Australia AI Regulation

Australia is one of the clearest examples of a jurisdiction that looked headed for an EU-style AI law and then changed course. In September 2024 the government proposed ten mandatory guardrails for high-risk AI, covering things like risk-management plans and pre- and post-deployment testing. The National AI Plan, released on December 2, 2025, dropped that approach: no standalone AI act, and the mandatory guardrails paused. Older guidance that describes Australian AI legislation as likely or imminent is out of date.

What the National AI Plan decided

• Existing law first. The government committed to "strong existing, largely technology-neutral legal frameworks" and to regulators' existing expertise rather than a new AI statute.
• AI Safety Institute. A new institute, funded at about A$30 million, begins monitoring AI from 2026 and is meant to advise on where stronger responses might be needed and where the law has gaps.
• Targeted reviews. The government said it would work with states and territories on clarifications to consumer protection rules, and review how copyright law applies to AI and how AI is regulated in health care.
• A reserved power. The government said it "will not hesitate to intervene" if more regulation proves necessary. Critics, including the former industry minister who proposed the guardrails, have warned that relying on existing law leaves gaps.

What applies to AI systems now

There is no AI-specific statute, so the practical baseline is existing law applied to AI use cases:

• The Privacy Act 1988 governs personal information used by AI systems. The most concrete new obligation sits here (see below).
• The Australian Consumer Law, enforced by the ACCC, applies to misleading or deceptive conduct involving AI-generated content or capability claims.
• Sector regulators in financial services, health and other areas apply their existing frameworks to AI within their remits.

The December 10, 2026 deadline: automated decision-making transparency

The Privacy and Other Legislation Amendment Act 2024 added new transparency requirements to Australian Privacy Principle 1 (APP 1.7 to 1.9). From December 10, 2026, entities covered by the Australian Privacy Principles must disclose in their privacy policies when they use a computer program to make, or do a thing substantially and directly related to making, a decision that significantly affects an individual's rights or interests, using that person's personal information. It is a transparency duty rather than a ban or a new substantive restriction, but advisers stress that meeting it means mapping which systems and decisions are in scope, not just editing a policy. The Office of the Australian Information Commissioner released a fact sheet, updated APP 1 guidelines and a decision flowchart on September 30, 2026.

What to verify

This page draws on the official plan coverage and law-firm and regulator commentary, not a clause-by-clause reading of the Act. Commentators also report that mandatory requirements for Commonwealth agencies started on June 15, 2026 with full compliance due by December 10, 2026, and that National Cabinet endorsed developing mandatory standards for large data centres in August 2026. We have not confirmed those two points against primary sources, so check the OAIC guidance and the government's own pages before relying on them.

Practical guidance

For a company with AI exposure in several jurisdictions, Australia is no longer a case of building to an expected statute. The work is smaller and more concrete: inventory the automated decisions that significantly affect individuals, update privacy policies before December 10, 2026, and keep consumer-law exposure for AI claims in view. Companies already preparing for the EU AI Act or Canada's privacy-law baseline will find most of that documentation reusable.

See every upcoming date on our AI compliance deadlines calendar.