How Is AI Regulated in Australia, and What Does It Mean for Your Business?

The short answer

Australia does not have a dedicated AI Act. AI is regulated through existing laws, such as privacy, consumer protection, anti-discrimination and sector rules, with voluntary government guidance setting out what good practice looks like. The current guidance is the National AI Centre's Guidance for AI Adoption, released on 21 October 2025, built around six essential practices. For businesses, the practical task is to apply the laws you already follow to the AI you already use, and to show you have taken reasonable, documented steps.

This article reflects our understanding at the time of writing. AI policy in Australia is evolving, so check current guidance from the Department of Industry, Science and Resources, the OAIC and your sector regulator. It is general information, not legal advice.

Is there an AI law in Australia?

Not a standalone one. Successive government consultations considered mandatory guardrails for high-risk AI, but the direction set by the National AI Plan in December 2025 was to rely on existing laws and regulators as the foundation, supported by voluntary guidance and new government capability such as an AI Safety Institute.

That does not mean AI is unregulated. Most Australian law is technology-neutral. If an AI tool misleads a customer, mishandles personal information or discriminates against a job applicant, the same laws apply as if a person had done it.

Which existing laws apply to AI?

The OAIC has published specific guidance on privacy and the use of commercially available AI products, which is essential reading for any business using AI tools with personal information.

What is the Guidance for AI Adoption?

The Guidance for AI Adoption is the government's current voluntary framework for responsible AI. It was published by the National AI Centre, part of the Department of Industry, Science and Resources, and the department describes it as updated and simplified guidance that evolves the 2024 Voluntary AI Safety Standard. The earlier standard's ten guardrails are condensed into six essential practices:

1. Decide who is accountable: name owners for AI use and AI systems.
2. Understand impacts and plan accordingly: consider who could be affected and how.
3. Measure and manage risks: assess and treat AI-specific risks proportionately.
4. Share essential information: be transparent with users and affected people about AI use.
5. Test and monitor: check AI systems before and after deployment.
6. Maintain human control: keep meaningful human oversight and the ability to intervene.

The guidance comes in a foundations version for organisations starting out or using AI in lower-risk ways, and an implementation version for organisations building AI or running higher-risk use cases. The National AI Centre also provides supporting templates, such as an AI policy template and an AI register template.

If your existing AI policy was written against the ten guardrails, you do not need to start again. Map it to the six practices and update the references.

What about the automated decision-making changes?

The Privacy and Other Legislation Amendment Act 2024 requires APP entities, from 10 December 2026, to include information in their privacy policy when computer programs use personal information to make, or substantially and directly contribute to, decisions that could significantly affect individuals' rights or interests. That captures many AI-assisted processes, not only fully automated ones. We explain the detail in what the Privacy Act reforms mean for business.

What should businesses do now?

A proportionate plan for a mid-sized business:

1. Find your AI. Build an inventory covering standalone tools, AI features inside existing software, and AI used by suppliers on your behalf.
2. Assign owners. Each AI use needs a named business owner, not just IT.
3. Screen for risk. Flag uses that affect customers, employees, money or legal rights for closer review.
4. Set a usage policy. Define approved tools, prohibited data types and when human review is required.
5. Update privacy disclosures. Identify automated decisions and reflect them in your privacy policy before 10 December 2026.
6. Check suppliers. Ask how vendors use your data, where it is processed and whether it trains their models.
7. Report to the board. Provide a short, regular summary of AI use, risks and controls.

For organisations wanting a formal, auditable structure, the international ISO/IEC 42001 AI management system standard aligns well with the six practices.

What should boards watch?

Directors should assume AI is already used across the business, including without approval. Key questions are whether the organisation knows where AI is used, which uses are high-impact, and whether controls match the risk. Our article on board AI governance and liability covers directors' exposure in more depth.

Also watch for change. Government has signalled further work on AI standards and on specific areas such as large data centres. A governance approach built on the six practices and existing law will adapt far more easily than one built around a single checklist.

Navigating AI regulation with The Technology Office

The Technology Office helps Australian organisations turn a shifting regulatory picture into clear, proportionate action. As an independent, vendor-neutral advisor, we are not selling an AI platform, so we can give a straight view on where AI creates value and where it creates exposure. Our CIO-level and board experience means AI governance is connected to strategy and risk appetite, not left as a side project.

Through our AI governance consulting and AI consulting, we build AI inventories, policies and risk processes aligned to the Guidance for AI Adoption and current law, and we report to boards in plain English. We work with businesses of any size, in any industry, across Australia.