🇦🇺Australia

Overview

Australia's approach to Artificial Intelligence (AI) regulation is characterized by a pragmatic and evolving philosophy, balancing the imperative to foster innovation and economic growth with a strong commitment to ensuring safety, ethical deployment, and public trust. Initially, the country adopted a "soft law" approach, exemplified by the voluntary AI Ethics Framework published in 2019, which laid down foundational principles for responsible AI development and use. This was followed by the National AI Action Plan in 2021, a strategic roadmap focusing on capability building, talent development, and the responsible adoption of AI across various sectors. This early phase underscored a belief in industry-led solutions and the adaptive application of existing, technology-neutral laws to address emerging AI-related challenges. However, in recent years, there has been a noticeable shift towards a more structured and potentially binding regulatory landscape, particularly for government use of AI and for high-risk applications in the broader economy. The Australia National AI Plan 2025, published in December 2025, consolidates this evolution, establishing a comprehensive national strategy aimed at capturing opportunities, spreading benefits, and keeping Australians safe through a flexible, risk-based framework. This plan explicitly leans on existing sectoral laws and regulators while simultaneously creating new governmental capabilities, most notably the Australian Artificial Intelligence Safety Institute (AISI), slated to be operational in early 2026, to provide independent technical analysis and advice. The trajectory indicates a mature understanding of AI's dual nature, moving beyond aspirational principles to concrete policy actions and the exploration of targeted legislative interventions. The overall maturity of Australia's AI regulatory framework is advancing rapidly, demonstrating a willingness to adapt to the fast-paced developments in AI technology. While maintaining a foundational commitment to principles-based and technology-neutral regulation, the government is actively engaging in consultations for mandatory guardrails for AI in high-risk settings, signalling a readiness to introduce specific statutory obligations where existing frameworks prove insufficient. This adaptive strategy aims to ensure that Australia remains competitive in the global AI landscape while proactively addressing potential harms and upholding societal values, fostering an environment where AI can flourish responsibly across both the public and private sectors.

