AI law and policy in Australia
28 instruments relevant to AI in Australia are indexed here, 11 of them binding law, one of which names AI or deepfakes in its title. No AI statute and no AI regulator. Australia governs AI through law that does not mention it: privacy, consumer, online safety, therapeutic goods, corporations and criminal law. The one genuinely binding AI-specific obligation applies to Commonwealth agencies rather than to the market. Mandatory guardrails for high-risk AI were proposed in 2024 and have not been legislated.
Governance readiness 6 of 10 points on the governance readiness index, which records how much machinery exists, not how strict it is. AI Governance Readiness Index This site Our own editorial coding from primary legal sources, not an objective measurement. Every score cites a specific instrument and article. "Readiness" means the machinery exists to govern AI. It is emphatically not a judgement that the resulting rules are good, proportionate, or well enforced. Cite AI Safety Tracker, "AI Governance Readiness Index". https://aisafetytracker.org/methodology/governance-readiness/. Retrieved 23 October 2026.
Use of AI, AI datacentres and governance readiness beside this index: AI in Australia
Statutes
Act of Parliament. Binding on everyone it applies to.
-
Parliament of Australia
Criminalises transmitting sexual material depicting an adult without consent, including material that has been generated or altered. One of the few Australian statutes written with generative models in view.
- safety
- children
-
Digital ID Act 2024 2024
Parliament of Australia
Accreditation for digital identity providers, with restrictions on biometric information and on using it for anything beyond verification. Relevant to any face-matching or liveness system operating in the accredited scheme.
- privacy
- security
-
Parliament of Australia
The first tranche of reform from the Privacy Act Review. Creates a statutory tort for serious invasions of privacy, and requires privacy policies to disclose where personal information is used in automated decisions that significantly affect someone. The automated-decision transparency duty is the closest thing Australia has to an AI transparency obligation, and it commences in December 2026.
- privacy
- transparency
-
Parliament of Australia
Gives the eSafety Commissioner removal powers and the ability to register industry codes and make standards. The codes and standards made under it now reach generative AI services, which is how Australia regulates AI-generated harmful material without an AI statute.
- safety
- children
-
Parliament of Australia
Risk management obligations for responsible entities in eleven critical sectors. Where an AI system is part of a critical infrastructure asset, the hazard categories and the reporting duties apply to it like anything else.
- security
-
Parliament of Australia
Misleading or deceptive conduct and the consumer guarantees apply to claims made about AI products and to products that fail because of them. The ACCC has been explicit that overstating what a model does is ordinary consumer law territory, with no AI-specific provision needed.
- consumer
-
Parliament of Australia
Directors' duties of care and diligence, and the obligation on financial services licensees to provide services efficiently, honestly and fairly, both reach board-level decisions about deploying AI. ASIC has said so directly.
- finance
- government use
-
Parliament of Australia
Clinical decision-support and diagnostic software can be a medical device and require TGA inclusion in the Register. This is the one area where an Australian AI developer faces pre-market approval rather than after-the-fact enforcement.
- health
- safety
-
Privacy Act 1988 1988
Parliament of Australia
The main constraint on AI systems that handle personal information. The Australian Privacy Principles apply to collection, use and disclosure regardless of whether a model is involved, which is why an Australian AI compliance question is usually a privacy question first.
- privacy
- transparency
-
Copyright Act 1968 1968
Parliament of Australia
Australia has fair dealing for specified purposes, not fair use, and no text and data mining exception. Training on copyright material in Australia has a narrower set of defences available than in the United States, which is the central question the Copyright and AI Reference Group was set up to examine.
- copyright
Rules made under an Act
Rules, regulations or codes made under an Act. Binding.
-
Australian Prudential Regulation Authority
Binding on APRA-regulated entities from July 2025. Requires identification of critical operations and management of material service provider risk, which captures dependence on a third-party model provider.
- finance
- security
Binding on government only
Binds government agencies only, not the wider market.
-
Department of Industry, Science and Resources
Announced in November 2025 and operating from early 2026, with the Australian Signals Directorate as a technical partner. It began testing frontier models in July 2026.
- safety
-
Data and Digital Ministers Meeting
Agreed by Commonwealth, state and territory ministers. Applies the AI Ethics Principles to government use and sets a common assurance approach across jurisdictions, which matters because most public-facing AI in Australia is deployed by states, not the Commonwealth.
- government use
-
Digital NSW
Mandatory for NSW government AI projects and the most developed state-level instrument. Most public-facing government AI in Australia is deployed by states, so Commonwealth policy alone does not describe what citizens meet.
