What the rules now require, and when.
Australia has no AI-specific statute in force. The December 2025 National AI Plan dropped the proposed mandatory guardrails, but on 15 July 2026 the government announced legislated Australian AI standards and on 26 August 2026 National Cabinet agreed a national framework, with legislation intended in early 2027. Until then, obligations come from privacy law, consumer law and sector regulators. This tracker lists each change with its source, its date and its status. Legal requirement, regulator guidance, best practice and our interpretation are always labelled separately.
DueIn forceConsultationPublished
Automated decision-making transparency
Privacy policies must state the kinds of personal information used in, and the kinds of decisions made solely by the operation of computer programs, and the kinds of decisions for which a thing substantially and directly related to making the decision is done by those programs, where the decision could reasonably be expected to significantly affect an individual's rights or interests. Inserted by the Privacy and Other Legislation Amendment Act 2024; 24-month commencement. Privacy and Other Legislation Amendment Act 2024 (Cth) Sch 1 Pt 15
The first hard AI-adjacent date for ordinary businesses. Applies to screening, scoring, pricing and eligibility tools even where a human signs off, if the program "is substantially and directly related to making the decision". Map decisions first; wording second.
Applies toAll APP entities (organisations with turnover above A$3m, plus health providers and others regardless of size)
Fair Work Commission: AI use in Commission cases
The Commission finalised its generative AI guidance note on 25 Aug 2026, stating "New requirements in our AI guidance note apply from 20 October 2026". The exposure draft requires that where generative AI was used, "you must state in the document that GenAI was used in preparing the document"; that "all references to facts or evidence in the document are correct and the facts or evidence exist" and "all cases, legislation, textbooks and articles referred to in the document exist and stand for the legal positions attributed to them"; that verification be done "by looking at sources of information known to be correct" rather than by asking the AI; that legal practitioners "include in the document hyperlinks to all case law referred to in the document"; and that witness statements and declarations reflect the witness's own knowledge. Sources: Fair Work Commission, 25 Aug 2026 and the exposure draft of 24 Mar 2026.
The nearest hard date on this page, and the one most employers will trip over. Any unfair dismissal response, witness statement or submission drafted with AI help now needs a disclosure line and a human who has checked every citation against the real source. Brief HR and any external agent before 20 October.
Applies toAny party or representative filing documents in Fair Work Commission proceedings
Privacy Act tranche 2
Exposure draft released 31 Aug 2026; submissions close 18 Sep 2026. Proposes a "fair and reasonable" test for handling personal information, a 72-hour breach notification window, a controller/processor distinction, and a right to erasure for large platforms. Commencement dates are blank. Attorney-General's Department
The "fair and reasonable" test would apply to AI training and profiling regardless of consent. Expect a transition of six months or more after passage; not a 2026 obligation, but the direction is set.
Applies toAPP entities; some small-business changes proposed
NSW: AI and algorithms brought inside work health and safety duties
SafeWork NSW opened consultation on guidelines under the Work Health and Safety Amendment (Digital Work Systems) Act 2026, which defines a digital work system as "an algorithm, artificial intelligence (AI), automation or online platform". The Act clarifies "that the existing primary duty of care…applies to managing risks arising from the use of digital work systems", creates "a new duty requiring PCBUs to consider whether the health and safety of workers is put at risk by the allocation of work by a digital work system", and gives entry permit holders a power to require reasonable assistance to access and inspect those systems. "Most provisions, including the new EPH power itself, cannot commence earlier than one month after the DWS Guidelines are published." SafeWork NSW, page modified 19 Aug 2026.
The first Australian law to put algorithmic work allocation squarely inside WHS duties, and it applies to ordinary employers, not just platforms. If you use AI to roster, allocate, score or monitor staff in NSW, that system belongs on your risk register now. Commencement is tied to the guidelines, so the clock starts when they publish.
