Australia's AI Guardrails in 2026
What actually applies to AI in Australia right now: no AI Act, six voluntary practices, one new Privacy Act duty from 10 December 2026, and Australian Standards for AI planned for 2027. What each means for your organisation, and what to do first.
The short version
Australia has no AI Act and no mandatory guardrails for high-risk AI. In its December 2025 National AI Plan the government set aside the guardrails it proposed in 2024 and chose to rely on existing law, voluntary guidance and a new AI Safety Institute. So for most organisations today, AI is governed by:
- Laws that already apply to everything: privacy, consumer law, anti-discrimination, copyright, directors' duties and sector rules such as APRA's.
- One new AI-relevant duty: from 10 December 2026, privacy policies must disclose automated decisions that significantly affect people.
- Voluntary guidance: the six practices in the Guidance for AI Adoption, known as AI6, which updates the 2024 Voluntary AI Safety Standard.
That is not the end of it. In July 2026 the Prime Minister announced an Office of AI and Australian Standards for AI, with legislation planned for early 2027. Organisations that adopt AI6 now, and govern AI properly, will be ready for whatever those standards require.
At a glance
| Instrument | Status | When | Who it applies to | What it does |
|---|---|---|---|---|
| Guidance for AI Adoption (AI6) | Voluntary | October 2025 | Every organisation using or building AI | Six essential practices; the government's main AI guidance. Updates the 2024 Voluntary AI Safety Standard. |
| Privacy Act: automated decision transparency (APP 1.7 to 1.9) | Mandatory | From 10 December 2026 | APP entities: agencies and most businesses over $3 million turnover | Privacy policies must disclose automated decisions that significantly affect people. |
| Statutory tort for serious invasions of privacy | In force | Since 10 June 2025 | Everyone | People can sue for serious, intentional or reckless invasions of privacy, including through AI misuse. |
| Policy for the responsible use of AI in government v2.0 | Mandatory for agencies | Effective 15 December 2025 | Non-corporate Commonwealth entities; suppliers indirectly | Accountable officials, an AI use case register and impact assessments before deployment. |
| Existing technology-neutral law | In force | Now | Everyone | Consumer law, anti-discrimination, copyright, online safety, directors' duties and sector rules all apply to AI. |
| Australian AI Safety Institute | Operating | 2026 | Government; frontier developers | Advisory. Tests and evaluates AI and advises on regulatory gaps; no licensing or enforcement powers. |
| Australian Standards for AI | Coming | Legislation planned for early 2027 | To be decided after consultation | Announced July 2026 with a new Office of AI in Prime Minister and Cabinet. |
| Mandatory guardrails for high-risk AI | Not pursued | Proposed September 2024 | n/a | Set aside in the December 2025 National AI Plan in favour of existing law and voluntary guidance. |
The six practices (AI6)
The National AI Centre's Guidance for AI Adoption, published in October 2025, is the government's main guidance for organisations using or building AI. It condenses the Voluntary AI Safety Standard's ten guardrails into six essential practices, in two versions: Foundations for organisations starting out, and Implementation, which is broadly aligned with ISO/IEC 42001. It is voluntary, but it is the clearest statement of what the government expects, and the likeliest starting point for any future standard.
| Practice | What to do | ISO 42001 | ISM controls |
|---|---|---|---|
| 1. Decide who is accountable | Name an executive owner for AI, set an AI policy, and give each AI system an owner. | Clause 5; A.2 AI policy; A.3 roles | GOV-08ISM-2074 |
| 2. Understand impacts and plan accordingly | Assess how each AI use could affect people, groups and the organisation before you deploy it, and keep an AI register. | A.5 AI system impact assessment; A.4 resources | ISM-2134 |
| 3. Measure and manage risks | Put AI risks in your risk register, treat them, and apply security controls proportionate to the risk. | Clause 6.1 | ISM-2156ISM-2158 |
| 4. Share essential information | Tell people when they are dealing with AI or affected by its decisions, and document what each system does. | A.8 information for interested parties | ISM-2084 |
| 5. Test and monitor | Test before release and monitor in use for performance, drift, misuse and unexpected behaviour. | A.6 AI system life cycle; clause 9 | ISM-2114ISM-2089 |
| 6. Maintain human control | Keep people able to oversee, override and stop AI, especially for decisions and actions that matter. | A.9 use of AI systems | ISM-2113 |
The ISO 42001 and ISM columns are CISO AI's mapping, to show where each practice is implemented. The guidance itself includes an AI screening tool, a policy template and an AI register template, free from the National AI Centre.
The Privacy Act's automated decision duty
The obligation starts. It was added by the Privacy and Other Legislation Amendment Act 2024 as new APP 1.7 to 1.9, and the OAIC published guidance on it on 30 September 2026.
Who it applies to: APP entities, which means Commonwealth agencies and private sector organisations covered by the Privacy Act (broadly, those with annual turnover over $3 million, plus some smaller ones such as health service providers).
