AI regulation in Australia: laws & policy (2026)

The federal government launched its National AI Plan, officially dropping the proposed economy-wide mandatory guardrails in favour of uplifting existing technology-neutral laws, issuing voluntary guidance, and funding a new AI Safety Institute (~A$29.9m) for early 2026. It marks a decisive pivot from AI-specific regulation toward a pro-adoption, light-touch framework.

The Commission's interim report 'Harnessing data and digital technology' urged the government to pause the proposed mandatory high-risk AI guardrails and instead address gaps in existing laws, warning AI-specific rules could harm a A$116bn+ growth opportunity. This recommendation directly shaped the later abandonment of the guardrails.

The Privacy and Other Legislation Amendment Act 2024 received Royal Assent, requiring entities to disclose in privacy policies when personal information drives automated decisions that significantly affect individuals (with a grace period to 10 December 2026). It is the first binding statutory transparency obligation touching AI-driven decisions.

The Office of the Australian Information Commissioner published two guidance documents clarifying how the Privacy Act and Australian Privacy Principles apply to organisations using commercially available AI products and to developers training generative AI models. It set regulator expectations on accuracy, transparency, and limits on secondary data use.

DISR released the Voluntary AI Safety Standard, ten voluntary guardrails giving organisations practical guidance on safe and responsible AI development and deployment. It served as an immediate, non-binding measure and a template for the proposed mandatory regime.

DISR released a consultation proposing ten mandatory guardrails (accountability, risk management, testing, human oversight, contestability, supply-chain transparency, etc.) for AI in high-risk settings, and consulted on defining 'high-risk AI'. These proposals were later shelved under the 2025 National AI Plan but defined the regulatory debate.

After 500+ submissions, the government concluded existing laws inadequately address AI risks and committed to a risk-based, technology-neutral approach, considering mandatory guardrails for high-risk settings and an interim voluntary safety standard. This set the policy direction for the 2024 reforms.

The Royal Commission found the government's automated welfare debt-recovery scheme 'crude, cruel and unlawful', and made 56 recommendations including reform of legal frameworks for automated decision-making in government. The scandal became a defining cautionary case shaping Australia's caution on automated/AI decision-making.

The government published eight voluntary AI Ethics Principles (fairness, transparency, accountability, privacy, contestability, human-centred values, reliability, and wellbeing), aligned with OECD AI Principles. This foundational, non-binding framework established the values underpinning all subsequent Australian AI policy.