Regulatory approach

Australia's regulatory approach to AI is predominantly risk-based and iterative, characterized by a blend of soft law, targeted policy interventions for government use, and ongoing consultation for potential mandatory guardrails in high-risk contexts. The initial framework, including the AI Ethics Principles (2019) and the Voluntary AI Safety Standard (VAISS) (2024), represents a horizontal, principles-based approach, providing non-binding guidance for all sectors and types of AI systems. These instruments emphasize ethical considerations, transparency, accountability, and safety, encouraging voluntary adoption of best practices across the AI lifecycle, from development to deployment. For the public sector, the approach is more prescriptive and binding. The Policy for the responsible use of AI in government (2024), along with supporting standards from the Digital Transformation Agency (DTA) such as the Standard for AI transparency statements and the Standard for accountable officials, imposes mandatory obligations on non-corporate Commonwealth entities. These policies mandate specific governance structures, risk assessment processes, transparency statements, and procurement guidance, ensuring that government agencies are exemplars in safe and ethical AI use. This dual approach allows for flexibility in the broader economy while ensuring a high standard of accountability and trustworthiness in public service delivery. Looking forward, the Australian government is actively exploring the introduction of mandatory guardrails for AI in high-risk settings across the entire economy, as detailed in the "Proposals Paper for Introducing Mandatory Guardrails for AI in High-Risk Settings" (2024). This consultation paper outlines a risk-based methodology for identifying high-risk AI systems and proposes ten high-level guardrails, indicating a potential shift towards targeted statutory interventions. The government is considering various regulatory pathways, including embedding guardrails into existing sectoral frameworks, coordinating powers across existing regulators, or introducing a standalone cross-economy AI Act. This demonstrates a strategic move towards more binding, yet still proportionate, regulation for AI applications that pose significant threats to individuals, groups, or public interests, while aiming to remain technology-neutral where possible to avoid stifling innovation in lower-risk areas. Australia's AI governance and enforcement landscape is characterized by a distributed model, leveraging existing sectoral regulators and establishing new coordinating bodies to address the unique challenges of AI. The Department of Industry, Science and Resources (DISR) serves as the central policy coordinator and lead steward for the whole-of-economy AI strategy, including the National AI Plan 2025. Under DISR, the National Artificial Intelligence Centre (NAIC), initially established within CSIRO’s Data61 and later transitioned to DISR, acts as a national focal point for AI. Its mandate includes providing guidance, fostering capability building, supporting SMEs, and promoting trustworthy AI practices across the ecosystem. A significant upcoming development is the Australian Artificial Intelligence Safety Institute (AISI), targeted to be operational in early 2026, which will provide independent technical analysis, monitoring, safety testing, and expert advice to regulators and ministers, enhancing the government's capacity to manage AI risks. For AI use within the Australian Public Service (APS), the Digital Transformation Agency (DTA) plays a crucial role as the lead agency for coordinating whole-of-government AI guidance. The DTA develops and implements mandatory policies and standards, such as the Policy for the responsible use of AI in government and the AI Impact Assessment Tool, which place clear obligations on non-corporate Commonwealth entities regarding AI governance, risk management, accountability, and procurement. These policies are supported by various standards, including those for AI transparency statements and accountable officials, ensuring a consistent and robust approach to AI deployment across government agencies. The Department of Finance and the Australian Public Service Commission (APSC) also coordinate the APS AI Plan, further embedding AI governance into public service operations. Beyond these coordinating and public sector-focused bodies, existing statutory regulators continue to play vital roles in enforcing AI-related compliance under their respective legislative mandates. The Office of the Australian Information Commissioner (OAIC) is responsible for upholding privacy laws, ensuring AI systems handle personal information ethically and lawfully. The Australian Competition and Consumer Commission (ACCC) addresses consumer protection and competition issues arising from AI, such as misleading AI claims or anti-competitive practices. The eSafety Commissioner is tasked with mitigating online harms, including those generated or amplified by AI like deepfakes and AI-facilitated abuse. Additionally, sector-specific regulators like the Therapeutic Goods Administration (TGA) oversee AI in medical devices, and the Australian Prudential Regulation Authority (APRA) monitors AI use in financial services, ensuring that AI deployment adheres to relevant industry standards and regulations. The Productivity Commission also contributes by conducting inquiries and providing recommendations on data and digital technology, informing broader policy directions.

Enforcement & penalties

Currently, Australia's federal regulatory framework for AI does not introduce specific new criminal offences or civil penalties directly attributable to AI-specific legislation. Instead, the enforcement of responsible AI practices and the remediation of harms largely rely on the application of existing, technology-neutral legal frameworks and the powers vested in established sectoral regulators. For instance, if an AI system breaches the Privacy Act 1988 (Cth) by mishandling personal information, the Office of the Australian Information Commissioner (OAIC) can investigate and impose significant civil penalties, issue determinations, or seek enforceable undertakings, as per its existing statutory authority. Similarly, the Australian Competition and Consumer Commission (ACCC) can pursue enforcement actions under consumer law if AI systems are used to make misleading claims, engage in unfair trading practices, or cause consumer detriment, with penalties including substantial fines and injunctions. The eSafety Commissioner also has powers to address online harms, including those facilitated by AI, under the Online Safety Act 2021. This distributed enforcement model means that the severity of penalties depends on the specific harm caused and the existing legislation it falls under. For AI use within non-corporate Commonwealth entities, non-compliance with mandatory policies and standards issued by the Digital Transformation Agency (DTA), such as the Policy for the responsible use of AI in government, is managed through administrative and governance channels rather than direct statutory penalties. While these policies do not create new criminal sanctions, failure to adhere can lead to internal administrative and accountability measures, impact an agency's ability to procure AI-enabled goods and services, and raise oversight concerns through central government bodies like the Department of Finance and the Australian Public Service Commission (APSC). Furthermore, the Australian National Audit Office (ANAO) may incorporate AI governance and assurance into its audit programs, providing an additional layer of accountability through parliamentary oversight. The government's "Proposals Paper for Introducing Mandatory Guardrails for AI in High-Risk Settings" (2024) is actively exploring options for introducing targeted legal updates that could include clearer enforcement powers, conformity assessment requirements, and incident reporting obligations for high-risk AI, which may lead to the introduction of AI-specific penalties in the future. This indicates a potential evolution towards more direct regulatory mechanisms and associated sanctions as the policy framework matures.

