AI governance in Australian employment and HR.

AI used to screen, rank or assess candidates must not produce discriminatory outcomes on protected attributes such as sex, race, age or disability. A facially neutral model that has a disproportionate adverse impact on a protected group without reasonable justification is indirect discrimination, and the employer remains liable for outcomes produced by a purchased tool. The Commission AI and recruitment compliance checklist expects documented bias testing, human oversight and validation against Australian cohorts.

The general protections in Part 3-1 prohibit an employer taking adverse action against an employee or prospective employee because of a protected attribute or the exercise of a workplace right. Where an automated screening, performance or scheduling tool drives a decision to refuse to hire, demote, discipline or dismiss, the employer bears the reverse onus of showing the real reason was lawful, so unexplained algorithmic outputs are a serious exposure.

Section 47C imposes a positive duty on employers and persons conducting a business or undertaking to take reasonable and proportionate measures to eliminate, as far as possible, sex discrimination, sexual and sex-based harassment and hostile workplace environments. AI tools that entrench gendered bias in hiring or scoring, or monitoring that fails to detect harassment, engage this proactive duty, which the Commission can investigate and enforce.

The Guidelines for complying with the positive duty set out four guiding principles and seven standards, being leadership, culture, knowledge, risk management, support, reporting and response, and monitoring, evaluation and transparency. The Commission uses these standards to assess compliance, so employers deploying AI in people processes should map their governance, risk assessment and monitoring of those tools against the seven standards.

Camera, computer and tracking surveillance of employees in NSW must not start without at least 14 days prior written notice stating the kind of surveillance, how it is carried out, when it starts, and whether it is continuous or intermittent and ongoing or time-limited. Computer and productivity monitoring, including AI-driven analytics, must also be conducted under a workplace computer-surveillance policy the employee is aware of. Similar Acts apply in the ACT and Victoria.

Personal information collected and used by AI in recruitment, monitoring and workforce analytics must be handled under the Australian Privacy Principles, including collecting only what is reasonably necessary, being open about practices, and keeping information secure. Note the narrow employee records exemption does not extend to job applicants, contractors or the tools that profile them, so candidate data sits squarely within the Act.

From 10 December 2026, under changes made by the Privacy and Other Legislation Amendment Act 2024, an entity that uses a computer program to make or substantially inform a decision that could significantly affect an individual must disclose in its privacy policy the kinds of personal information used and the kinds of decisions so made. Automated hiring, promotion and termination decisions are squarely in scope, so employers should update privacy policies before the commencement date.

Under the model WHS Regulations a person conducting a business or undertaking must eliminate or minimise psychosocial risks so far as is reasonably practicable. Algorithmic management practices such as intense automated surveillance, machine-set targets, opaque productivity scoring and unpredictable AI rostering can be psychosocial hazards. Employers must identify these risks, apply the hierarchy of controls and consult workers, guided by the model Code of Practice on managing psychosocial hazards at work.

The Voluntary AI Safety Standard sets out ten guardrails, and the October 2025 Guidance for AI Adoption distils these into six practices, being decide who is accountable, understand impacts and plan, measure and manage risks, share essential information, test and monitor, and maintain human control. Although voluntary, this is the Australian Government benchmark of reasonable AI governance and a strong signal of the direction of future mandatory rules for higher-risk uses such as employment decisions.

Build and maintain an AI system register that lists every recruitment, screening, rostering, monitoring and performance tool in use, who is accountable for each, and what personal information it processes

Require vendors of hiring and assessment tools to supply bias-testing results validated against Australian cohorts, and run your own pass-through rate audits by stage from application to shortlist to hire

Rewrite or issue Workplace Surveillance Act notices and a computer-surveillance policy before any employee monitoring starts, giving at least 14 days written notice of the kind, method and timing of surveillance

Update your privacy policy before 10 December 2026 to disclose the kinds of personal information and the kinds of decisions made or substantially informed by automated systems that significantly affect individuals

Run a psychosocial risk assessment on algorithmic management practices such as automated targets, surveillance intensity and machine-driven scheduling, and record the controls applied

Keep a human decision-maker meaningfully in the loop for hiring, discipline and dismissal so automated outputs never become the sole basis for an adverse employment decision

Document leadership accountability, worker consultation and review processes so you can evidence compliance with the positive duty and the model WHS consult, cooperate and coordinate obligations