When it is triggered: when a computer program makes a decision, or does something substantially and directly related to making one, that could reasonably be expected to significantly affect an individual's rights or interests, and personal information about the individual is used in the program's operation. It is not limited to AI: a rules engine counts as much as a model.
What you must disclose: in your privacy policy, the kinds of personal information used in those programs, and the kinds of decisions made solely by them and those they substantially and directly inform.
Getting ready before 10 December
- Find your automated decisions. Credit, eligibility, pricing, fraud, hiring, claims, access: look in systems you would not call AI as well as those you would.
- Test each against the trigger. Does it use personal information, and could the decision significantly affect someone? Record your reasoning either way.
- Update the privacy policy with the kinds of personal information and decisions involved, in plain language.
- Keep it current. Add the check to your AI register and change process, so a new model or rule does not slip past the policy.
Check the OAIC's guidance and updated APP 1 guidelines for the detail, including how it reads "substantially" and "significantly affect".
Laws that already apply to AI
With no AI Act, the government's position is that existing, technology-neutral law covers AI harms, enforced by existing regulators. In practice:
Government agencies and their suppliers
The Digital Transformation Agency's Policy for the responsible use of AI in government, version 2.0, took effect on 15 December 2025 and applies to non-corporate Commonwealth entities, with limited exceptions such as defence and intelligence. It asks agencies to designate accountable officials for AI strategy and for each use case, keep an AI use case register, and complete an AI impact assessment before deploying an in-scope use case, with staged deadlines running through 2026 and into 2027.
If you sell to government: the policy places no direct duty on suppliers, but agencies need supplier information to complete their impact assessments. Expect questions about how your AI works, what data it uses and trains on, and how it is tested and controlled, and have the answers ready. ASD Essentials and the ISM's AI controls cover the security side; see our ASD Essentials and AI guide.
What is coming
- Australian Standards for AI. Announced by the Prime Minister on 15 July 2026, to be developed through the new Office of AI in the Department of the Prime Minister and Cabinet, after consultation with industry and the states, with legislation planned for early 2027. The scope is not yet settled.
- Data centres. Mandatory requirements on power supply, water and connection costs for large data centres were the most concrete part of the July announcement.
- The AI Safety Institute. Operating since 2026 within the Department of Industry, Science and Resources. It evaluates AI and advises government on risks and regulatory gaps, and has no licensing or enforcement powers.
- Further privacy reform. More Privacy Act changes remain on the government's agenda.
The safest preparation is the same whatever the standards end up saying: adopt AI6, keep an AI register and impact assessments, secure your AI systems (our securing AI agents guide), and consider an ISO 42001 management system to run it all consistently.
AI guardrails checklist
Twelve checks covering AI6 and the legal duties above. Ticks are stored in this browser only.
AI6 practice 1
AI6 practice 2
AI6 practice 2
AI6 practice 3
AI6 practice 4
AI6 practice 5
AI6 practice 6
Privacy Act APP 1, by 10 Dec 2026
Privacy Act APP 1.7 to 1.9
Australian Consumer Law
Anti-discrimination law
Privacy Act; ISM-2103
Need help getting ready?
Whether it is the 10 December privacy change, adopting AI6 or preparing for ISO 42001, tell us where you are and we will reply within two business days. We can introduce you to an independent adviser who works on AI governance and privacy.
CISO AI may receive a fee from providers we introduce you to. Your details are used only for this enquiry; see our privacy policy.
Questions
Does Australia have an AI Act?
No. In its December 2025 National AI Plan the government chose not to introduce AI-specific legislation or the mandatory guardrails for high-risk AI it had proposed in 2024, and to rely on existing technology-neutral law, voluntary guidance and the new AI Safety Institute. In July 2026 it announced Australian Standards for AI, with legislation planned for early 2027, so that may change.
Is the Voluntary AI Safety Standard still current?
Its successor is the Guidance for AI Adoption (AI6), published by the National AI Centre in October 2025, which condenses the standard's ten guardrails into six essential practices and covers developers as well as deployers. Work done against the ten guardrails maps across.
What changes on 10 December 2026?
APP entities must say in their privacy policies when they use computer programs to make, or substantially and directly inform, decisions that could reasonably be expected to significantly affect an individual's rights or interests, where personal information is used. The policy must describe the kinds of personal information used and the kinds of decisions involved. The OAIC published guidance on the obligation on 30 September 2026.
Does the automated decision rule only cover AI?
No. It covers any computer program, from a simple rules engine to a machine learning model, that makes or substantially and directly informs a significant decision using personal information. Many organisations will find automated decisions in systems they would not call AI, such as credit, eligibility, pricing or fraud rules.
How does AI6 relate to ISO 42001?
AI6's implementation guidance is broadly aligned with ISO/IEC 42001. AI6 tells you what good practice looks like; ISO 42001 is a certifiable management system for doing it consistently. Our ISO 42001 and integrated framework guides cover how to build it.