AI consulting in Australia now means helping organisations self-govern. The Government did not proceed with mandatory AI guardrails and released the National AI Plan in December 2025, which relies on existing laws such as the Privacy Act and Australian Consumer Law. Good AI consulting services map your uses, meet that law, build against the voluntary Guidance for AI Adoption, and leave evidence.
For most of 2024 and 2025, Australian boards planning AI projects were waiting for a rulebook. The Department of Industry, Science and Resources released a proposals paper in September 2024 with ten mandatory guardrails for high-risk AI, and many organisations paused until they knew what the law would require.
That AI-specific act is not coming this cycle. After consultation, the Government chose not to proceed with mandatory guardrails. The National AI Plan leans on Australia's technology-neutral laws and points organisations to voluntary guidance. A national AI Safety Institute began standing up in early 2026 to monitor risks and work with international partners.
This guide is for COOs, CIOs and CFOs at mid-sized and enterprise Australian organisations. It covers what binds you, what an AI strategy engagement should produce, and how to choose a partner. If you are comparing firms, our buyer's guide to AI consulting in Australia covers how to tell them apart.
Key takeaways
- There is no AI-specific act. The Privacy Act 1988, Australian Consumer Law, anti-discrimination law, WHS duties and sector rules apply to AI conduct directly.
- The National AI Centre's Guidance for AI Adoption (October 2025) sets six essential practices. It is voluntary, and it is the yardstick regulators, insurers and enterprise buyers will reach for.
- Governance effort should follow exposure: decisions about people need full oversight; internal drafting needs a light touch.
- Staff use of consumer AI tools (shadow AI) carries the same legal weight as systems you approve.
- The deliverable from AI consulting services is now a working system plus the evidence that it meets the law.
How did Australia's AI rules land between 2024 and 2026?
The direction of travel explains why the burden now sits with you.
- Sep 2024Two documents landVoluntary AI Safety Standard published, plus a proposals paper on mandatory guardrails for high-risk AI
- Oct 2025Guidance for AI AdoptionNational AI Centre releases six essential practices, evolving the earlier standard
- Dec 2025National AI PlanGovernment relies on existing technology-neutral law, does not proceed with mandatory AI guardrails
- Early 2026AI Safety InstituteNew body stands up to monitor AI risk and coordinate internationally
Two points matter. First, the voluntary material was refined, not abandoned. The Voluntary AI Safety Standard of 5 September 2024 set out ten guardrails. In October 2025 the National AI Centre replaced it with the Guidance for AI Adoption: six essential practices, split into a Foundations track for organisations getting started and an Implementation track for technical and governance teams.
Second, not legislating AI specifically does not leave AI unregulated. AI is another way your business can breach or comply with the laws you already answer to.
What still binds you after the National AI Plan?
A consultant who says AI is now a free-for-all in Australia has misread the Plan. The question is which existing statutes your particular use touches.
| Guidance for AI Adoption | Existing law | Impact | |
|---|---|---|---|
| Status | Voluntary, no new penalty | In force, enforceable now | Binding |
| Personal information in prompts or training | Practice: data governance | Privacy Act 1988, APPs | Applies |
| AI-generated claims to customers | Practice: accountability | Australian Consumer Law, s18 | Applies |
| AI in hiring or credit decisions | Practice: human oversight | Anti-discrimination law | Applies |
| AI advice in a safety-critical setting | Practice: risk management | WHS duties, sector rules | Applies |
Read the right-hand column as the floor. The guidance helps you meet it defensibly, and does not soften it. If a chatbot on your site tells a customer something untrue about a product, following voluntary guidance is useful evidence of good faith, and the misleading conduct provisions of the Australian Consumer Law still apply.
The Privacy Act deserves particular attention. Personal information in a prompt, a fine-tuning set or a retrieval index is still personal information, and the Australian Privacy Principles govern how you collect, use, disclose and secure it. Where that data is processed becomes a governance question, which is why private AI infrastructure is now a common part of scoped engagements.
What are the six essential practices in the Guidance for AI Adoption?
The Guidance for AI Adoption is the closest thing Australia has to a national baseline. Treating it as optional is a commercial risk even though it is not a legal duty.
- AccountabilityName who owns each AI system
- Assess impactUnderstand who it affects
- Manage riskMeasure and control it
- Share informationBe transparent up and down the chain
- TestContinuously, not once
- Human oversightKeep a person able to intervene
None of these is exotic. Organisations stumble because each needs an owner and a habit, and a filed policy satisfies none of them. Accountability means a named person who can explain a decision the system made last Tuesday. Human oversight means someone with the authority and tooling to override the model before harm reaches a customer.
The guidance aligns with Australia's AI Ethics Principles, ISO/IEC 42001 and the NIST AI Risk Management Framework, so building against it also prepares you for enterprise and export buyers who ask for those standards by name.
