AI Regulations in Australia: What Applies to Your Business

Australia has no single AI Act. Your business is regulated by the laws it already follows (privacy, consumer, discrimination, directors’ duties and more), applied to how you and your staff use AI, plus voluntary government guidance that shows what good practice looks like. The hard part for most owners is not reading the rules. It is knowing which AI tools your people actually use, and with what data. We built our AI readiness assessment to answer that: an anonymous staff survey that turns into a scored report and a 90-day plan.

CalibreforumSee Where AI Is Used Across Your BusinessCalibre Forum’s AI readiness assessment surveys employee use and delivers a scored report with a 90-day action plan.Visit

TL;DR

There is no standalone AI law for businesses. The Department of Industry, Science and Resources (DISR) says existing laws of general application can apply to how organizations develop and deploy AI.
The Privacy Act 1988 applies whenever AI touches personal information, including what staff type into a chatbot.
From 10 December 2026, new automated-decision transparency rules start for organizations covered by the Australian Privacy Principles (APPs).
The Voluntary AI Safety Standard and the National AI Centre’s six essential practices are not binding, but they are the clearest roadmap for governance.
You cannot govern or disclose AI use you cannot see. Start with an inventory of what staff really use.

Which laws apply to AI in Australia today
Privacy law is where most businesses are exposed first
Voluntary standards: what they are and why they still matter
What is new in government policy
The gap: policy on paper versus AI in practice
A practical compliance sequence for a small or medium business
What the Calibre Forum assessment does
Our perspective
FAQ
Sources

Which laws apply to AI in Australia today

Australian law regulates AI by default, through the rules that already cover your conduct. DISR lists the existing laws that may be relevant to AI: directors’ duties, privacy law, critical-infrastructure and sector cybersecurity obligations, negligence, the Australian Consumer Law, product safety and liability, criminal law, online safety, defamation, intellectual property and copyright, contract and confidentiality duties, and anti-discrimination law (DISR, 21 October 2025).

In practice, that looks like this:

Everyday AI use	Law most likely to matter
Staff paste customer details into a public chatbot	Privacy Act and the APPs
A tool screens job applicants or ranks staff	Anti-discrimination law, privacy
AI-written marketing makes claims about a product	Australian Consumer Law
Staff upload client contracts or supplier data	Confidentiality and contract duties
AI drafts content from third-party material	Copyright and intellectual property
Leaders sign off on AI use without oversight	Directors’ duties

Sector rules add to this. DISR notes that product safety, motor-vehicle, surveillance and sector-specific laws may apply depending on the use case. A medical clinic, an aged care provider and a recruitment agency each face a different mix, which is why one generic checklist rarely fits.

Privacy law is where most businesses are exposed first

For a typical small or medium business, the Privacy Act is the rule that bites soonest, because AI tools are so often fed personal information. The Office of the Australian Information Commissioner (OAIC, the privacy regulator) states that the Privacy Act 1988 and the Australian Privacy Principles apply to AI uses involving personal information, including training, testing and use of AI systems (OAIC guidance on commercially available AI products, updated 17 January 2025).

The same guidance sets out what that means for an organization using AI products:

Treat prompts and any outputs containing personal information as covered by the Privacy Act.
Do due diligence on the product and its vendor, including testing, human oversight, access, privacy and security.
Make sure the conditions for collecting personal information (APP 3) and for using or disclosing it (APP 6) are met.
Update privacy notices and policies so people are told how AI is used.
Identify public-facing chatbots as AI.
As best practice, do not enter personal or especially sensitive information into public generative AI tools.

That last point is the one that most often goes wrong in daily work, because it depends on what each employee decides to paste at 4 pm on a Friday. We cover the practical side in what staff can paste into AI tools under the Privacy Act.

What changes on 10 December 2026

The Privacy and Other Legislation Amendment Act 2024 added automated-decision transparency obligations (APP 1.7 to 1.9) that commence on 10 December 2026, according to the OAIC. From that date, an APP entity must put specified information in its privacy policy if it arranged for a computer program to make a decision, or do something substantially and directly related to making one, that could reasonably be expected to significantly affect an individual’s rights or interests, and personal information about that person is used.

What that means for you: if software helps decide who gets a job interview, a loan, a service, a price or a rostered shift, your privacy policy needs to say so. The first job is finding where that happens, and in many businesses nobody has a full list. Check whether your business is covered by the APPs with the OAIC, and talk to your lawyer about your specific policy wording.

Café employee checking a shift assignment

Voluntary standards: what they are and why they still matter

Two layers of guidance sit on top of the law. Neither creates legal duties, but both show what a regulator, a client or an insurer would call reasonable.

The Voluntary AI Safety Standard. DISR is explicit that the standard and its 10 guardrails do not create new legal obligations. They are intended to help organizations operate within existing Australian law (DISR). The guardrails cover accountability and governance, risk management, system security and data governance, testing and monitoring, meaningful human oversight, informing users about AI, challenge and contestability processes, supply-chain transparency, record keeping, and stakeholder engagement (Voluntary AI Safety Standard, August 2024).

The Guidance for AI Adoption. Published by the National AI Centre on 21 October 2025, it streamlined the earlier standard into six essential practices for safe and responsible AI governance (DISR). Its implementation guidance is the most practical document in this space.

If you want one place to start, start there. It asks organizations to:

Name an AI owner and set up a governance structure.
Keep an inventory and a register of AI use cases.
Set a risk appetite and decide which uses are unacceptable.
Triage each use case, then document stakeholder-impact, legal, privacy, security, commercial and reputational assessments.
Require testing, human oversight, escalation paths, incident response and monitoring across the lifecycle.
Reassess after controls are added or something material changes.

