Reference tracker, checked 24 October 2026

Australian AI rules and deadlines

Every Australian law, regulation, government policy and guideline that changes what an organisation must do with AI, in one place. The next deadline is first, and each entry links to its official source.

Australia has no standalone AI act. Obligations come from privacy, safety, financial services and online safety law, plus mandatory policies for government agencies that flow down to their suppliers.

Upcoming deadlines

  • 10 Dec 2026Privacy policies must disclose automated decisions that significantly affect people (APP 1.7 to 1.9)Every APP entity
  • Within 12 months of 15 Dec 2025Use case owners, a use case register, staff training and impact assessments under the DTA AI policy v2Non-corporate Commonwealth entities
  • 30 Apr 2027Existing AI use cases scoped and brought into line with the DTA AI policy v2Non-corporate Commonwealth entities
  • 31 Oct 2027First signed annual attestation under the NSW AI Operational PolicyNSW Government agencies
  • To be proclaimedNSW duty to keep algorithms, AI and work allocation systems safe for workersEvery business with NSW workers

Rules that apply to every Australian business

There is no standalone AI act. These general laws already reach AI systems that handle personal information or affect people.

Privacy and Other Legislation Amendment Act 2024: automated decisions (APP 1.7 to 1.9)

Law
Applies to
APP entities
Key dates
Royal assent 10 Dec 2024. Commences 10 Dec 2026.
What it requires
Your privacy policy must say when a computer program uses personal information to make, or substantially help make, decisions that could significantly affect people, and list the kinds of information and decisions involved.
Official source

Privacy and Other Legislation Amendment Act 2024: statutory tort for serious invasions of privacy

Law
Applies to
Individuals and organisations generally
Key dates
Commenced 10 Jun 2025.
What it requires
People can sue for serious, intentional or reckless invasions of privacy, including harm caused with AI.
Official source

OAIC guidance on privacy and the use of commercially available AI products

Regulator guidance
Applies to
Organisations using off-the-shelf AI tools
Key dates
Published 21 Oct 2024, updated 17 Jan 2025.
What it requires
The Privacy Act applies to personal information you put into an AI product and to what comes out of it. Take care before entering personal information into public tools.
Official source

OAIC guidance on privacy and developing and training generative AI models

Regulator guidance
Applies to
Developers training or fine-tuning models
Key dates
Published 21 Oct 2024, updated 23 Oct 2024.
What it requires
Check the accuracy of training data and confirm you may lawfully use any personal information in it, including scraped data.
Official source

Work Health and Safety Amendment (Digital Work Systems) Act 2026

Law
Applies to
Every business with workers in NSW
Key dates
Assent 18 Feb 2026. Main duties start on a date to be proclaimed, after SafeWork NSW publishes guidelines.
What it requires
Once in force, a business must ensure, so far as reasonably practicable, that algorithms, AI, automation and work allocation platforms do not put workers' health and safety at risk.
Official source

Criminal Code Amendment (Deepfake Sexual Material) Act 2024

Law
Applies to
Everyone
Key dates
Commenced 3 Sep 2024.
What it requires
Sharing sexual material of an adult without consent is a crime, including material created or altered with AI.
Official source

Guidance for AI Adoption (National AI Centre)

Voluntary guidance
Applies to
Any organisation developing or using AI
Key dates
Published 21 Oct 2025. Replaces the Voluntary AI Safety Standard of 5 Sep 2024 in practice.
What it requires
Six practices: decide who is accountable, understand impacts and plan, measure and manage risks, share essential information, test and monitor, and maintain human control.
Official source

Financial services

APRA and ASIC regulate AI through standards that already exist rather than AI-specific rules.

