Australia's AI regulatory landscape.

Australia's Voluntary AI Safety Standard (2024)

• →Guardrail 1: establish, implement and publish an accountability process, including governance, internal capability and a strategy for regulatory compliance
• →Guardrail 2: establish and implement a risk management process to identify and mitigate risks
• →Guardrail 3: protect AI systems, and implement data governance measures to manage data quality and provenance
• →Guardrail 4: test AI models and systems to evaluate performance, and monitor the system once deployed
• →Guardrail 5: enable human control or intervention to achieve meaningful human oversight across the life cycle
• →Guardrail 6: inform end-users about AI-enabled decisions, interactions with AI and AI-generated content
• →Guardrail 7: establish processes for people impacted by AI systems to challenge use or outcomes
• →Guardrail 8: be transparent across the AI supply chain about data, models and systems
• →Guardrail 9: keep and maintain records to allow third parties to assess compliance with the guardrails
• →Guardrail 10: engage stakeholders and evaluate their needs, with a focus on safety, diversity, inclusion and fairness

Privacy Act 1988 and the Australian Privacy Principles

• →APP 1: a clearly expressed, up-to-date privacy policy about how personal information is managed, including where AI processes it
• →APP 3: collect personal information only where reasonably necessary for your functions or activities; sensitive information, including biometrics used for identification, also needs consent unless an exception applies
• →APP 6: use or disclose personal information for the purpose it was collected, or another purpose only with consent or an exception, such as a related purpose the individual would reasonably expect
• →APP 11: take reasonable steps to protect personal information, including in AI tools and systems
• →Notifiable data breaches: assess a suspected eligible data breach within 30 days and notify the Commissioner and affected individuals of an eligible one (Part IIIC)
• →Further reform: on 31 August 2026 the Government released draft legislation for consultation, including a fair and reasonable test, a right to erasure from large platforms, stronger consent standards and limits on trading in personal information (submissions were due by 18 September 2026)

APRA Prudential Standards: CPS 230, CPS 234, CPS 220 and SPS 220

• →CPS 230, operational risk management, including risks from material service providers, which can include AI providers
• →CPS 234, AI systems are information assets to be classified and protected; CPG 234 is non-binding guidance on meeting it
• →CPS 220 (banks and insurers) or SPS 220 (superannuation trustees), AI risk must be identified and managed in the enterprise risk framework
• →APRA’s April 2026 letter on AI lists model risk among the risk domains AI cuts across, and found few entities had continuous validation or monitoring for drift and bias
• →Material service providers need a service provider management policy, a register submitted to APRA annually, and formal agreements with minimum terms (CPS 230)
• →The Board oversees operational risk management (CPS 230), and APRA expects boards to maintain sufficient understanding and literacy with respect to AI (April 2026 letter)

ASIC Conduct Obligations in Financial Services AI

• →Responsible lending obligations apply to AI-driven credit assessment
• →Best interests duty applies to AI-assisted financial advice
• →RG 271, AI-driven decisions subject to IDR obligations
• →AI chatbots making product representations create conduct liability
• →Anti-hawking provisions apply to AI-initiated contact
• →Market conduct obligations apply to algorithmic trading and pricing

Australian Consumer Law and ACCC Enforcement

• →Prohibition on misleading and deceptive conduct applies to AI-generated content
• →AI chatbot false representations are the deploying organisation's legal liability
• →Dynamic pricing AI subject to unconscionable conduct provisions
• →Dark pattern AI subject to ACL prohibitions
• →Algorithmic price discrimination can breach anti-discrimination and ACL provisions
• →AI-generated advertising must comply with ACL representations standards

Fair Work Act and AI-Driven Workplace Change

• →Consultation obligations triggered by AI-driven major workplace change
• →AI performance data subject to procedural fairness requirements
• →Redundancy driven by AI must still meet FWA genuine redundancy tests
• →Many enterprise agreements have specific technology change consultation clauses
• →AI monitoring subject to state-based workplace surveillance laws (especially NSW, ACT)
• →Anti-discrimination law applies to AI-driven employment decisions

Privacy and Other Legislation Amendment Act 2024

• →New APP 1.7: the privacy policy must cover decisions a computer program makes, or does a thing substantially and directly related to making, where the decision could reasonably be expected to significantly affect an individual’s rights or interests and their personal information is used
• →APP 1.8: the policy must state the kinds of personal information used, the kinds of decisions made solely by such programs, and the kinds of decisions a program does a thing substantially and directly related to making
• →APP 1.9: a decision includes refusing or failing to decide, effects can be adverse or beneficial, and examples include benefit decisions, contractual rights and access to a significant service or support
• →Schedule 1 Part 15 commences 10 December 2026 and applies to decisions made after that date; a missing APP 1.7 statement becomes a civil penalty contravention under s 13K(1)(b)(iia)
• →Civil penalty for serious interferences with privacy (section 13G): for a body corporate, the greater of $50M and either three times the benefit or, if a court cannot determine it, 30% of adjusted turnover; separate criminal doxxing offences added to the Criminal Code
• →Statutory tort for serious invasions of privacy (Schedule 2), a new individual right of action from 10 June 2025

Australia's AI6 Guidance for AI Adoption (October 2025)

• →Decide who is accountable, name the person or role responsible for each AI system
• →Understand impacts and plan accordingly, assess who could be affected before deployment
• →Measure and manage risks, identify and mitigate risks in proportion to the use case
• →Share essential information, tell users and affected people what they need to know about AI use
• →Test and monitor, evaluate AI systems before deployment and monitor them in operation
• →Maintain human control, keep meaningful human oversight proportionate to the stakes

APRA CPS 230: Operational Risk Management

• →Material service providers, which can include AI providers, must be identified, recorded in a register and managed under a service provider management policy
• →Formal legally binding agreements for all material arrangements, with minimum terms including audit access, APRA access and sub-contractor liability
• →The Board oversees operational risk management, within a defined risk appetite with indicators, limits and tolerance levels
• →Business continuity planning and testing across severe but plausible scenarios, including disruption to material service providers
• →Notify APRA within 72 hours of an operational risk incident likely to have a material financial impact or a material impact on critical operations
• →Assess risks from reliance on service providers, including geographic location and concentration