Is AI regulated in Australia? It is one of the first questions business owners ask us. The short answer is: not by one single AI law, but more than most people think, and more is on the way.
The last few months have brought a lot of announcements. This article sorts out what applies to your business today, what has been announced, and what small businesses and organisations should do now.
The short answer
Australia does not have a standalone AI Act, like the one in Europe. In 2024 the Government consulted on mandatory guardrails for high risk AI, but it chose not to go ahead with them. Its National AI Plan, released in December 2025, said it would rely on existing laws and strengthen them where needed.
Since then, things have moved. The Government has announced a national AI framework, a new Office of AI and national AI standards, with laws planned for 2027. The first of these mainly target the companies that build AI, not the businesses that use it.
Laws that already apply when you use AI
Using AI doesn’t put your business outside the law. The rules you already follow still apply to anything you do with an AI tool. The main ones are:
- The Privacy Act, if your business is covered. It controls how you collect, use and share personal information, including in AI tools.
- The Australian Consumer Law. Misleading claims are still misleading if AI wrote them, and that includes claims about your own use of AI.
- Anti discrimination laws. If an AI tool helps you choose job applicants or customers, the outcome must not be unlawfully unfair.
- Work health and safety laws, which cover how new technology affects your workers.
- Copyright law, which still applies to content you publish, however it was made.
Not sure whether the Privacy Act covers your business? Our guide to the $3 million test walks you through it.
The new privacy rule starting 10 December 2026
This is the one firm date every covered business should have in its diary. From 10 December 2026, your privacy policy must explain when software makes important decisions about people. That includes decisions where a computer program plays a key part, even if a person signs off.
It isn’t limited to AI. It covers any software that scores, ranks, approves or declines people. Our article on the OAIC’s automated decision making guidance explains what you need to add.
The voluntary guidance you can follow today
In October 2025 the National AI Centre released the Guidance for AI Adoption. It sets out six essential practices, such as naming who is accountable for AI, managing risks and keeping a person in control.
It is voluntary, but it is the clearest picture of what the Government expects good AI governance to look like. Our checklist of the six practices turns it into steps a small business can follow.
What has been announced in 2026
Here is what has happened so far this year, in plain English.
July: a national AI framework and an Office of AI
In July the Prime Minister announced a new national framework for AI. A new Office of AI, inside the Department of the Prime Minister and Cabinet, will coordinate the work. One of its jobs is to design Australian standards for AI.
September: plans for AI incident reporting
Late in September, the Government said it plans to require companies to report serious AI incidents. This followed a reported incident involving an AI agent and government data systems. Reports would go to the organisations affected and to the Australian Signals Directorate. The details, including exactly who must report, are expected in future legislation.
October: proving safety systems work
On 8 October, Assistant Minister Andrew Charlton outlined how the Government plans to regulate the most advanced AI. Rather than list every rule, it wants AI companies to run serious risk management systems and prove they work. The approach borrows from how banking, aviation and workplace safety are regulated.
National AI standards are expected by the end of 2026, with legislation planned for 2027.
Is AI regulated in Australia for small businesses?
For now, the new announcements are aimed mainly at the companies that build and run powerful AI systems. If your business uses tools like ChatGPT, Copilot or AI features in your accounting software, nothing new applies to you yet.
That doesn’t mean nothing will change for you. Standards for AI developers tend to flow down to their customers through contracts and settings. Larger clients and government buyers are also starting to ask their suppliers how they manage AI. Being able to answer clearly is becoming part of winning work.
What to do now
You don’t need to wait for the new standards. These steps will put you in a good position whatever the final rules look like:
- Make a list of every AI tool your business uses, including free ones staff use
- Write a short AI use policy so staff know the rules
- Make sure a person checks AI work before it reaches a customer
- Check whether the Privacy Act applies, and if it does, update your privacy policy before 10 December 2026
- Name one person who is responsible for AI in your business
- Keep a simple record when something goes wrong with an AI tool
Our earlier articles on building an AI system inventory and what should actually be in an AI governance policy cover the first two steps.
Questions business owners are asking
Is there an AI Act in Australia?
No. Australia does not have a single AI law. The Government plans new legislation in 2027, aimed first at the most advanced AI systems.
Do the new AI standards apply to my business?
We don’t know the final detail yet, as the standards are still being written. What has been announced so far targets AI developers. We will update this article when the standards are released.
Can I get in trouble for how my staff use AI?
Yes, under existing laws. For example, a staff member might put customer information into an AI tool in a way the Privacy Act doesn’t allow. If so, your business is responsible.
Is ISO 42001 required?
No. ISO/IEC 42001 is a voluntary international standard for managing AI. It is a good way to show clients you take AI seriously, and it lines up well with the Guidance for AI Adoption.
The short version
Is AI regulated in Australia? Yes, through the laws that already apply to your business, with a new privacy rule from 10 December 2026. New national AI standards and laws are coming, aimed first at AI developers. The smart move for small businesses and organisations is to get the basics in place now.
This article is general information, not legal advice. It reflects announcements up to 15 October 2026. Please get advice about how the law applies to your situation.
How Lead Comply can help
Want to know where your business stands? Book a complimentary assessment and we will help you work out what applies to you. From 30 October you can also start free in the Lead Comply AI Governance Portal. It builds your AI register, policy and privacy disclosure in one place.