Notice that steps 2 and 3 depend on knowing what is in use. The remaining steps are paperwork around that fact. For a worked view of the risk steps, see our guides on AI risk mitigation and AI model risk management, and this audit-ready AI reporting roadmap on triage, residual risk and monitoring.

What is new in government policy

Some recent changes apply to government rather than private business, but they signal direction.

Government agencies. Version 2.0 of the Policy for the Responsible Use of AI in Government took effect on 15 December 2025 and applies to non-corporate Commonwealth entities, with some exceptions. It requires accountable officials, transparency statements, use-case registers, staff training and impact assessments (Digital Transformation Agency). If you supply to government, expect clients to ask similar questions of you.
Office of AI and data centres. On 15 July 2026 the Prime Minister announced the Office of AI would be established that day, and that Australian Standards for AI would set rules for large data centres, covering power, connection costs, water efficiency, location and community input. They were expected to be legislated in early 2027 (Prime Minister of Australia). That concerns infrastructure operators rather than a business using AI tools.

Check the National AI Centre for the latest, since this area moves quickly.

The gap: policy on paper versus AI in practice

Every framework above assumes you already know how AI is being used in your business. Most owners and managers do not. Staff adopt chatbots, browser extensions, meeting transcribers and built-in assistants on their own, often with good intentions and no record. Three problems follow.

Privacy exposure. You cannot meet APP obligations or update your privacy policy for automated decisions you do not know about.
Security blind spots. Data leaves through tools IT never approved. Our AI security checklist and AI access control guide cover what to lock down once you know.
Policies nobody follows. A policy written without staff input describes how work should happen, not how it does. See what to include in an AI policy and how to enforce it, or the shorter small business AI policy outline.

The National AI Centre says successful adoption depends on people and culture: consult workers, provide training, define accountability, assess effects on staff and customers, make AI use transparent and keep human judgement in key decisions (Get ready for AI). Consulting workers is the step that is hardest to do well. People under-report tools when they fear being blamed, which is why anonymity matters. For the training piece, AI training programs are one way to build staff capability once you know where the gaps are.

A practical compliance sequence for a small or medium business

Here is the order we would work in.

Find out what is really used. Ask every staff member, not just the IT team, which AI tools they use, for what tasks and with what kinds of data. Make it anonymous so the answers are honest. We explain how in running an AI staff survey honestly and anonymously.
Sort by data and decision. Mark every use that involves personal information, client confidential material, or a decision about a person. These are where the Privacy Act, anti-discrimination law and the December 2026 rules matter most.
Set the rules. Write a short policy: approved tools, what must never be pasted in, who owns AI risk. Our data governance guide and generative AI governance guide go deeper.
Update disclosures. Revise privacy notices, and where automated decisions significantly affect people, prepare the privacy policy wording ahead of 10 December 2026. Get legal advice on the wording.
Train and review. Teach staff what the rules mean for their daily tasks (AI security awareness for staff), then reassess regularly, because tools and usage change month to month.

What the Calibre Forum assessment does

Our assessment is built around step 1, then carries you through steps 2 to 5. Staff complete a structured, anonymous survey about the AI tools they use, their workflows and how technology fits into their work. We combine the responses into a scored report that maps current capabilities, identifies risks and sets out a tailored 90-day action plan with concrete operational and security recommendations. Nothing is installed, and no individual data is collected. You can see the contents in what is in the readiness report.

The report is A$1,990 as a one-off. If you want to track progress, the membership is A$2,388 per year and covers recurring quarterly assessments and reports.

Calibreforum

Start with the Report if you want a clear picture and a plan. Sector-specific versions exist for managed service providers, medical clinics, aged care and NDIS providers, RTOs, recruitment agencies, engineering consultancies and vet clinics.

The report does not make compliance or legal claims, and it is not legal advice. It gives you the visibility that your lawyer, your privacy officer and your IT provider all need to do their work.

Our perspective

Regulation in Australia is arriving as a patchwork: existing laws, a privacy regulator with clear expectations, and voluntary standards that read like a checklist. Every one of them starts from the same question: what AI is being used in your business, by whom, and with what data?

In our view, the fastest way to answer that is to ask everyone, and to let them answer safely. A survey of every staff member, kept anonymous, gives a more honest map than an IT audit alone, because it captures the tools people choose for themselves and the way they use them. It also builds trust: when people see that the point is visibility and next steps, not blame, they tell you more.

That is why our assessment surveys the whole organization, scores the results and finishes with a 90-day plan. You get a place to start on governance, privacy and security, in a form a busy owner or manager can act on. Then a quarterly repeat shows whether it is working.

Anthony

FAQ

Is there an AI Act in Australia?

No single AI law for businesses applies today. DISR says existing laws of general application, such as privacy, consumer, discrimination and copyright law, may affect how organizations develop and deploy AI. Government guidance and standards sit alongside them as voluntary tools.

Do the OAIC’s AI guidelines apply to my business?

If your business is covered by the Privacy Act and uses AI with personal information, yes, the OAIC’s guidance explains how the APPs apply. It covers vendor due diligence, using personal information in prompts, and updating privacy notices. Ask your lawyer whether your business is an APP entity.

Is the Voluntary AI Safety Standard mandatory?

No. DISR says the standard and its 10 guardrails do not create new legal obligations. They are intended to help organizations operate within existing law, and many businesses use them as a governance checklist.

What changes for privacy and AI on 10 December 2026?

APP entities must include specified information in their privacy policy where a computer program makes, or substantially helps make, a decision that could significantly affect someone’s rights or interests using their personal information. Find where that happens in your business before the date.