The changelog
A dated log of changes to AI regulation in Australia.
On 21 October 2026 the European Commission published the reference to EN 18286:2026 in the Official Journal. It's the first harmonised standard under the EU AI Act. The standard, written by CEN and CENELEC, sets out a quality management system for providers of high-risk AI systems. A provider that follows it is presumed to meet the quality management requirements in Article 17 of the Act, for the parts the standard covers. It's built around the life of an AI system rather than the whole organisation, and it's designed to sit on top of ISO/IEC 42001 or ISO 9001, not replace them. More harmonised standards are expected before the high-risk obligations apply from 2 December 2027.
Most Australian businesses won’t be providers of high-risk AI systems in the EU, so this doesn’t reach them. If you build or sell an AI product into the EU that could count as high-risk, you now have a named standard to work from rather than reading Article 17 cold. If you already run ISO/IEC 42001, this layers on it.
Check whether anything you supply into the EU could be a high-risk AI system under the Act. If it could, note EN 18286 against it in your register and decide who owns the question. If it couldn’t, there’s nothing to do.
The OAIC released its guidance for the automated decision-making transparency obligation (APP 1.7 to 1.9): a fact sheet, a flowchart, a government supplement and an updated APP 1 Guidelines chapter. The obligation commences 10 December 2026; the guidance treats spreadsheets and rules engines as computer programs, says human sign-off does not remove a tool from scope, and counts refusals as decisions.
On 30 September 2026 the privacy regulator released a fact sheet, a flowchart, a supplementary sheet for government agencies and an updated chapter of the APP 1 Guidelines, ten weeks before the obligation commences on 10 December 2026.
The guidance reads the rule broadly. “Computer program” includes spreadsheets and rules engines, not only AI. A person signing off on what the program recommends does not take the tool out of scope. A refusal counts as a decision. The guidance also confirms what the rule is not: it is a transparency obligation only, with no right for individuals to contest a decision or to be notified.
Our advice is unchanged: find the decisions your software makes about people, then write the three things the policy needs to say. We have written a plain-English guide to what counts as an automated decision.
ASIC has amended the Market Integrity Rules for securities and futures markets to require participants to test, monitor and govern their trading systems and algorithms, including AI and machine learning ones, and to clarify that AI-driven trading that creates a false or misleading appearance breaches the rules. The amendments take effect in 2028 after an 18-month transition; consultation on the updated guidance (RG 265 and RG 266) closes 5 November 2026.
This affects firms that trade on Australian securities and futures markets as ASIC market participants. If that is not you, nothing changes.
If it is you, the rules now make a trading algorithm your responsibility whether a person wrote it or a model learned it.
You must test it before it trades, watch it while it trades, and be able to show how you govern it. The rules are technology neutral, so a vendor’s AI trading tool is covered the same way as your own code. The false or misleading rule now expressly catches AI-driven trading that creates a false appearance in the market, whether or not anyone intended it.
You have time. The amendments commence in 2028, and ASIC extended the transition to 18 months after industry feedback. The practical step now is to list every trading algorithm you run, name who owns each one, and record how it is tested and monitored. That record is what ASIC will ask to see.
ASIC is also consulting on simpler guidance for market participants (updated RG 265 Guidance on ASIC market integrity rules for participants of securities markets, and RG 266 Guidance on ASIC market integrity rules for participants of futures markets, with RG 241 Electronic Trading withdrawn) until 5 November 2026. If the current guidance is problematic to apply, this is an opportunity to have your voice heard.
The government released draft Digital Duty of Care legislation for targeted consultation on 9 September 2026. It would require digital services, including AI chatbots, apps and online games, to protect Australian users and especially under-18s from harmful design and content, document their measures, and give social media users a choice over algorithmic feeds ("My Feed, My Way"). eSafety would enforce it, with penalties up to $109.2 million. A bill is promised for 2026.
This draft duty falls on businesses that provide a digital service to the public: social media platforms first, and then apps, online games and AI chatbots that Australians, and especially under-18s, use directly.