Use the two tracks as intended. Foundations is for directors and managers setting expectations before a project starts. Implementation is for the people who build and run systems, and is where testing, logging and oversight get specified. Handing the whole document to the technical team and hoping governance emerges is how practices end up existing only on paper. Our AI governance framework guide shows what a defensible version of each looks like.
Where does your AI risk actually sit?
A model drafting internal meeting notes is a different problem from one that helps decide who gets a loan. Spending equally on both wastes money and starves the high-risk system of attention. A short strategy engagement earns its keep by sorting your uses before you build.
What does the AI system touch?
- Decisions about people (hiring, credit, eligibility)High risk: full impact assessment and human oversight
- Personal information at scalePrivacy Act review and data governance first
- Public-facing claims or adviceAustralian Consumer Law check on outputs
- Internal drafting and productivity onlyLight-touch: acceptable-use policy and testing
The closer a system sits to a decision affecting a person's rights, money or safety, the more of the six practices apply in full. Mapping uses first lets you move faster on the low-risk ones because you have already decided they are low risk.
Are unapproved AI tools still your responsibility?
Yes. Before any board approves an AI project, staff are already pasting company and customer information into consumer AI tools that may store or train on it. This shadow AI carries the same legal weight as anything you deploy deliberately.
If an employee pastes customer records into a public chatbot to clean them up, Privacy Act obligations attach to that disclosure whether or not anyone signed off. If a customer-facing team member relies on a wrong AI answer, the Australian Consumer Law does not care that the tool was unofficial.
An early output of a scoping engagement is usually an inventory: what tools are in use, what data flows into them, and which flows create exposure. It is dull work, and it is often where the real risk is hiding. Our guide to a shadow AI inventory and policy explains how to run one.
What should AI consulting services in Australia deliver now?
Because Australia chose guidance over legislation, you are no longer buying an interpretation of a new law. You are buying a working system that meets existing law and stands up against the voluntary baseline, plus the evidence that it does.
For example, a services organisation with several hundred staff running Xero, a CRM and a document store wants an AI assistant across customer support and internal operations. A scoped engagement would usually deliver:
- A use-case map separating high-risk applications from low-risk ones, so effort follows exposure.
- A data and hosting decision that satisfies the Privacy Act, often keeping processing onshore.
- The built and integrated system, connected to the tools the business already runs so work flows rather than piling up in a new silo.
- Governance evidence: named owners, impact assessments, a testing schedule and a rehearsed override path.
The last item is the one most often skipped and most often regretted. When something goes wrong, the question is never whether you had a glossy AI policy. It is whether you can show what the system did, who was responsible and how a person could have stopped it.
- Impact assessment at design timeDays
- Reconstructing it after an incidentWeeks
- Enterprise deals that ask for ISO 42001 alignmentWinnable
- Regulator or insurer asking 'who was accountable?'Answerable
Should your AI run on your own infrastructure?
The National AI Plan does not force this choice. The Privacy Act, sector rules and enterprise security questionnaires often push sensitive data onshore and inside your own boundary.
Running models in your own environment suits some workloads; others are better served by a managed provider. It fits when data is sensitive, when a contract or regulator requires onshore processing, or when you need an audit trail you fully control. We built RootCauseAI, our own on-premise investigation product, for teams that could not send incident data to an external service. The same pattern carries to any organisation with that constraint. Our data sovereignty guide covers the decision in more depth.
The practical test: if you cannot answer in writing where your data is processed and who can see it, you are not ready to deploy. That gap is a normal first output of scoping.
How do you choose an AI consultant in Australia?
With no regulator pre-approving the approach, the choice of partner matters more. Ask them to:
- State in writing where your data will be processed.
- Name the six essential practices and show how their delivery builds each one in.
- Show the override path on a system they have shipped, not a diagram.
- Tell you what they advised a previous client not to automate.
Understanding your regulatory environment matters more than postcode. A partner working with an Adelaide defence supplier needs that sector's data-handling expectations, which is why our Adelaide page leads with sovereignty. The AI consulting guide has a fuller checklist of engagement models and red flags.
What is the takeaway for Australian boards?
There will be no AI-specific act handing you a checklist this cycle. Existing law reaches your AI conduct directly, and the Guidance for AI Adoption is the baseline you will be measured against. Organisations that treat that baseline as the real standard, and keep evidence that they met it, will move faster and carry less risk than those still waiting for permission.
How Solve8 can help
Our consultants and engineers start with your obligations: we map your AI uses, decide where data is processed, and build systems that run on your infrastructure in Australia with a person approving before anything reaches a customer or system of record. See our AI strategy service, or contact us to scope the first phase.
