Australia AI Law

Australia AI law combines generally applicable legislation, sector regulation and rules for government and court use of AI. The National AI Plan, released on December 2, 2025, makes existing legal frameworks and regulators the foundation of the Commonwealth's approach, alongside targeted responses to emerging harms. The September 2026 national AI standards consultation concerns proposed requirements for large data centres and frontier-AI training; it is not an enacted general AI statute.

This guide covers selected Commonwealth measures and state examples. Source review: September 18, 2026 (Australian Eastern time). It distinguishes legal obligations from policy, guidance and proposals.

Status at a glance

Measure	Legal status and scope
Privacy Act 1988 and Australian Privacy Principles (APPs)	Existing privacy obligations apply to covered entities using AI to handle personal information.
Automated-decision privacy disclosures	Enacted amendments; additional APP 1 disclosures commence December 10, 2026.
Commonwealth government AI policy	Version 2.0 effective December 15, 2025; mandatory requirements for covered Commonwealth entities, with exceptions.
National AI Plan and industry adoption guidance	Government strategy and practical governance guidance; distinct from legislation and mandatory public-sector policy.
National AI standards	Consultation announced September 17, 2026; submissions scheduled September 18–October 9. Proposed legislation and implementation details remain subject to the policy process.

Enacted laws

Privacy and personal information

The Privacy Act's application depends on the entity and activity concerned. OAIC guidance explains that personal information in AI inputs and outputs remains subject to privacy obligations. Generating or inferring information about an identifiable person can itself constitute collection. Relevant issues include lawful collection, permitted use and disclosure, accuracy, security and transparency.

For organisations using third-party tools, OAIC recommends examining whether vendors retain prompts or use them for training. Its recommendation to avoid entering personal information, especially sensitive information, into publicly available generative-AI tools is expressly framed as best practice; it is distinct from a statutory prohibition on every such input.

The Privacy and Other Legislation Amendment Act 2024 added automated-decision transparency obligations to APP 1. From December 10, 2026, covered entities must describe specified uses of computer programs in their privacy policies where personal information is used in decisions reasonably expected to significantly affect an individual's rights or interests. Coverage includes programs making decisions and programs performing tasks substantially and directly connected with making them. Required descriptions concern the kinds of personal information and the kinds of decisions involved. These are privacy-policy disclosures, rather than a general prohibition on automated decisions.

A separate statutory tort for serious invasions of privacy commenced on June 10, 2025. It provides a court-based avenue concerning intrusion upon seclusion or misuse of information where the statutory conditions are met. Its reach can extend beyond APP entities, but it includes public-interest considerations, defences and exemptions. OAIC does not administer the tort; available court remedies can include damages and injunctions.

Consumer protection and competition

Treasury's October 3, 2025 review concluded that the Australian Consumer Law, together with other laws, can generally address challenges from AI products and services. The existing framework includes prohibitions on misleading or deceptive conduct and false representations, and consumer guarantees for qualifying goods and services. ACCC guidance explains that consumer guarantees apply to goods and services and that overseas businesses selling directly to Australian consumers must comply with the Australian Consumer Law.

In its December 2025 AI snapshot, the ACCC identified risks involving false representations, fake reviews, scams and use of consumer data. It also highlighted possible competition problems from integration with established platforms, barriers to switching and AI-sector investment and partnerships. These are regulatory concerns and monitoring priorities, not findings that every AI integration or partnership breaches competition law.

Employment, discrimination and workplace safety

AI-assisted hiring, dismissal and performance management engage the Fair Work framework. Anti-discrimination rules remain relevant where AI outputs disadvantage people on protected grounds, while workplace surveillance can also engage state and territory laws. The National AI Centre identifies physical and psychosocial risks from AI as matters for work health and safety duties, including worker consultation and safe-use training.

The DTA's fairness guidance identifies the Age Discrimination Act 2004, Disability Discrimination Act 1992, Racial Discrimination Act 1975 and Sex Discrimination Act 1984 as relevant federal laws. It stresses that an organisation's chosen technical definition of fairness must comply with anti-discrimination law.

Deepfakes and online safety

The Criminal Code Amendment (Deepfake Sexual Material) Act 2024 strengthened Commonwealth offences addressing non-consensual transmission of sexually explicit material, including technologically created or altered material. The legislation's specific offence elements matter; it is not a blanket prohibition on all synthetic images.

Separately, eSafety's image-based-abuse scheme covers sharing, or threatening to share, intimate images without consent, including digitally altered deepfakes. Its reporting and removal functions provide a different route from criminal prosecution.

Intellectual property

IP Australia's patent examination manual states that a named inventor must be a natural person. It explains this rule through the Australian proceedings involving DABUS, distinguishing the inventor from a corporation or other entity that may be entitled to apply for a patent. The issue is inventorship under patent legislation, separate from copyright in AI-generated expression.

Copyright policy work addresses training inputs, licensing, transparency, AI outputs and enforcement. The Attorney-General's Department's Copyright and Artificial Intelligence Reference Group records October 2025 priorities on licensing, certainty for AI-generated material and less costly enforcement, and the government's then-announced position against a text-and-data-mining exception. That dated position should be read alongside the later consultation debate below.

