Australia AI Governance Profile

Executive summary

Australia does not currently have a single horizontal AI Act or a general mandatory high-risk AI regime. The current architecture combines the National AI Plan, mandatory Policy for the Responsible Use of AI in Government, existing privacy and consumer protections, the Australian AI Safety Institute, and sector-specific regulatory work. For public bodies, the Commonwealth policy creates mandatory internal controls for responsible AI use within its scope. For private enterprises, the main near-term legal development is the enacted privacy transparency requirement for certain automated decisions, which is scheduled to commence on 10 December 2026. The proposed mandatory guardrails consultation has closed without the government proceeding with that broad regime at this time; it should therefore remain a closed or deferred policy pathway, not current law. Australia’s governance signal is consequently implementation-led and adaptive. Enterprise readiness should focus on privacy, transparency, record-keeping, consumer protection, sector obligations, safety testing, procurement controls, and monitoring of future legislative or regulator action.

Governance architecture

Australia’s AI governance architecture is layered across Commonwealth administrative policy, privacy and consumer law, sector regulation, safety and evaluation infrastructure, and national strategy. The Policy for the Responsible Use of AI in Government is a mandatory Commonwealth public-sector control within scope. The National AI Plan is strategic rather than binding, the Australian AI Safety Institute provides capability and testing infrastructure rather than general regulatory authority, and the scheduled Privacy Act transparency amendments create a targeted legal requirement for certain automated decisions. The previous mandatory high-risk guardrails pathway is not an enacted regime.

Major policies and frameworks

Policy timeline

Enterprise implications

Enterprises should not treat the closed mandatory-guardrails consultation as current law. Near-term controls should focus on existing privacy, consumer, sector and security obligations; transparency and record-keeping for significant automated decisions ahead of 10 December 2026; model and data documentation; human review and escalation; testing and assurance; procurement and vendor controls; and monitoring for future Commonwealth or sector-specific rules. OAIC’s 30 September resources translate the future statutory requirement into operational guidance. APP entities using personal information in decisions that could reasonably significantly affect rights or interests should inventory relevant processes and prepare privacy-policy disclosures ahead of 10 December 2026. The guidance did not enact a new law.

Observatory interpretation

Australia is an implementation-led and adaptive jurisdiction. Its binding AI-specific signal is currently strongest in Commonwealth public-sector policy and targeted privacy transparency, while the National AI Plan and Australian AI Safety Institute build capability and direction. The absence of a broad enacted high-risk guardrail regime is itself material and should be recorded as a policy status, not silently converted into a regulatory gap or an assumed future law.

Official resources