Guide · Choosing an AI consultant
How to choose an AI automation consultant in Australia: questions to ask before you sign
By Angelo Hanna, founder of Mavat AI · Sydney ·
If you are looking for help with AI automation, there is no shortage of offers from software vendors, freelancers, agencies and consultants. Some will do excellent work. Others will leave you with a fragile workflow, an open-ended bill and no clear idea of where your customers’ data has gone.
This guide explains what each type of provider does, the red flags that should make you pause, and the questions to ask about data, privacy, ownership, support and pricing before you sign. It also covers how to scope a small first project, so you can test a provider on real work before committing to more. It is general information, not legal advice; for privacy obligations specific to your business, speak to your own adviser.
The short answer
Choose an AI automation consultant who starts with your workflow rather than a favourite tool, can explain in plain English where your data goes and which AI provider processes it, keeps a person in the loop for decisions with real consequences, hands over ownership of what is built, and will price a small, clearly scoped first project before asking for a larger commitment. If a provider cannot answer questions about data, ownership and support clearly before you sign, they are unlikely to answer them better afterwards.
Consultant, software vendor or freelancer: what is the difference?
The labels overlap, but the incentives differ. Agencies can fall into any of these camps; with an agency, ask who will actually do the work and who will support it after launch.
- An AI automation consultant designs and builds workflows around your business: mapping how work moves, deciding where automation fits and where it does not, connecting your existing tools and setting the controls. Their advice is only as good as their willingness to recommend less, or nothing, when that is the right answer.
- A software vendor sells a product, increasingly with AI features built in. When the product fits your process, it can be the fastest and lowest-risk option, but the vendor’s advice will naturally lead back to their product.
- A freelancer is usually one person building automations on a platform such as Zapier or Make, or writing custom code. Good freelancers can be quick and cost-effective for well-defined tasks. Ask about continuity, documentation and who has designed the controls around the workflow.
Red flags to watch for
None of these automatically rules a provider out, but each deserves a direct question.
- Savings promised before anyone has looked at your work. A credible provider measures a baseline first: how long the task takes now, how often it happens and what goes wrong.
- No clear answer on data. If you ask where your data is stored and processed and which AI provider sees it, “it’s all secure” is not an answer.
- Lock-in by design. Workflows built in the provider’s own accounts, code you cannot access, or a platform only they can maintain all make it expensive to leave.
- Per-seat fees for something you paid to have built. Understand every recurring fee and what it pays for.
- No human in the loop. Automations that email customers, quote prices or change records with no review step and no exception path are a risk, especially early on.
- Tool-first pitches, with no mention of what should not be automated. A good adviser asks how your business works before naming a platform, and will tell you that some tasks are better left with people.
Questions to ask about data and privacy
Data handling is where careful and careless providers differ most. Ask early, and get the answers in writing.
- What personal or sensitive information will the workflow touch, and can any of it be left out?
- Which AI provider will process our data, through which service, and on whose account?
- Are our inputs and outputs used to train AI models, and where does the provider state that?
- Where is our data stored, and where is it processed?
- What is logged, for how long, and who can see it?
Will our data be used to train AI models?
Most consultants do not build their own AI models; they connect your workflow to models from providers such as OpenAI, Anthropic, Google or Microsoft. The same model can come with different data terms depending on how it is accessed, so check the provider’s own policy for the exact service used. At the time of writing, OpenAI states that data sent to its API is not used to train or improve its models unless you explicitly opt in. Anthropic states that by default it does not use inputs or outputs from its commercial products, including its API, for training; feedback or bug reports and explicit permission to use data are exceptions. Microsoft states that prompts and completions sent to models in its Azure service are not used to train, retrain or improve the base models. Sources: OpenAI API data controls, Anthropic commercial data policy and Microsoft Azure model data privacy.
Free and paid access can differ. Google’s Gemini API terms say that content submitted to unpaid services may be used to improve Google’s products and read by human reviewers, while prompts and responses sent to paid services are not used to improve its products. Billing-enabled projects use paid-service data terms even for free quota; regional exceptions also apply. Check the terms for your account. Source: Gemini API terms.
Where will our data be stored and processed?
Storage and processing are not always in the same place. OpenAI lists Australia as a data residency region for storage but not for processing, and says it may process and temporarily store customer content outside a region that does not support regional processing. Microsoft processes prompts sent to standard deployments of its Azure-hosted models within the geography the customer specifies, but its “Global” and “DataZone” deployment types can process them elsewhere. Sources: OpenAI residency and processing controls and Microsoft deployment data handling.
Ask your consultant to name the region for every service in the workflow, including the automation platform, the database and the logs, not just the AI model.
How does this fit the Privacy Act?
The Privacy Act 1988 and its 13 Australian Privacy Principles (APPs) apply to many Australian businesses. There is a small business exemption for businesses with an annual turnover of $3 million or less, but it does not cover every small business. Health service providers, for example, are covered regardless of turnover. APPs that are directly relevant to AI automation include APP 6 (use or disclosure of personal information), APP 8 (cross-border disclosure of personal information), APP 10 (quality of personal information) and APP 11 (security of personal information). Sources: OAIC small business coverage and OAIC AI privacy guidance.
