Book 4.

Risk level
The result of your quick risk screen.

Last reviewed
When someone last checked that it still fits.

Tell people when AI is involved

Learn

The guidance asks organisations to make disclosure standard practice, especially where AI makes or influences decisions, creates content that could meaningfully affect people, or can be mistaken for a human.

For example, a customer using a chatbot should know it is not a human specialist.

Decide your own line for everyday drafting help, and say it plainly where it matters.

RULE OF THUMB

If it could mislead, say so.

Evidence worth keeping

Learn

Sign-offs
Who approved what, and when.

Checks
What was checked and what was found.

Incidents
What went wrong, and what changed afterwards.

Training
Who has learned what about AI use.

Review on a schedule

Learn

Put a regular review in the calendar, such as every quarter. Look at the register, the incident notes and any complaints.

Check whether uses have changed, new tools have appeared and your rules still fit.

After any incident or major change, review straight away.

REMEMBER

A review date is a promise to yourself.

Why records matter

Going Deeper

They make you consistent
Writing it down means the same question gets the same answer next month.

They protect you
If a customer or regulator asks, you can show what you did and why.

They show patterns
A log of incidents and complaints shows what keeps going wrong.

Keep them proportionate
A short, current record beats a long one nobody updates.

A short example

See It

Tessa runs a small bookkeeping firm. Her register lists four AI uses.

When a client asks whether AI touches their data, she can answer in a minute: which tool, what it sees and who signs off.

She adds a line to her client emails saying where AI helps with drafts and that a person checks everything.

THE LESSON

A short, current register answers hard questions fast.

This is a made-up example for teaching.

Build your register

Try It

1. Build a register with the five columns for every AI use in your business.

2. Add a line saying where you tell people that AI is involved.

3. Name the person who keeps it current.

4. Set the first review date.

YOUR TOOLS

A table in any tool, or on paper.

GUIDANCE

What to look for is in the Guidance section at the end.

Check yourself

Check It

Question 1
What five things belong in an AI register?

Question 2
When is it especially important to say AI is involved?

Question 3
Why is a short, current record better than a long one?

Answer in your own words before you read the Guidance section at the end.

Chapter 4 in four sentences

Keep It

KEEP THIS

Keep a short AI register: the tool and use, the owner, the data, the risk level and the last review date. Say when AI is involved, especially where it affects people or could be mistaken for a human. Keep evidence of sign-offs, checks and incidents. Review on a schedule and after any incident.

Guidance and answers

At The Back

Questions and exercises stay in the chapters, on their own slides. Guidance lives here, so you can try first and look afterwards.

Try the task or question in your own words, then compare. Where your answer differs, that is worth a note, not a correction.

WHERE TO FIND IT

The Guidance section below: answers and exercise guidance, one part for each chapter.

Chapter 1: answers and guidance

Guidance

Answer 1
Law is binding. Guidance explains good practice. Your policy is what you decide to do, and then follow.

Answer 2
Any two of: privacy, employment, anti-discrimination, consumer protection, copyright and confidentiality, or sector rules.

Answer 3
Decisions about people can have serious effects, and specific rules may apply. An adviser can tell you what applies to you.

Exercise
A good list has at least one use that touches people or sensitive data. Those uses need the most care and the best questions.

Chapter 2: answers and guidance

Guidance

Answer 1
The same tool can be low risk for one job and high risk for another, depending on who is affected and how serious a mistake is.

Answer 2
A biased process looks normal and runs on every case, so many people can be affected before anyone notices.

Answer 3
Any two of: a named contact, a plain explanation, a fix that works, and a record of the complaint.

Exercise
Most people find one use that affects people. That use needs a person in charge of the decision and a way for people to question it.

Chapter 3: answers and guidance

Guidance

Answer 1
Decide who is accountable; understand impacts and plan; measure and manage risks; share essential information; test and monitor; maintain human control.

Answer 2
The practices are meant to grow with your use. Start with the getting-started actions and add more as your use or risk grows.

Answer 3
Records show what you did and why. They support reviews and answers to customers.

Exercise
Most people find they already do part of several practices, such as human sign-off. The gaps are usually the register and the way for people to challenge results.

Chapter 4: answers and guidance

Guidance

Answer 1
The tool and use, the owner, the data, the risk level and the last review date.

Answer 2
When AI makes or influences decisions, creates content that could meaningfully affect people, or could be mistaken for a human.

Answer 3
A current record gets used and can be trusted. A long one nobody updates becomes wrong.

Exercise
A good register fits on one page. If you found a use nobody owned, give it an owner this week.

About Ekalavya Academy

Find Out More

Ekalavya Academy is a learning series from Almost Magic Tech Lab. The books are written for people who teach themselves, using the tools they already have.

Sources used: National AI Centre, "Guidance for AI adoption: foundations" (ai.gov.au), and the European Commission AI Act Service Desk, Article 4 (ai-act-service-desk.ec.europa.eu). This book is awareness, not legal advice.

Almost Magic builds tools that help people check and govern their AI use. The books never depend on those tools.

LINKS

Almost Magic: almostmagic.net.au

Case studies: ai-casestudies.almostmagic.net.au

Page for this book on the Academy site: link to be added when the page exists.

Ekalavya Academy by Almost Magic | almostmagic.net.au