The map
Most of the obligations that reach Australian businesses are not AI law. They come from rules that already exist: privacy, consumer law, employment, contract. The AI-specific material is still mostly voluntary, or made overseas.
Personal information handled by or through an AI tool falls under the same collection, use, disclosure and security rules as any other personal information. The law most Australian businesses using AI are actually bound by.
Applies to: APP entities: businesses with annual turnover over $3 million, and some smaller businesses regardless of size (health service providers, businesses that trade in personal information, Commonwealth contractors, others)
The privacy regulator's October 2024 guidance on adopting off-the-shelf AI tools: check what the product does with personal information before you use it, keep personal information out of public tools, and say what you use in your privacy policy.
Applies to: APP entities using off-the-shelf AI tools, from chatbots to features inside software they already run
The privacy regulator's October 2024 guidance for anyone who builds, trains, adapts or fine-tunes a generative AI model with personal information. Public data is still personal information; reuse of customer data needs a reasonable expectation or consent.
Applies to: Entities that develop, train, adapt or fine-tune generative AI models using personal information, including fine-tuning a vendor's model on your own data
The prohibition on misleading or deceptive conduct applies to what your business publishes or tells customers, whether a person or an AI system produced it. Every business, every size, no AI carve-out.
Applies to: Every business in trade or commerce in Australia, regardless of size or turnover
ASIC's October 2024 review of how 23 financial services and credit licensees govern AI, and its warning that adoption is outrunning governance. Existing licensee obligations already apply to AI use.
Applies to: AFS licensees and credit licensees. Not other businesses.
The prudential regulator's April 2026 letter setting out what it expects of banks, insurers and superannuation trustees as they adopt AI. Binding in practice for APRA-regulated entities; a useful benchmark for everyone else.
Applies to: APRA-regulated entities: banks, insurers, superannuation trustees. Not other businesses.
The EU's risk-based AI law, in force since August 2024 and phasing in. It reaches Australian businesses through EU customers, EU users and contracts, not through Australian regulators.
Applies to: Australian businesses that sell AI-enabled products or services into the EU, or whose AI outputs are used in the EU, and their suppliers by contract
The risk assessment every NSW Government agency must run on any system with an AI component, mandated by Circular DCS-2024-04 and modernised in January 2026. Binding on agencies; reaches suppliers through procurement.
Applies to: NSW Government agencies (mandatory), and any business supplying AI-enabled systems or services to them
From 10 December 2026, privacy policies must explain the automated decisions that significantly affect people and the personal information behind them. Enacted law with a fixed commencement date.
Applies to: APP entities that use computer programs, including AI, to make or substantially inform decisions that could significantly affect a person's rights or interests
The National AI Centre's six essential practices for adopting AI, published 21 October 2025 to replace the Voluntary AI Safety Standard. Voluntary, but the closest thing to an official Australian definition of reasonable AI governance.
Applies to: Any organisation developing or deploying AI. Voluntary. Written for businesses without a specialist team.
The government's September 2024 standard of ten voluntary guardrails for AI, superseded on 21 October 2025 by the National AI Centre's Guidance for AI Adoption. Kept here because people still search for it.
Applies to: Nobody, as of October 2025. Read the Guidance for AI Adoption instead.
Eight voluntary principles from 2019 for responsible AI, from human wellbeing to contestability and accountability. Not enforceable; still the vocabulary Australian guidance and tenders use.
Applies to: Everyone and no one: voluntary, aimed at any organisation designing, developing or using AI.
The international standard for running an AI management system, adopted in Australia as AS ISO/IEC 42001:2023. Voluntary. Relevant when a large customer or tender asks for certification; not needed to use AI tools.
Applies to: Businesses asked for certification by a customer or tender; not businesses that only use AI tools
The Commonwealth's proposed mandatory AI standards framework, announced July 2026, headed to National Cabinet in August 2026 with legislation expected early 2027. The mandatory obligations named so far centre on large-scale data centres, not general business AI use.
Applies to: Large-scale data centres initially; broader scope to be defined by the legislation
Draft legislation putting a legal duty of care on digital services, including AI chatbots, to protect Australian users and especially under-18s, with penalties up to $109.2 million. Out for consultation; bill promised for 2026.
Applies to: Digital service providers: social media platforms, apps, online games and AI chatbots used by Australians, with specific duties toward under-18s
The government's December 2025 roadmap: capture the economic opportunity, spread the benefits, keep Australians safe through existing laws rather than an AI Act. Policy direction, not an obligation, and partly overtaken by the July 2026 decision to legislate Australian Standards for AI.
Applies to: Policy direction for government, regulators and industry. Creates no obligation for any business.
A binding privacy code for online services children are likely to use, due for registration by 10 December 2026. Best interests of the child, strict data minimisation, consent for marketing. Exposure draft consulted; final code pending.
Applies to: APP entities providing social media, messaging, gaming, streaming and other online services likely to be accessed by children, or aimed at children. Health service providers excluded.