AI governance in Australia: the 2026 guide
There is no AI Act yet, but there are dates. The rules that apply to an Australian business that buys or builds AI, in order, and what to do about each one this quarter.
Australia has no AI Act in force. AI governance here means meeting the laws you already have, the Privacy Act, consumer law, workplace safety and anti-discrimination law, and following voluntary guidance from the National AI Centre and Australia's cyber agency. The first dated obligation for most businesses is the Privacy Act change on 10 December 2026.
This page sets out which rules apply to a business that buys or builds AI, in date order, and links to the longer guide we have written on each. It is general information written by people who build AI systems. It is not legal advice, so check your own situation with your lawyer.
Is there an AI law in Australia?
There is no Australian AI Act in force yet, and the two national AI frameworks are voluntary. That is changing. On 15 July 2026 the Prime Minister signalled a standards-led framework for AI, and supporting legislation for national AI standards is expected in Parliament in early 2027. On 8 October 2026 Assistant Minister Andrew Charlton said the government has "committed to legislating National AI Standards for frontier AI".
Those standards are aimed at large data centres and the labs that train the biggest models. If your business buys AI and does not train frontier models, nothing published so far gives you a new legal duty under them. What they change is what you can expect from your vendors. Our reading of the announcement is in AI safety standards are coming. What changes for buyers?
Which AI rules and dates matter for an Australian business?
- January 2024: Engaging with artificial intelligence. The cyber agency's baseline for using AI securely, written for small and medium businesses too.
- September 2024: Voluntary AI Safety Standard. Ten rules for developers and deployers. Still published, and now evolved into the six practices below.
- 21 October 2025: Guidance for AI Adoption. The National AI Centre's six essential practices. Voluntary, and the framework to build to now.
- 18 February 2026: NSW Digital Work Systems Act assented. Its duties on software that allocates work have not started yet.
- 1 May 2026: Careful adoption of agentic AI services. The cyber agency's guidance for AI that takes actions.
- 1 July 2026: CPS 230 transition ends. APRA regulated entities had to bring material service provider contracts, AI vendors included, into line.
- 10 December 2026: Privacy Act, automated decisions. Your privacy policy must describe automated decisions that could significantly affect people.
- Early 2027, expected: national AI standards legislation. Aimed at frontier AI. No date set.
Filled circles are in force or published. The outlined circle has no fixed date yet. Dates checked against the sources at the foot of this page on 12 October 2026.
What do the six AI practices ask you to do?
The National AI Centre's Guidance for AI Adoption replaced the 2024 standard as the government's current advice. It comes in two versions: Foundations, for businesses that configure AI inside tools like HubSpot, Microsoft or Google, and Implementation, for teams that build or customise AI systems.
| Practice | The smallest version that counts |
|---|---|
| 1. Decide who is accountable | One named person against each AI system, who knows they own it |
| 2. Understand impacts and plan accordingly | A short written impact note for each use |
| 3. Measure and manage risks | AI cases added to the risk register you already have |
| 4. Share essential information | Disclosure to the people affected, and an honest privacy policy |
| 5. Test and monitor | A test set you rerun, and logging somebody reads |
| 6. Maintain human control | A documented way to override or stop it, used at least once |
Register the uses, as well as the tools. The guidance's own example is that an internal chatbot carries a different risk from AI used in hiring or customer decisions, even on the same software. The detail is in the 10 guardrails or the 6 practices: which framework applies to you, and a one-page version you can adopt is in who signs off on AI.
What does the Privacy Act ask of AI?
Three parts of it come up on almost every AI project we scope.
- Automated decisions, from 10 December 2026. If a computer program uses personal information to make decisions that could reasonably be expected to significantly affect someone's rights or interests, your privacy policy has to say what kinds of information and decisions are involved. It says "a computer program", so a plain if-then rule in your CRM can be in scope. Lead scoring is the one that surprises people. What changes and the five step fix.
- Sending data offshore. Personal information sent to an AI model processed outside Australia is a cross-border disclosure under Australian Privacy Principle 8. Where your data goes when you use AI covers which plans and regions do what.
- Keeping it secure. APP 11 asks you to protect the personal information you hold, which includes the copies and logs an AI system keeps. Who should own your CRM explains why that makes ownership a legal question.
Does the Essential Eight cover AI, and how do you secure it?
No. The Essential Eight protects internet-connected IT networks, was last updated in November 2023, and none of its eight strategies address AI. Australia's cyber agency covers AI in two separate papers: Engaging with artificial intelligence from January 2024, for AI that answers, and Careful adoption of agentic AI services from 1 May 2026, for AI that acts. If a buyer asks whether you meet the Essential Eight and how you secure your AI, those are two answers and you need both.
An agent sits on all three layers, so it needs all three sets of controls.
The longer versions: does the Essential Eight cover AI?, how do you secure AI? What the ACSC actually says, and can someone hijack your AI by emailing you? If a customer is about to send you their questions, the AI security questionnaire your buyer's CTO is about to send has the five we ask first.