If your AI use is internal, or your chatbot serves adult customers of a business, nothing in this draft reaches you.
If you run a public-facing chatbot or app that a minor could reach, the draft would require you to protect young users from addictive design and from listed categories of harmful content, and to keep a written record of the measures you take and evidence that they keep working. Start that record now: it is the same record a regulator asks for after something goes wrong, and it costs little to begin.
This is an exposure draft, not law. The government is consulting platforms, industry bodies and civil society and says it will introduce the bill to Parliament this year. Scope, and the size of business it catches, will settle in the bill.
First Ministers endorse the framework; data centre standards to be developed
On 26 August 2026, National Cabinet agreed to the Commonwealth’s plan for a nationally consistent framework on AI, with mandatory minimum standards for large data centres covering energy, water and land use. All states and territories are behind it, with some flexibility built in on the energy detail. The Commonwealth will now work with the states to develop the actual standards, and national AI laws are still expected in early 2027.
For a typical business, this changes nothing you have to do today. The mandatory part lands on operators of large data centres, not on how most businesses use AI.
The framework announced in July now has the states behind it, so it is far more likely to become law. The dates to watch are the draft legislation later this year and the bill in early 2027, which will define any obligations that reach general business.
The next phase of the EU AI Act takes effect, sharpening the duties of those building with and deploying AI tools
From 2 August the next phase of the EU AI Act takes effect, including transparency requirements and the rules the Commission can now enforce, for anyone building AI systems or deploying them in the EU market.
This is EU law, so it reaches you only if you sell into or operate in the EU. Most Australian businesses using everyday AI tools are outside its scope. If you have EU customers or operations, check where your AI use sits under the Act; the penalties are large enough to justify legal advice.
The OAIC published updated guidance on the use of facial recognition in retail spaces.
On 30 July 2026 the OAIC published updated guidance on the use of facial recognition in retail spaces. The updated guidance implements the findings of the Administrative Review Tribunal (ART) in the matter of Bunnings Group Limited (Bunnings), which concerned the retailer’s use of facial recognition technology in 62 of its stores for a period between 2018 and 2021.
It sets out how the Privacy Act applies when a business captures and matches people’s faces
The OAIC expects the use to be:
If you use facial recognition in a store, a venue or a security system, this is the standard you will be measured against. Everyday AI tools are not affected.
The European Commission published guidelines on the AI Act's transparency obligations
On 20 July 2026 the European Commission published guidelines on the AI Act’s transparency obligations:
If you build, deploy or operate AI systems in the EU, or have EU customers, these guidelines set out when you must tell people they are dealing with AI and when generated content must be labelled.
For an Australian business outside the EU, they show where disclosure rules are heading: expect to tell people when they are dealing with AI and to label generated content. Both cost little to start now.
Government announced it will legislate mandatory 'Australian Standards for AI'; to be considered by National Cabinet in August 2026, legislation expected early 2027.
On 15 July 2026 the government announced it will legislate mandatory “Australian Standards for AI”.
A new Office of AI will sit inside the Department of the Prime Minister and Cabinet.
The mandatory obligations named so far centre on large-scale data centres and copyright, not on how most businesses use AI.
For a typical business, nothing concrete is in place yet. National Cabinet considers the framework in August 2026 and legislation is expected early in 2027.
Standards Australia published an explainer on AS ISO/IEC 42001:2023
Standards Australia published an explainer on AS ISO/IEC 42001:2023, the international management-system standard for AI.
It is ISO 27001 for AI: a recognised way to set up, run and improve how an organisation governs the AI it uses.
It is voluntary, not law. Expect large customers to start asking for ISO 42001 certification the way they ask for ISO 27001 or SOC 2 now, because a certificate is easier to check than your governance practices.
The themes of ISO 42001 cover ownership, risk assessment, monitoring and human oversight, and are the same ones sensible governance covers anyway.