Data protection

Australia's data protection framework is primarily anchored in the Privacy Act 1988 (Cth), which is enforced by the Office of the Australian Information Commissioner (OAIC). This Act is technology-neutral, meaning its core principles, known as the Australian Privacy Principles (APPs), apply directly to the collection, use, disclosure, storage, and security of personal information by AI systems. The OAIC has been proactive in issuing guidance on how these principles should be interpreted and applied in the context of AI, emphasizing the importance of privacy-by-design, transparent data practices, meaningful consent, and robust data governance throughout the AI lifecycle. Organisations deploying AI systems that process personal data are expected to conduct privacy impact assessments, ensure data quality and provenance, and implement appropriate security controls to protect against breaches and misuse, aligning with the APPs' requirements for data integrity and security. The framework is also undergoing continuous review and potential reform to ensure its ongoing effectiveness in the digital age. The Productivity Commission's "Harnessing data and digital technology" inquiry report (2025) recommended a shift towards an outcomes-based privacy regulation, proposing an alternative compliance pathway to rigid prescriptive rules. This approach aims to reduce compliance costs while maintaining strong privacy protections, suggesting a more flexible and adaptive regulatory model that could better accommodate the complexities of AI. Furthermore, the government's "Proposals Paper for Introducing Mandatory Guardrails for AI in High-Risk Settings" (2024) explicitly includes data governance, quality, and privacy protections as a fundamental guardrail for high-risk AI systems, underscoring the critical intersection of AI regulation and data protection. While Australia does not have explicit data localization requirements akin to some other jurisdictions, the cross-border data flow principles within the Privacy Act impose obligations on entities transferring personal information overseas, which are relevant for AI systems relying on international data processing or cloud infrastructure.

Sector-specific rules

Australia's approach to AI regulation largely integrates AI-specific considerations into existing sectoral legal and regulatory frameworks, rather than creating entirely new sector-specific AI laws. This strategy leverages the expertise of established regulators and ensures that AI deployment aligns with existing industry standards and consumer protections. In the healthcare sector, the Therapeutic Goods Administration (TGA) plays a critical role in regulating AI as a medical device, particularly software as a medical device (SaMD). This ensures that AI-powered diagnostic tools, treatment planning systems, and other health applications meet stringent safety, quality, and performance standards before and after market entry. The National AI Plan 2025 explicitly highlights the need for targeted reviews in healthcare and medical device software to ensure robust oversight of AI innovations in this sensitive domain. Similarly, in the financial services sector, the Australian Prudential Regulation Authority (APRA) oversees the use of AI by regulated entities, such as banks and insurance companies. APRA's focus is on ensuring that AI systems are integrated into sound risk management frameworks, maintain data integrity, and do not introduce undue risks to financial stability or consumer outcomes. For automated decision-making in government services, particularly those with high impact on individuals (e.g., welfare, critical public services), the Policy for the responsible use of AI in government (2024) and the DTA's Impact Assessment Tool mandate rigorous risk assessments, human oversight, transparency, and contestability mechanisms. This ensures that AI-driven government decisions are fair, accountable, and provide avenues for redress. Furthermore, the eSafety Commissioner addresses online harms, including those potentially exacerbated by AI such as deepfakes and AI-facilitated abuse, under the Online Safety Act 2021, while the Office of the Australian Information Commissioner (OAIC) applies privacy protections to biometric surveillance systems, ensuring ethical data handling and consent. This integrated approach allows for tailored regulation that accounts for the specific risks and opportunities within each sector.