The Office of the Australian Information Commissioner (OAIC) has published guidance on privacy and commercially available AI products. It recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, and it encourages due diligence before an AI product is adopted. From 10 December 2026, APP entities that use personal information in automated decision-making with the potential to affect individuals’ rights or interests must also explain this in their privacy policies. Sources: OAIC AI privacy guidance and OAIC automated decision-making transparency.
A good consultant designs with these obligations in mind. Whether and how they apply to your business is a question for your own adviser.
Questions to ask about ownership, handover and support
An automation is not finished on launch day. These questions decide whether you stay in control of what you paid for.
- Who owns the code, workflows and configuration? Ideally your business does, and the contract says so.
- Whose accounts will it run in? Hosting, automation and AI provider accounts in your business’s name make changing providers far easier.
- What documentation and training will we receive? At a minimum: what each workflow does, what it connects to, its rules and exception paths, and how to switch it off.
- What happens when something breaks, or when an AI model or connected tool changes? Ask how issues are reported, how quickly they are handled and who pays for the fix.
- Could another developer take this over? If the answer is no, or not easily, treat that as a cost.
How to scope a first project
The safest way to test a consultant is on one small, real workflow with a clear boundary. A good first project has:
- A single workflow with a clear start and end, such as “an enquiry arrives” to “a reply is drafted and the record is updated”.
- A baseline: how often the task happens, how long it takes and what goes wrong now.
- Agreed boundaries: what the automation may read and change, and what it must never do without approval.
- A named person in your business who owns the workflow and reviews the exceptions.
- Acceptance criteria you can check, and a draft-first start, where anything that reaches a customer is reviewed before it is sent.
Not sure which workflow to start with?
Map the candidates before you talk to providers. See our guides on mapping your workflows before buying software and where to start with AI automation.
How pricing is usually structured
Rates vary widely and are rarely published on a comparable basis, so it is more useful to understand the common pricing models and what each one rewards.
- Fixed price per phase. An agreed price for a defined scope, deliverables, exclusions and acceptance criteria. You know the cost before work starts, and the provider carries the risk of their own estimate. It needs a clear scope, which is why paid discovery often comes first.
- Hourly or daily rates. Flexible when the scope is genuinely uncertain, but the total is open-ended. Ask for estimates, caps and regular reporting.
- Retainers. A monthly fee for agreed support, improvement or availability. Useful once workflows are running; less useful for buying an undefined first project.
- Licences or subscriptions. An ongoing fee, per user or per workflow, to keep using what was built. Find out what it covers and what happens if you stop paying.
Separate build costs from running costs
Whatever the model, separate the one-off build cost from the costs of running the workflow: the automation platform, AI usage (usually charged according to volume), hosting and support. Ask who pays each bill and whose account it sits in. For a wider view of cost drivers, see how much a custom CRM costs in Australia.
Use the government’s AI guidance as a checklist
The Australian Government’s Guidance for AI Adoption, published by the National AI Centre, sets out six essential practices: decide who is accountable, understand impacts and plan accordingly, measure and manage risks, share essential information, test and monitor, and maintain human control. It is written for organisations using AI, but it also works as a checklist for a consultant: ask how their approach covers each practice. Source: National AI Centre essential AI practices.
Where Mavat fits
Mavat is a founder-led Sydney business that builds custom business systems, custom CRMs and controlled AI automation for growing service businesses. The first conversation is a free fit call. Where a workflow needs proper investigation, a paid Workflow Blueprint maps it before any build is proposed, and builds are priced as fixed-price phases. Clients own what is built, and there are no per-seat licences.
Explore AI automation consulting and the Workflow Blueprint, or get in touch.
Straight answers
Frequently asked questions.
What does an AI automation consultant do?+
They map how work moves through your business, decide where AI and automation genuinely help, build workflows that connect your existing tools, and set the controls around them: permissions, exception paths, human review and logging.
How much does an AI automation consultant cost in Australia?+
It depends on the scope and the pricing model: fixed-price phases, hourly or daily rates, retainers or ongoing licences. Be cautious of any firm quote given before the provider understands your workflow.
Is it safe to put customer data into ChatGPT or other AI tools?+
The OAIC recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools. For business workflows, use access with documented data terms and keep information the task does not need out of the workflow.
Does the Privacy Act apply to my small business?+
Not always. There is an exemption for businesses with an annual turnover of $3 million or less, but some small businesses are covered regardless, including health service providers. Confirm your position with your own adviser.
Who should own the automations a consultant builds?+
Your business, ideally in writing, with the workflows running in accounts in your business’s name and enough documentation for another developer to take over.
Related
Want a straight answer for your business?
Tell Angelo which workflow is slowing the team down. The fit call is free; detailed workflow analysis and the recommended build plan are completed through a paid Workflow Blueprint.
Get in touch