AI Regulation in Australia: A Guide for Legal Teams
How AI is regulated in Australia today: the laws that already apply, the national guidance, sector rules and when the EU AI Act reaches you.
- Published
- Updated
AI regulation in Australia relies on existing laws, with voluntary national guidance helping organisations govern their use of artificial intelligence. Australia has no general federal AI Act equivalent to the EU AI Act. Privacy, consumer protection and anti-discrimination duties already apply to AI use.
For legal teams, the starting point is the business activity: what the system does, whose information it uses and who its decisions affect. An approved AI policy helps manage those activities, but it does not replace compliance with the laws governing them.
Is There an AI Act in Australia?
No, Australia has no general federal AI Act comparable to the EU regime. The National AI Plan builds on existing, largely technology-neutral laws and sector regulation, with targeted action against particular harms.
The government’s mandatory guardrails consultation update says it will not proceed at this time with the earlier proposals for mandatory AI development and deployment guardrails. Those proposals must not be described as enacted requirements.
That position leaves enforceable duties under other legislation intact. A misleading AI-generated product claim, for example, can engage consumer law even though there is no general AI Act. Legal review must therefore examine the proposed activity and its consequences, rather than wait for an AI-specific statute.
Laws That Already Apply to AI
Existing Australian laws apply according to the activity, information and people involved in an AI system. The National AI Centre’s legal overview explains how established duties address AI-related harms.
Legal Duties and Their Practical Effect
| Area | How it applies to AI | What the legal team needs to assess |
|---|---|---|
| Privacy Act 1988 and Australian Privacy Principles | Covered entities must comply when AI collects, uses or discloses personal information, including information generated about a person. | The lawful basis for handling information, permitted purposes, security and disclosures to providers. |
| Australian Consumer Law | Misleading conduct and false representations can arise from AI outputs or claims about an AI product. | Whether customer-facing answers and advertised capabilities create a false impression. |
| Anti-discrimination law | AI-assisted decisions can expose an organisation to discrimination claims, including in recruitment. | Whether selection criteria or resulting decisions disadvantage people on protected grounds. |
| Professional obligations | Lawyers retain duties concerning competence, confidentiality, supervision and the administration of justice. | Whether the proposed use protects client information and produces work the responsible practitioner can properly use. |
| Corporate and sector obligations | Directors’ duties and financial-services rules can apply to the governance and consequences of AI use. | Who approves the use, which licence obligations apply and how risks are controlled. |
| Other applicable laws | Copyright, contract, duties of confidence and workplace safety can constrain a particular use. | Rights in the inputs and outputs, contractual restrictions and risks to workers. |
The Office of the Australian Information Commissioner’s guidance applies the privacy rules to commercial AI products. Its best-practice advice is to avoid entering personal information, particularly sensitive information, into publicly available generative AI tools.
Recruitment needs its own assessment. The Australian Human Rights Commission’s AI recruitment checklist addresses fairness and the ability to challenge outcomes, alongside privacy and accountability.
For legal practice, applicable conduct rules and court directions remain separate requirements. The Queensland Law Society’s AI guidance explains how confidentiality and supervision duties apply in Queensland. A firm must also apply the rules and directions governing its own practitioners and proceedings.
Guidance and Standards
The national Guidance for AI Adoption sets out six practices for responsible AI governance. It is voluntary guidance, while the underlying legal obligations remain enforceable.
The National AI Centre’s foundations guidance covers early and lower-risk use. Its implementation guidance provides more detail for complex or higher-risk systems. Our Guidance for AI Adoption guide explains how to apply the practices without treating a completed checklist as legal approval.
Regulator guidance adds the requirements relevant to a particular activity. The OAIC AI guidance concerns personal information. The Australian Securities and Investments Commission’s Report 798 examines AI use and governance among financial-services and credit licensees.
Privacy reform also creates a forthcoming transparency obligation for certain computer-assisted decisions. Covered entities will need privacy-policy information where the statutory conditions concerning personal information and effects on individuals are met. The OAIC’s official commencement and scope details explain when those duties begin. Our automated decision-making guide covers the distinction between wholly automated decisions and computer assistance that meets the statutory test.
The EU AI Act and Australian Businesses
The EU AI Act can reach an Australian business through its EU activities or the use of its AI outputs in the EU. Australian incorporation does not settle the question.
Article 2 of the EU AI Act covers providers placing AI systems or general-purpose AI models on the EU market, regardless of where the provider is established. It also covers providers and deployers outside the EU where the system’s output is used in the EU.
In a hypothetical example, an Australian supplier provides an AI recruitment system to an EU employer. That supply can bring the supplier within scope. An Australian organisation using a system entirely for Australian operations needs a different analysis of the territorial conditions.
Being within scope does not mean every AI Act obligation applies to every system. Identify the organisation’s role and the system’s classification, then assess the applicable requirements and commencement provisions. Record that analysis for each EU-facing use before approving procurement or deployment.
FinTrace
Statements in. Evidence out.
FinTrace turns your bank statements into one searchable Excel ledger and a written findings report, with every finding cited to its source page.
FinTrace
See how FinTrace works