From the Voluntary AI Safety Standard to the Guidance for AI Adoption (AI6)

Australia's AI governance framework has evolved significantly since 2024. The original Voluntary AI Safety Standard (VAISS), published in September 2024 with its 10 guardrails, was superseded on 21 October 2025 by the Guidance for AI Adoption, a new national framework that consolidates the 10 guardrails into six essential practices, now commonly referred to as "AI6".

The National AI Centre describes the guidance as the first update to the VAISS: it condensed the 10 guardrails into 6 essential practices, removed redundant language and expanded the audience to developers as well as deployers. It comes in two versions, Foundations for organisations early in their AI use and Implementation guidance for more complex or higher-risk use.

What the National AI Plan (December 2025) means

On 2 December 2025, the Australian Government released its National AI Plan. By then a question had been open since the government consulted in September and October 2024: will Australia pursue mandatory AI guardrails for high-risk AI?

For now, the answer is no. The Department of Industry, Science and Resources states that the government will not proceed at this time with its proposals to introduce mandatory guardrails, and that feedback on them informed the National AI Plan. The Plan builds on existing technology-neutral laws (Privacy Act, ACL, sector legislation), with voluntary guidance (the AI6 framework) and a new Australian AI Safety Institute (AISI).

Update (15 July 2026): In a speech at the University of Sydney, Prime Minister Albanese announced that the government will establish a set of Australian Standards for AI and, effective that day, an Office of AI in the Department of the Prime Minister and Cabinet. As the speech describes them, the standards will protect Australian creators' control of their work used to train AI and set rules for where large data centres are built and the power and water they use, bringing the March 2026 data centre expectations into one framework the Prime Minister called "clear, consistent and mandatory". He will seek agreement at National Cabinet and aims to bring legislation to Parliament early in 2027, while saying it is not the government's goal "to try and legislate for every possible eventuality or risk". The speech does not mention the 2024 mandatory guardrails proposal. Read the speech.

The AISI was backed by a A$29.9 million commitment to become operational in early 2026. The Department of Industry describes its role as monitoring and analysing emerging AI capabilities, with a focus on advanced and frontier models, and providing technical information and insights to support regulators and agencies.

The six essential practices (AI6)

The Guidance for AI Adoption sets out six essential practices that organisations are encouraged to adopt: decide who is accountable; understand impacts and plan accordingly; measure and manage risks; share essential information; test and monitor; and maintain human control.

These practices are voluntary, but the laws around them are not. The OAIC (Office of the Australian Information Commissioner), ACCC, APRA (Australian Prudential Regulation Authority), and ASIC (Australian Securities and Investments Commission) all have powers that apply to AI in their respective domains, and AI6 is the government's guidance on AI governance within those laws.

Privacy Act reform: the AI obligation that is coming

The one significant new legal obligation on the horizon for Australian organisations is the Privacy Act reform. The Privacy and Other Legislation Amendment Act 2024, which received Royal Assent on 10 December 2024, includes a requirement (new APP 1.7) that privacy policies address decisions that a computer program makes, or does a thing substantially and directly related to making, where the decision could reasonably be expected to significantly affect individuals' rights or interests. This provision comes into effect in December 2026. For organisations using AI in consequential decisions, credit, employment, insurance, service access, this creates a specific disclosure obligation that is not voluntary.

What Australian organisations should do now

With mandatory guardrails not proceeding for now, some organisations may conclude that AI governance can be deferred. This conclusion is mistaken for three reasons. First, existing laws, Privacy Act, ACL, Fair Work Act, sector-specific regulation, already apply to AI and are being enforced. Second, AI6 is the government's own guidance, which the National AI Centre describes as a shared, trusted baseline for responsible AI use. Third, the regulatory direction, in Australia and globally, is toward more, not less, formal obligation. Organisations building strong governance now will find adaptation straightforward when formal requirements come.

Related reading

Further reading: APRA, Letter to Industry on AI (April 2026)