Australian AI Governance Tracker

Manage the operational risk of critical operations, including AI embedded in them and material service providers (AI and cloud vendors).

Pre-existing contracts with material service providers had to comply by the earlier of next renewal or 1 July 2026. That transition relief has now ended, so CPS 230 applies in full to these arrangements. APRA also finalised targeted amendments to CPS 230 itself, commencing the same day.

Privacy policies must describe the kinds of decisions made or substantially assisted by computer programs using personal information. The OAIC public consultation on its formal guidance closed 15 June 2026, with guidance intended by September 2026, so the inventory work should not wait for it.

Take reasonable steps to secure personal information used with AI, and stay accountable for offshore AI providers that process it.

Individuals can sue directly for serious invasions of privacy, including intrusive AI surveillance, scraping or profiling.

A proposed reform that personal-information handling be fair and reasonable. Not part of the 2024 tranche; track its progress.

Voluntary government guidance on accountability, risk, data and system governance, testing and monitoring, human oversight, and transparency and contestability. The benchmark courts and procurement look to.

Confirms Australia governs AI through existing technology-neutral law and sector regulators, supported by the National AI Centre and a new AI Safety Institute, rather than a standalone AI Act.

Responsible lending, best-interests duty, complaints handling and market-conduct obligations apply fully to AI-driven decisions and representations.

Misleading or deceptive conduct rules apply to what your AI tells customers. A hallucinated price or claim is attributable to the business.

Consultation duties on major AI-driven change, procedural fairness on AI performance data, and surveillance-notice rules for AI monitoring.

Responsible entities must manage material risks to critical infrastructure assets, including hazards introduced by AI systems and AI vendors.

Australian organisations whose AI chatbots or AI-generated content reach EU users must disclose this general transparency duty. Unaffected by the Digital Omnibus, now Regulation (EU) 2026/1744, published in the Official Journal 24 Jul 2026 and in force from 27 Jul 2026.

The narrower duty to embed a machine-readable marker in AI-generated content is a four-month grace period under the adopted Digital Omnibus for systems already on the EU market before 2 Aug 2026. The general disclosure duty above is unaffected and still applies from 2 Aug 2026.

AU organisations placing high-risk AI (employment, credit, and other Annex III uses) on the EU market face the heaviest duties. Deferred to 2 Dec 2027 under the Digital Omnibus, Regulation (EU) 2026/1744, published in the Official Journal 24 Jul 2026 and in force from 27 Jul 2026.

The Prime Minister announced an Office of AI within the Department of the Prime Minister and Cabinet, effective immediately, to coordinate a whole-of-government national AI framework, plus a set of Australian Standards for AI to be legislated. The standards will set binding rules for large data centres (underwriting their own new power supply, paying full connection costs, demand response, and water efficiency), preserve creator ownership of copyrighted works used in AI training, and streamline compliance verification. Whole-of-government AI consumer safety priorities were flagged to follow within weeks. No bill has been introduced yet, so treat the detail as announced policy, not law.

The certifiable AI management system standard. Voluntary, but increasingly requested in government and enterprise procurement.