AI governance in Australian education.

Every school, university and edtech provider covered by the Privacy Act must handle student and staff personal information under the 13 Australian Privacy Principles: collect only what is needed, be open about AI uses, keep data secure, and let people access and correct it. Where an AI tool ingests enrolment, wellbeing or assessment data, the collection notice and purpose limits under APP 3 and APP 6 still apply in full.

From 10 December 2026 an entity that arranges a computer program to use personal information to make, or substantially help make, a decision that could reasonably be expected to significantly affect an individual must disclose this in its privacy policy. For education that reaches AI-assisted admissions, scholarship, streaming, proctoring and progression decisions about students, whose rights or interests are directly engaged.

The Voluntary AI Safety Standard sets 10 guardrails, now distilled into the six essential practices of the Guidance for AI Adoption published 21 October 2025. Providers deploying AI in learning or administration should assign accountability, do risk assessment, test and monitor tools, keep humans in control of decisions about students, be transparent, and keep records. Voluntary today, but the expected baseline for reasonable-steps defences and procurement.

Education Ministers approved the Australian Framework for Generative Artificial Intelligence in Schools on 5 October 2023, implemented from Term 1 2024 and reviewed annually. It sets six guiding principles across teaching and learning, human and social wellbeing, transparency, fairness, accountability and privacy, security and safety. School authorities are expected to apply it when adopting generative AI tools that involve students and staff.

Registered higher-education providers must comply with the Higher Education Standards Framework (Threshold Standards) 2021, including the academic and research integrity standards and the learning-outcomes and assessment standards. TEQSA has written to all providers on the risks generative AI poses to assessment integrity and expects providers to redesign assessment so that awarded qualifications remain credible despite AI-assisted cheating.

TEQSA requires providers to actively manage the integrity risks generative AI presents to assessment. Its assessment-reform work and revised Academic Integrity Toolkit direct institutions to secure assessment design, detect and respond to AI-enabled misconduct, and evidence how students demonstrate their own learning. Providers that fail to act risk conditions on registration and reputational harm to the qualifications they confer.

Education platforms that host user interaction fall within the Online Safety Act 2021 and the Basic Online Safety Expectations, which the eSafety Commissioner enforces. The Expectations name generative AI as a feature providers must make safe, require the best interests of the child as a primary design consideration, and demand reporting and complaint tools. eSafety can issue transparency notices and act on harmful material involving students.

NSW public schools and universities are agencies bound by the Privacy and Personal Information Protection Act 1998, which sets Information Protection Principles governing how they collect, hold, use and disclose the personal information of students and staff. Deploying AI that processes student records, wellbeing data or assessment outputs must satisfy these principles, and equivalent state privacy laws bind public education bodies in other jurisdictions.

Build a register of every AI tool touching student data, mapping each to the Privacy Act, the relevant state privacy law and the schools or higher-education framework that applies.

Rewrite privacy policies and collection notices before 10 December 2026 to disclose any AI-assisted decisions that significantly affect students, such as admissions, proctoring or progression.

Adopt the six essential practices from the Guidance for AI Adoption, assigning a named owner and a risk assessment for each student-facing AI system.

Redesign assessment against TEQSA guidance so awarded qualifications remain defensible where students can access generative AI, and update academic-integrity policies accordingly.

Apply the six principles of the Framework for Generative AI in Schools to any classroom tool, with explicit attention to privacy, safety and wellbeing of minors.

Vet edtech and platform vendors for compliance with the Basic Online Safety Expectations, keeping the best interests of the child central to design and moderation.

Run a data-minimisation and consent review for AI training and analytics so student personal information is not used beyond the purpose it was collected for.