Australia does not have an AI Act. Instead, AI is regulated through laws that already exist, such as privacy, consumer protection and online safety, plus voluntary guidance and a growing set of government bodies. One new rule is about to bite: from 10 December 2026, businesses that use automated decision-making must disclose it in their privacy policy. This guide explains what applies now, who it reaches, and what is still only planned.
The short version
- No AI-specific law. The National AI Plan, released on 2 December 2025, chose to rely on existing technology-neutral laws, sector regulators and voluntary guidance. It did not carry forward the mandatory AI guardrails proposed in 2024.
- Privacy law is the main hard rule. From 10 December 2026, a new transparency duty covers automated decisions that significantly affect people.
- Consumer, online safety and criminal laws also apply to AI products and AI-generated content.
- More is planned. The government has announced Australian Standards for AI and intends to legislate in early 2027. The announced focus is large data centres and creators' copyright, not everyday business use.
How Australia got here
In September 2024 the government published a proposals paper for ten mandatory guardrails in high-risk AI settings, alongside a Voluntary AI Safety Standard with ten similar guardrails. The National AI Plan of 2 December 2025 then confirmed a lighter approach: use existing laws, support businesses with guidance, and set up an AI Safety Institute to test and advise. The Voluntary AI Safety Standard remains useful as a checklist of good practice, but it creates no legal duty.
Who does what
- Australian AI Safety Institute. Monitors, tests and advises on AI risks. It does not regulate.
- Office of AI. Set up inside the Department of the Prime Minister and Cabinet on 15 July 2026 to coordinate government work on the new national AI standards. It coordinates and does not enforce.
- Office of the Australian Information Commissioner (OAIC). Enforces the Privacy Act, including for AI that uses personal information.
- eSafety Commissioner. Enforces the online safety codes, including their rules for AI chatbots.
- Australian Competition and Consumer Commission (ACCC). Enforces the Australian Consumer Law.
What applies today
Privacy Act 1988
Personal information used to train or run an AI system is covered by the Australian Privacy Principles (APPs). In general the Act applies to businesses with annual turnover above A$3 million, and to some smaller ones, such as health service providers. Government agencies are covered too.
New from 10 December 2026: automated decision-making disclosure. The Privacy and Other Legislation Amendment Act 2024 adds a transparency rule to APP 1. Your privacy policy must say how you use automated decisions if all three of these are true:
- A computer program is arranged to make a decision, or to do something substantially and directly related to making it.
- The decision could reasonably be expected to significantly affect a person's rights or interests.
- Personal information about the person is used in the program.
The policy must describe the kinds of personal information used, the kinds of decisions the program makes on its own, and the kinds of decisions where the program does something substantially related to the decision.
The OAIC published its final guidance on 30 September 2026. As summarised by law firms, it says:
- "Computer program" is broad. It covers AI and machine learning, rule-based tools and chatbots, and even simple everyday software.
- Having a human review the output does not take a tool out of scope. A program whose output is a material input to a decision is generally captured.
- Likely significant areas include health, housing, finance, employment and utilities.
- The duty sits with the organisation that uses the tool, not with the vendor. You may need to ask your suppliers how embedded decision tools work.
This is a transparency rule only. It does not give people a right to a human review or an explanation of an individual decision.
Statutory privacy tort. Since 10 June 2025, people can sue for serious invasions of privacy that are intentional or reckless. This can reach conduct outside the APPs.
Australian Consumer Law
The consumer guarantees and the ban on misleading or deceptive conduct apply to AI features like any other product. Overstating what an AI tool can do, or hiding that content was AI-generated where it matters, can create a misleading-conduct risk.
Online safety codes
Industry codes under the Online Safety Act took effect on 9 March 2026. They cover AI companion chatbots and require age assurance for high-risk generative AI services. Providers of those services should check the codes against their products.
Criminal law on deepfakes
Creating or sharing sexually explicit deepfake material of a real person without consent is a federal criminal offence under the Criminal Code Amendment (Deepfake Sexual Material) Act 2024. Some states and territories add their own offences.
What is coming
- Australian Standards for AI. Announced on 15 July 2026 and reported to be backed by National Cabinet in August. The announced focus is energy, water and siting rules for large AI data centres, and protection for Australian creators' work. Legislation is planned for early 2027. Draft standards have not been published, so treat the details as unsettled.
- Unfair trading practices ban (from 1 July 2027). A new prohibition on manipulative conduct, including dark patterns, with penalties of up to A$100 million for companies.
Who should act before 10 December
- You operate in Australia and use software to help decide on credit, insurance, hiring, tenancy, benefits or access to services. Check whether the tool counts as a computer program that is substantially related to the decision.
- You use third-party scoring, screening or recommendation tools. The disclosure duty falls on you. Ask suppliers in writing what the tool does and what personal information it uses.
- You offer an AI chatbot or generative AI service to Australian users. Check the online safety codes and your consumer-law claims.
A short plan for the next few weeks
- List every system that uses personal information to make or inform decisions about people.
- For each one, note whether the output is advisory or decisive, and whether a human can override it.
- Draft the new section of your privacy policy: kinds of personal information, kinds of decisions, and which are fully automated.
- Get supplier information in writing, and update contracts to say who is making the decision.
- Review marketing claims about your AI features against what the tool actually does.
What this guide does not cover
Australia has more rules than these, including discrimination, copyright, workplace and sector-specific laws. If you operate in several countries, start with which AI laws apply to you. If you also sell into Europe, the 2 December 2026 EU deadlines are covered in our EU guide.
Primary sources: the OAIC for privacy law and guidance, the Department of Industry, Science and Resources for AI policy, the Department of the Prime Minister and Cabinet for the Office of AI, the eSafety Commissioner for the online safety codes, and the Federal Register of Legislation for the text of the Acts. Check them, or ask a qualified Australian lawyer, before you rely on any date or duty in this guide.