Prudential Standard CPS 230 Operational Risk Management

Regulation
Applies to
APRA-regulated entities
Key dates
Commenced 1 Jul 2025. Amended version commenced 1 Jul 2026.
What it requires
Manage operational risk, keep critical operations resilient and control material service providers, which includes AI vendors.
Official source

APRA Letter to Industry on Artificial Intelligence

Regulator guidance
Applies to
Banks, insurers and super trustees
Key dates
Published 30 Apr 2026.
What it requires
Boards able to challenge management on AI, an inventory of AI uses with clear owners, people involved in high-risk decisions, and tested exit plans for critical AI providers.
Official source

ASIC REP 798 Beware the gap: governance arrangements in the face of AI innovation

Regulator guidance
Applies to
AFS and credit licensees
Key dates
Released 29 Oct 2024.
What it requires
Governance must keep pace with AI adoption, and be in place before AI is deployed.
Official source

Health and online services

Two sectors where existing law treats some AI products as regulated products.

TGA: AI and medical device software

Regulator guidance
Applies to
Developers, manufacturers and sponsors of AI software
Key dates
Ongoing under the Therapeutic Goods Act 1989. Guidance updated 5 Feb 2026.
What it requires
AI software intended to diagnose, prevent, monitor, predict or treat disease or injury is a medical device and must meet TGA requirements. Its purpose decides this, not the technology.
Official source

eSafety Age-Restricted Material Codes (including generative AI and AI companion chatbots)

Regulation
Applies to
Online services, including generative AI services and chatbots
Key dates
Codes covering generative AI and chatbots in effect from 9 Mar 2026.
What it requires
Stop children reaching age-restricted content, including content generated by AI, with age assurance where the risk is higher.
Official source

Government agencies, and suppliers who sell to them

Agencies carry the duties below. Suppliers are usually asked to support them in tenders and contracts.

Policy for the responsible use of AI in government (DTA, v2)

Mandatory policy
Applies to
Non-corporate Commonwealth entities
Key dates
v2.0 effective 15 Dec 2025, v2.1 published 21 Oct 2026. Most requirements due within 12 months; existing use cases by 30 Apr 2027.
What it requires
Accountable officials, published transparency statements, a register of AI use cases with named owners, staff training and impact assessments for in-scope uses.
Official source

Technical standard for government's use of artificial intelligence (DTA)

Mandatory policy
Applies to
Australian Government agencies building or using AI
Key dates
Last updated 22 Aug 2025.
What it requires
Lifecycle practices for designing, training, testing, deploying and monitoring AI, with an addendum for agentic AI.
Official source

National framework for the assurance of AI in government

Voluntary guidance
Applies to
Australian, state and territory governments
Key dates
Released 21 Jun 2024.
What it requires
A shared approach to checking government AI against Australia's AI Ethics Principles. Most state policies build on it.
Official source

NSW AI Operational Policy (Circular DCS-2026-02) and the AI Assessment Framework

Mandatory policy
Applies to
NSW departments, agencies and statutory bodies
Key dates
Circular issued 30 Jul 2026. Assessment platform mandatory from 30 Sep 2026. First annual attestation due 31 Oct 2027.
What it requires
Register every AI use case, complete the risk self-assessment where required, and send high or critical risk uses to the AI Review Committee.
Official source

Queensland Artificial intelligence governance policy (QGEA) and the FAIRA framework

Mandatory policy
Applies to
Queensland departments and statutory bodies
Key dates
Policy v2.0.0 effective August 2026. FAIRA v2.0.0 effective September 2026.
What it requires
AI governance with regard to ISO 38507, and every AI use assessed against Australia's AI Ethics Principles using FAIRA, FAIRA LITE or an agreed equivalent.
Official source

Victoria: Administrative Guideline for the safe and responsible use of generative AI in the public sector

Mandatory policy
Applies to
Victorian public service bodies and public entities
Key dates
Made 27 Nov 2024.
What it requires
Prefer agency-approved tools, make sure staff understand the risks, monitor use, and do not use generative AI to make decisions or carry out assessments.
Official source