Applies toAll NSW PCBUs using algorithms, AI, automation or platforms to allocate, direct or monitor work
Mandatory rules for large AI data centres
The Prime Minister announced that expectations on self-supplied energy, full connection-cost recovery and water use will become mandatory, National Cabinet agreed the framework on 26 Aug 2026, broadening it to land use and to skills and training, and the Commonwealth intends to legislate in early 2027; Sources: Prime Minister of Australia, 15 Jul 2026 and Meeting of National Cabinet, 26 Aug 2026. The text and data mining exception was ruled out separately, in the National AI Plan of Dec 2025. An Office of AI was established in the Department of the Prime Minister and Cabinet on 15 Jul 2026 to "coordinate across Australian Government agencies to design and legislate the new Australia artificial intelligence (AI) standard and unlock AI training in Australia".
Converts the March "Expectations" from voluntary to binding. Raises the cost of grid-connected projects without firm supply and favours developers with power secured.
Applies toLarge data-centre developers and operators
OAIC guidance on automated decision-making
OAIC published an issues paper on ADM transparency (submissions closed 15 Jun 2026) and indicated final guidance by September 2026. Final guidance not published as at 13 Sep 2026.
Draft your wording from the Act now; adjust when guidance lands. Waiting for guidance leaves too little time before 10 December.
Applies toAPP entities
Expectations of Data Centres and AI Infrastructure Developers
Five expectations: national interest and sovereignty, energy transition contribution, water, workforce, innovation. DISR
The baseline that the July announcement proposes to make mandatory. Read it as the future licence to operate.
Applies toData-centre and AI infrastructure developers
OAIC privacy-policy compliance sweep
OAIC began a sweep of privacy policies; a non-compliant privacy policy can breach APP 1.3 or APP 1.4, civil penalty provisions under s 13K of the Privacy Act 1988 (Cth) carrying a maximum of 200 penalty units, being A$72,800 at the penalty unit value of A$364 in force from 1 Jul 2026.
Enforcement posture is active before the ADM date. Privacy policies are the cheapest thing to get right and the first thing checked.
Applies to~60 organisations across six sectors
National AI Plan: Empowering all Australians
Mandatory AI guardrails dropped in favour of existing technology-neutral law; A$29.9m to establish the AI Safety Institute in early 2026; the existing A$17m AI Adopt Program moves into the National AI Centre. Source: National AI Plan, DISR, Dec 2025.
Superseded in part. This was the settled position until 15 July 2026, when the government announced it would legislate Australian AI standards; National Cabinet agreed the framework on 26 August 2026 and legislation is intended in early 2027. Until a bill exists, compliance demand is still driven by privacy, consumer and sector law. Free SME adoption help exists; governance help largely does not.
Applies toEconomy-wide
Guidance for AI Adoption
Replaces the ten voluntary guardrails with six practices, starting with "decide who is accountable". DISR
The de facto standard a regulator, insurer or customer will measure a small business against. Our kit maps to it clause by clause.
Applies toAll organisations
OAIC: privacy and commercially available AI products
"Do not enter personal information, and particularly sensitive information, into publicly available generative AI tools." Also covers transparency, accuracy and secondary use. OAIC
The single sentence every staff member should know. Most breaches in small businesses are a paste, not a hack.
Applies toAll APP entities using AI tools
Dot colour: red = binding law, amber = starts soon, teal = proposed or in consultation. Type labels: Legal requirement = in an Act or regulation; Regulator guidance = published by a regulator, not itself law; Government policy = executive policy or program; Proposed = announced or in consultation. Interpretation column is AI Economy Index' view and is not legal advice. Last checked 13 Sep 2026.
Three dates.
18 September 2026: tranche 2 submissions closed. The draft is still an exposure draft and the government says it remains subject to further consideration. 30 September 2026: the OAIC published its guidance on the ADM duty and updated Chapter 1 of the APP Guidelines. 10 December 2026: the ADM disclosure duty starts. We update this page when any of them moves.