International alignment

Australia places a strong emphasis on aligning its AI governance framework with international norms and standards, recognizing the global nature of AI development and deployment. This commitment is evident from the foundational Australian AI Ethics Principles (2019), which were developed with explicit reference to and alignment with the OECD AI Principles, advocating for trustworthy and responsible AI stewardship. This early alignment set a precedent for Australia's engagement in global AI governance discussions and frameworks. Subsequent policy documents, such as the National Framework for the Assurance of Artificial Intelligence in Government (2024), further reinforce this commitment by referencing international instruments like the OECD principles, the Bletchley Declaration, and Seoul outcomes, demonstrating Australia's active participation and desire for consistency in the international AI policy landscape. The ongoing development of Australia's AI regulatory approach, particularly concerning potential mandatory guardrails for high-risk AI, is heavily influenced by international precedents. The "Proposals Paper for Introducing Mandatory Guardrails for AI in High-Risk Settings" (2024) explicitly acknowledges and considers approaches taken by other leading jurisdictions, notably the EU AI Act and Canadian frameworks. This intentional benchmarking aims to ensure that any future Australian regulations are interoperable, avoid regulatory fragmentation, and support cross-border trade and collaboration in AI technologies. Moreover, the Voluntary AI Safety Standard (VAISS) (2024) is designed to be consistent with globally recognized standards such as AS ISO/IEC 42001 (AI management system) and the NIST AI Risk Management Framework (AI RMF), providing a practical pathway for Australian organizations to adopt internationally recognized best practices for AI safety and responsibility. This consistent focus on international alignment underscores Australia's strategic goal to be a trusted and responsible player in the global AI ecosystem, facilitating innovation while upholding shared values and mitigating collective risks.

What's next

Australia's AI regulatory landscape is poised for significant evolution, with several key initiatives underway that signal a move towards more definitive and potentially mandatory regulations for certain AI applications. The most impactful future development stems from the "Proposals Paper for Introducing Mandatory Guardrails for AI in High-Risk Settings," published in September 2024. This paper initiated a crucial consultation process to define "high-risk AI" and explore the implementation of ten high-level mandatory guardrails across the AI supply chain and lifecycle. These guardrails cover critical areas such as testing and evaluation, transparency, data governance, human oversight, accountability, incident reporting, and conformity assessment. The consultation is actively seeking feedback on three potential regulatory pathways: integrating guardrails into existing sectoral frameworks, a coordinated approach across existing regulators, or the creation of a standalone cross-economy AI Act with a dedicated regulator. The outcome of this consultation is expected to directly inform future legislative and policy reforms, potentially introducing new statutory obligations and enforcement mechanisms for high-risk AI in Australia. Complementing these potential regulatory changes, the Australia National AI Plan 2025, published in December 2025, outlines a strategic roadmap that includes the establishment of the Australian Artificial Intelligence Safety Institute (AISI). Targeted to be operational in early 2026, the AISI will play a critical role in providing independent technical analysis, monitoring, and safety testing, offering expert advice to regulators and ministers. This institution is designed to bolster Australia's capacity to understand and mitigate AI risks, feeding directly into the ongoing development of the regulatory framework. Furthermore, the Productivity Commission's "Harnessing data and digital technology" inquiry report (2025) has recommended a three-year monitoring period for AI and its interaction with copyright before considering legislative changes, and proposed reforms to the Consumer Data Right and a shift towards outcomes-based privacy regulation. These interconnected initiatives collectively indicate a dynamic and iterative approach to AI governance, with a clear trajectory towards a more robust, adaptive, and potentially legally binding framework designed to navigate the complexities and opportunities presented by rapidly advancing AI technologies.