Are you APRA regulated? Then CPS 230 already applies to your AI vendors
CPS 230 applies to banks, insurers, super funds and private health insurers. Material service provider arrangements need a register entry and specific contract terms, and existing contracts had to be brought into line by the earlier of their renewal or 1 July 2026. On 30 April 2026 APRA wrote to industry that AI governance is lagging AI adoption, and named third party and supply chain risk as the biggest gap. Is your AI vendor a material service provider under CPS 230? covers the register and the four contract terms most agreements lack.
Does workplace law cover AI that hands out work?
In NSW it will. The Work Health and Safety Amendment (Digital Work Systems) Act 2026 treats algorithms, AI, automation and online platforms that allocate work as a health and safety matter. It was assented to on 18 February 2026, and as at 12 October 2026 its duties had not commenced. If HubSpot round robin, AI lead scoring or activity targets decide who gets which lead or ticket, read does NSW's AI work law cover your lead routing?
What should a 100-person business do this quarter?
Most of the work is a register, a policy and one privacy policy update. In the order we would do it:
| Do this | Who usually owns it | Why now |
|---|---|---|
| List every use of AI, with the system, the data it reads and one named owner | Operations or RevOps lead | Practice 1, and the basis for everything else |
| Mark which uses make decisions about people, such as scoring, routing or eligibility | The same owner, with whoever owns privacy | The Privacy Act change on 10 December 2026 |
| Update the privacy policy to describe those decisions | Whoever owns privacy, checked by your lawyer | Required from 10 December 2026 |
| Adopt a one-page AI policy: approved tools, what never goes in a prompt, who approves a connector | A director | Practices 1 and 4, and the first thing a buyer's questionnaire asks for |
| Ask each AI vendor where data is processed, whether it trains on your data, and what they log | Whoever signs the contract | APP 8, and CPS 230 if you are APRA regulated |
| For anything that acts, add a test set, a log and a way to stop it | The system's named owner | Practices 5 and 6, and the 2026 agent guidance |
How do we govern our own AI?
We follow the steps above ourselves. Our AI Security and Governance Overview is public and written to be shared with procurement teams. Every agent acting on our behalf runs under a Green, Amber and Red action policy: low-risk actions run and are logged, risky ones notify a person first, and irreversible ones wait for a person to approve them. Agents get credentials scoped to the task, granted per engagement and revoked when it ends. A director is accountable for the policy and reviews the Red queue.
The same overview lists the models we use and where each one processes data. If you are building AI with any supplier, ask them for the equivalent document. Who owns the AI system after we leave? covers the contract terms to ask for at the same time, because in Australia the default on code ownership is the opposite of what most people assume.
Frequently asked questions
Is there an AI Act in Australia? No. There is no AI Act in force. The government has committed to legislating national AI standards for frontier AI, with legislation expected in early 2027, and those standards are aimed at large data centres and the labs that train the biggest models.
Which AI framework should an Australian business follow? The National AI Centre's Guidance for AI Adoption, published on 21 October 2025. Its six practices are accountability, impacts, risk, sharing information, testing and monitoring, and human control. It is voluntary and replaces the 2024 Voluntary AI Safety Standard as the current advice.
What changes on 10 December 2026? Your privacy policy must describe the kinds of personal information used, and the kinds of decisions made, when a computer program makes decisions that could reasonably be expected to significantly affect someone's rights or interests. Plain CRM rules such as lead scoring can be in scope.
Does the Essential Eight cover AI? No. The Essential Eight protects IT networks and none of its eight strategies address AI. Australia's cyber agency covers AI in two separate papers, one from January 2024 for AI that answers and one from May 2026 for AI agents that take actions.
Do we need an AI policy? It is not a legal requirement on its own, but it is the simplest way to meet the six practices and the first thing a buyer's security questionnaire asks for. One page is enough: approved tools, what never goes in a prompt, who approves a connector and who owns each system.
Read next
- The 10 guardrails or the 6 practices
- The Privacy Act change on 10 December 2026
- Does the Essential Eight cover AI?
- How do you secure AI? What the ACSC says
- A one-page AI policy you can actually use
- AI vendors under CPS 230
- NSW's AI work law and your lead routing
- AI agents for business in Australia
Sources
- Guidance for AI Adoption, National AI Centre, 21 October 2025.
- Voluntary AI Safety Standard, National AI Centre, September 2024.
- Speech at the Sydney Trust and Safety Festival, Assistant Minister Andrew Charlton, 8 October 2026.
- Guidance for transparency in automated decision making, OAIC.
- APP 8 guidelines, cross-border disclosure, OAIC.
- Essential Eight, Australian Signals Directorate.
- Engaging with artificial intelligence, ASD's ACSC, January 2024.
- Careful adoption of agentic AI services, ASD's ACSC and partners, 1 May 2026.
- CPS 230 Operational Risk Management and the letter to industry on AI, APRA.
- Work Health and Safety Amendment (Digital Work Systems) Act 2026, NSW legislation.
Neighbourhood builds AI systems on Claude for Australian businesses, with the governance written down before the build starts.
Is your AI ready for 10 December?
Book 15 minutes and tell us what AI your team uses today. We will find the uses that make decisions about people, which are the ones the Privacy Act change covers, and tell you what your privacy policy and AI register need before then. Your lawyer still signs it off.