WA Government Artificial Intelligence Policy and Assurance Framework

Mandatory policy
Applies to
WA Government entities
Key dates
Published 5 Mar 2024, last updated 25 Aug 2026.
What it requires
An AI Accountable Officer and a self-assessment for every AI project. Medium-risk or higher projects, and those over $5 million, go to the AI Advisory Board.
Official source

South Australia: AI Ethics Policy and generative AI guideline

Mandatory policy
Applies to
SA Government agencies
Key dates
In force. See the source for current versions.
What it requires
Agencies apply the national AI Ethics Principles. The guideline covers the risks of generative AI tools.
Official source

Northern Territory: AI policy for public sector officers

Mandatory policy
Applies to
NT agencies, staff, contractors and service providers
Key dates
In force. See the source for the current version.
What it requires
AI with a real impact on services or the public must be assessed against the NT AI Assurance Framework.
Official source

Policy direction: where the rules are heading

These create no obligations today, but they show what is coming.

National AI Plan

Policy direction
Applies to
The whole economy
Key dates
Released 2 Dec 2025.
What it requires
The Government will manage AI risk through existing, largely technology-neutral laws and regulators, review those laws as needed, and fund an AI Safety Institute.
Official source

Mandatory guardrails for AI in high-risk settings (proposals paper)

Policy direction
Applies to
Was aimed at developers and deployers of high-risk AI
Key dates
Consulted Sep to Oct 2024. The Government will not proceed with mandatory guardrails at this time.
What it requires
Nothing. There is no mandatory guardrails regime.
Official source

AI consumer safety priorities

Policy direction
Applies to
Government work program
Key dates
Announced 20 Jul 2026.
What it requires
Five planned workstreams: a Digital Duty of Care for AI companies, a second round of privacy reform, AI safety at work, Australian Consumer Law options, and a framework for automated decisions by federal agencies.
Official source

Australia's AI Safety Institute

Policy direction
Applies to
Supports government and regulators
Key dates
Announced 25 Nov 2025, funded 2 Dec 2025, testing frontier AI systems by Jul 2026.
What it requires
Tests and monitors advanced AI and advises regulators. It places no duties on businesses.
Official source

Copyright and AI: no text and data mining exception

Policy direction
Applies to
AI developers and copyright owners
Key dates
Announced 26 Oct 2025.
What it requires
AI developers cannot rely on a new exception to train on Australian works without permission. Licensing options are under consultation.
Official source

Before 10 December 2026

The automated decisions rule is the one deadline that reaches most private businesses. List every place a system scores, ranks, approves or declines something about a person, such as credit checks, job applicant screening, claim triage or pricing. For each one, record what personal information it uses and whether a person reviews the outcome. Then update the privacy policy to describe them.

Our guide to the Privacy Act automated decision rules covers the detail, and the NSW AI Assessment Framework for agencies and suppliers explains what NSW agencies will ask of you.

Get an AI governance review

Questions

Does Australia have an AI act?

No. The National AI Plan released on 2 December 2025 manages AI risk through existing laws and regulators, and the Government has said it will not proceed with mandatory guardrails for high-risk AI at this time. Privacy, consumer, work health and safety, financial services and online safety laws all still apply to AI systems.

What is the next AI-related deadline for Australian businesses?

10 December 2026. From that date, an organisation covered by the Australian Privacy Principles must say in its privacy policy when it uses computer programs to make, or substantially help make, decisions that could significantly affect people (APP 1.7 to 1.9).

Do government AI policies apply to suppliers?

The duties sit with the agency, but agencies pass them on. A supplier selling an AI system to a Commonwealth, NSW, Queensland, Victorian or WA agency should expect to provide what the agency needs for its register, risk assessment and transparency statement.

Can I cite or link to this page?

Yes. Link to https://solve8.com.au/resources/australian-ai-rules/ and quote the date it was last checked. Every entry links to its official source, which is the authority to rely on.

This tracker summarises public sources for general information. It is not legal advice. Last checked 24 October 2026. Spotted a change? Email [email protected].