National AI Plan

What it is

The federal government’s AI policy, released on 2 December 2025 under three headings: capture the opportunities, spread the benefits, and keep Australians safe. Its regulatory decision was the news: Australia would manage AI through “strong existing, largely technology-neutral legal frameworks” and regulators’ existing expertise, with no standalone AI Act and no mandatory guardrails for high-risk AI, ending the 2024 proposals paper. The minister’s phrase was to regulate “as much as necessary but as little as possible”. It funded an Australian AI Safety Institute, about $30 million, to test and monitor AI capabilities and risks, with advisory rather than enforcement powers, and it promised work with the states to clarify existing rules and future protections for workers on AI surveillance and rostering. Seven months later the direction shifted: in July 2026 the government announced it would legislate mandatory Australian Standards for AI and establish an Office of AI, and National Cabinet backed that framework in August. The plan remains the statement of the government’s approach; the Standards are where its regulatory position now lives.

What it requires

Nothing of a business. The plan directs government: investment in data centres, skills and public-service AI adoption; the AI Safety Institute; regulators applying the laws they already hold, the OAIC on privacy, the ACCC on consumers, eSafety on online harms, the TGA on medical software; and targeted fixes where a gap is found. For a business the operative consequence is the one the plan states and every entry on this Map repeats: the obligations that reach you are in existing law, applied to AI, and the government’s published measure of reasonable practice is the voluntary Guidance for AI Adoption.

Does this reach your business?

Not directly, and that is the point of it. What reaches you is the law the plan chose to rely on: the Privacy Act, consumer law, employment and safety law, and sector regulators’ expectations. Read the plan for direction, not duties. The direction changed once already, in July 2026; the Australian Standards for AI entry on this Map is where to watch for obligations that may eventually reach general business.

What we recommend

Our advice is to take the plan at its word and govern under existing law now, rather than waiting for AI-specific rules that the plan said would not come and the July decision says will come slowly and, so far, for data centres. Use the Guidance for AI Adoption as your working checklist, because it is what the plan points regulators and industry to. Keep one record of what AI you use, who owns it and what it touches; every regulator the plan names will ask for the same thing. And note the two dates that did come out of this policy line: December 2026 for automated-decision transparency in the Privacy Act, and 2027 for the first Australian Standards for AI legislation.