Regulations and executive actions

Financial services and medical devices

ASIC has emphasized that financial-services and governance obligations continue when regulated firms adopt AI. Its April 2025 review update warned that AI-specific risk management and governance arrangements could lag adoption, referring firms to Report 798. This is supervision under existing obligations, not a stand-alone AI authorisation regime.

The Therapeutic Goods Administration's February 5, 2026 guidance explains how medical-device regulation applies to AI software. Intended purpose and functionality matter: adding a feature that suggests diagnoses or treatment can turn a transcription tool into a medical device. Manufacturers must assess changes, secure appropriate approvals and maintain evidence supporting safety and performance. A general-purpose AI label does not resolve the regulatory analysis.

Commonwealth government use

The DTA's version 2.0 policy requires covered agencies to address accountable officials, transparency statements, an AI adoption strategy, internal use-case registers, staff training and impact assessment. It operates as public-sector governance policy rather than a generally applicable private-sector statute. It applies to non-corporate Commonwealth entities, while excluding AI use in the defence portfolio and the national intelligence community; those bodies may voluntarily adopt elements where compatible with national security.

Development of a consistent legislative framework for government automated decision-making is a separate reform stream. The Attorney-General's November 2024–January 2025 consultation connects it to the Robodebt Royal Commission's call for fair and transparent automation in government services. A consultation does not itself confer legal authority to automate a statutory decision.

State and territory example: New South Wales

NSW requires government use of AI to apply its AI Ethics Policy and AI Assessment Framework under Circular DCS-2024-04. The framework covers the system lifecycle, including procurement and operational use, and requires high- or critical-risk uses to be referred for AI Review Committee review. These are NSW public-sector requirements, not rules automatically applicable to every Australian private business.

Guidance and frameworks

The National AI Plan describes a coordinated approach in which existing regulators retain responsibility for harms within their respective domains. It assigns the AI Safety Institute a supporting role in evaluating capabilities and risks and advising government and regulators. The July 20, 2026 government safety announcement reported that the institute had begun testing frontier systems.

For industry, the National AI Centre's Guidance for AI Adoption develops six essential practices covering governance, stakeholder impacts, risk management, information sharing, testing and monitoring, and human oversight. It supplies practical implementation advice; following guidance does not displace applicable legal obligations. The department identifies the October 21, 2025 guidance as an evolution of the September 2024 Voluntary AI Safety Standard, which used ten guardrails.

Court and tribunal rules

The NSW Supreme Court's Practice Note SC Gen 23, issued January 28, 2025 and commencing February 3, 2025, governs generative-AI use in proceedings before that court. It prohibits generating or rewriting a witness's substantive evidence with AI, requires specified disclosures in evidentiary documents, and permits exceptional applications concerning AI-generated annexures or exhibits. It also restricts entering protected litigation material into AI systems unless specified confidentiality and use conditions are met.

For AI-assisted submissions, authors must verify authorities and evidentiary references; verification cannot rely solely on another generative-AI tool. AI use for expert reports is subject to the note's leave requirements and exceptions. These are court-specific procedural controls, not a nationwide ban on lawyers using AI. The court's resource page also links separate guidance from other Australian courts.

Proposed legislation and reform

National AI standards consultation

On September 17, 2026, the government announced consultation on national standards for large data centres and frontier-AI training. The paper separates infrastructure requirements concerning energy, water, community costs, engagement and workforce impacts from conditions for frontier training concerning safety, security, local capability and creators. It envisages Commonwealth legislation complementing state and territory approval processes.

The consultation explores capacity thresholds, which entities would bear obligations and when projects in development would become subject to them. These remain design questions, not settled compliance thresholds. Submissions opened at 6 am AEST on September 18 and close at 5 pm AEDT on October 9, 2026. See September 17 digest coverage, which also includes independent reporting.

The live submission form accepts responses and permits anonymous submissions. The consultation page expressly excludes copyright policy, which remains a separate Attorney-General-led process. See September 18 opening coverage.

Copyright consultation and other safety priorities

On September 15, 2026, ABC reported consultation options involving rights-holder opt-outs and a minimum quota of licensing deals before use of other online material for AI training. These were reported policy options, not enacted copyright exceptions. In a same-day official interview, Deputy Prime Minister Richard Marles acknowledged continuing copyright discussions while emphasizing protection for creators. See September 15 digest coverage.

The government's July 2026 safety priorities also identified work on a Digital Duty of Care, further privacy reform, workplace AI safety, consumer risks from surveillance pricing and agentic commerce, and government automated decision-making. The announcement describes workstreams; it should not be read as establishing that every proposed reform has been enacted.

Historical measures

In September 2024, the government consulted on mandatory guardrails for AI in high-risk settings, with submissions closing October 4, 2024. That proposals paper and the contemporaneous voluntary standard were distinct instruments. The consultation is historical evidence of reform options, not evidence that its proposed guardrails became enforceable requirements.

Related articles and coverage

• International Legislation and Legislation and Regulation — jurisdiction directories.
• Policy — comparisons of AI governance approaches.
• DABUS — patent-inventorship background.
• September 15, 2026: copyright consultation debate.
• September 17, 2026: national AI standards consultation.