- government use
-
Digital Transformation Agency
Mandatory for non-corporate Commonwealth entities from September 2024. Requires an accountable official and a public transparency statement. This is the most concrete binding AI obligation in Australia, and it binds the government rather than the market.
- government use
- transparency
Regulator guidance
How a regulator states it will apply existing law. Creates no obligations of its own.
-
Office of the Australian Information Commissioner
The regulator's view on scraping and on training with personal information, including that publicly available does not mean freely usable under the Privacy Act. Directly relevant to anyone training on Australian web data.
- privacy
- copyright
-
Office of the Australian Information Commissioner
What the Australian Privacy Principles require of an organisation buying in a model rather than building one. Includes the OAIC's position that entering personal information into a public generative AI tool is a disclosure.
- privacy
-
Australian Securities and Investments Commission
A review of AI use across 23 licensees which found governance lagging deployment. ASIC's position is that existing obligations already bite and that boards cannot wait for AI-specific law.
- finance
- consumer
Voluntary standards
Guidance with no legal force. Compliance is a choice.
-
Department of Industry, Science and Resources
The economic strategy rather than the regulatory one: skills, compute, adoption and sovereign capability. Included here because it sets the policy frame the regulatory decisions are being made inside.
- government use
-
Department of Industry, Science and Resources
Ten guardrails covering accountability, risk management, testing, human oversight and disclosure. Written to line up with the mandatory guardrails that were proposed at the same time, so an organisation that adopts it is positioned for legislation that has not arrived.
- safety
- transparency
-
Department of Industry, Science and Resources
Eight principles, voluntary since 2019. Their practical significance is that later binding government policy adopts them by reference, which gives them force inside the public sector that they do not have outside it.
- safety
- discrimination
Proposed, not law
Proposed, consulted on, or before Parliament. Creates no duties yet.
-
Office of AI, Department of the Prime Minister and Cabinet
Consultation paper of September 2026 on the proposed Australian AI standards: mandatory minimum requirements for large data centres, covering energy, water and community engagement, and conditions for frontier AI training in Australia. Submissions closed in October 2026. No bill has been introduced.
- safety
-
Department of Industry, Science and Resources
Consulted on in late 2024. Proposed a risk-based regime with ten mandatory guardrails and canvassed three options for giving them effect: a new AI act, framework legislation, or amendments to existing law. The December 2025 National AI Plan set it aside in favour of existing law. In July 2026 the government announced it would legislate Australian Standards for AI instead, with legislation expected in 2027. Nothing has been legislated, which is the single most important fact in this index.
- safety
- transparency
Reviews and inquiries
An inquiry or review. Evidence and recommendations, not obligations.
-
Government of South Australia
Began in October 2026 and reports by 1 July 2027. Its terms of reference cover AI's effect on productivity and growth in South Australia, the policy, legislative and regulatory frameworks needed for safe adoption, and protection of people from its risks.
- safety
-
Senate of Australia
Recommended that general-purpose models be declared high-risk and that Australia legislate a dedicated AI act. The government has not adopted the recommendation, and the gap between this report and the statute book is worth understanding before reading Australian AI coverage.
- safety
- consumer
- discrimination
-
Attorney-General's Department
The standing forum on whether Australian copyright law needs changing for AI training and AI output. No statutory change has followed, so the Copyright Act as it stands remains the answer.
- copyright
-
Attorney-General's Department
116 proposals, agreed or agreed in principle by the government in 2023. The 2024 amendment act delivered the first tranche; the proposals on automated decisions, a fair and reasonable test, and small business exemptions are still outstanding and would change the AI picture substantially.
- privacy
- transparency
-
Commonwealth of Australia
Not an AI inquiry, and the most important document here for understanding Australian automated decision-making. An automated income-averaging scheme unlawfully raised debts against hundreds of thousands of people. Its recommendations on transparency and on a legislative basis for automated decisions are the reason government AI policy here is as cautious as it is.
- government use
- transparency
About this index
Compiled here from primary instruments and licensed MIT.
11 of the 28 instruments here are binding law, and exactly one of those names AI: the Criminal Code Amendment (Deepfake Sexual Material) Act 2024. The remainder apply to AI without naming it, so a keyword search of the statute book does not find them.
Topics covered: children, consumer, copyright, discrimination, finance, government use, health, privacy, safety, security, transparency. A build check probes every citation on this page, because a link that returns a 404 looks like evidence and is not.
This is not legal advice. It is not a compliance checklist and it is not exhaustive. Commencement dates, proposals and enforcement positions move; the review date is on every record. If something here is wrong, say so and it gets fixed and listed rather than quietly patched.