Australia regulates AI through existing law rather than a dedicated AI act: the Privacy Act 1988, as amended in December 2024, is the main rule set, and from 10 December 2026 organisations must explain in their privacy policies when computer programs make or substantially support decisions that significantly affect people. The government’s December 2025 National AI Plan chose to rely on existing laws and regulators rather than proceed with mandatory guardrails for high-risk AI, and voluntary guidance now sits in the six essential practices of the Guidance for AI Adoption. For banks, insurers and super funds, APRA’s April 2026 letter on AI adds clear supervisory expectations, including board literacy and staff training.
This guide is for CISOs, privacy officers, risk and compliance leaders and L&D heads in Australian organisations, and for global companies with Australian operations.
The Privacy Act and the 2024 amendments
The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024. Most of it took effect straight away, including new civil penalty tiers and wider enforcement powers for the Office of the Australian Information Commissioner (OAIC). A new statutory tort for serious invasions of privacy followed in June 2025.
Automated decision transparency from 10 December 2026
The provisions most relevant to AI are new APPs 1.7 to 1.9, which start on 10 December 2026. They apply where an APP entity has arranged for a computer program to make, or do something substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual’s rights or interests, and personal information is used in the program’s operation.
Where that test is met, the privacy policy must describe:
- the kinds of personal information used in the operation of those programs;
- the kinds of decisions made solely by the programs; and
- the kinds of decisions where the programs do something substantially and directly related to making the decision.
On 30 September 2026, the OAIC updated its APP 1 Guidelines and released a fact sheet and flowchart on the new obligation. Two points matter in practice. First, the program does not have to be built or run by you: third-party tools and AI products you arrange to use are in scope. Second, the rule is not limited to AI and can capture rule-based scoring and screening tools. It is a transparency duty, not a right to contest decisions, but it forces an inventory of automated decision making that many organisations have never done.
Further reform is under consultation
On 31 August 2026, the Attorney-General’s Department released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, with proposals that include a “fair and reasonable” test for collecting and using personal information. Consultation closed in September 2026. These are proposals, not law, but they point to stricter expectations for AI uses of personal information.
The OAIC’s guidance on AI
In October 2024, the OAIC published two AI guides that still set its expectations.
Using commercially available AI products
The first covers organisations using AI products such as chatbots, copilots and AI features in business software, including free public tools. Its key messages:
- Privacy obligations apply to personal information entered into an AI system and to output that contains personal information.
- Do due diligence before adopting a product, including how it was tested, how human oversight works and who can access the data.
- Update privacy policies and notices, and clearly identify public-facing AI such as chatbots.
- Under APP 6, personal information should only be used in AI for its original purpose unless there is consent or a reasonably expected, related secondary use.
- As best practice, do not enter personal information, and particularly sensitive information, into publicly available generative AI tools.
That last point is the single most important rule to teach your workforce. It is also where technical controls help: our partner AccuroAI’s shadow AI discovery shows which public AI tools staff actually use, so you know where the risk sits.
Developing and training generative AI models
The second guide is for organisations that build, train or fine-tune generative AI models. It makes clear that publicly available data is not automatically lawful to use for training, that inferred, incorrect or AI-generated information about an identifiable person can still be personal information, and that developers should take a privacy-by-design approach, including privacy impact assessments.
Voluntary standards and the status of mandatory guardrails
In September 2024, the government published the Voluntary AI Safety Standard with ten guardrails, alongside a proposals paper on mandatory guardrails for high-risk AI. Both have since been overtaken.
- Guidance for AI Adoption (October 2025). On 21 October 2025, the National AI Centre released the Guidance for AI Adoption, which updates and replaces the Voluntary AI Safety Standard. It condenses the ten guardrails into six essential practices, known as AI6: decide who is accountable; understand impacts and plan accordingly; measure and manage risks; share essential information; test and monitor; and maintain human control.
- National AI Plan (December 2025). The plan, released on 2 December 2025, relies on existing laws and sector regulators rather than introducing new rules aimed at high-risk AI, which put the mandatory guardrails proposal on hold. It also funded an Australian AI Safety Institute to advise government and regulators.
- Australian Standards for AI (July 2026). In July 2026, the Prime Minister announced plans for mandatory standards focused on large AI data centres and set out the government’s position on the use of Australian creative works to train AI, with legislation flagged for 2027. These do not create general rules for how organisations use AI at work.
So for most organisations, AI6 is the reference framework, and existing law (privacy, consumer, anti-discrimination, workplace and sector rules) is what is enforced.
APRA’s expectations for financial services
On 30 April 2026, APRA wrote to banks, insurers and superannuation trustees calling for a step-change in AI risk management and governance, after a targeted review found that governance, assurance and operational resilience were not keeping pace with AI adoption. APRA expects:
- boards to maintain sufficient understanding and literacy on AI to challenge management, rather than relying on vendor presentations;
- an inventory of AI tools and use cases, clear ownership across the lifecycle and human involvement in high-risk decisions;
- enforceable technical controls, not just policy, over staff use of AI tools outside approved control frameworks;
- training and education of staff on AI use, misuse, limitations and secure practices;
- credible fallback processes where AI supports critical operations, and tested exit plans for critical AI providers; and
- continuous monitoring and assurance, with second-line and internal audit able to assess AI independently.
These expectations build on existing prudential standards such as CPS 234 (information security) and CPS 230 (operational risk management). The letter sets no fixed deadline, but APRA has warned of stronger supervisory action where AI risks are not managed. AccuroAI’s financial services AI security playbook maps controls to this kind of supervisory expectation.
A six-step AI governance and training checklist for Australian organisations
- Inventory automated decisions before 10 December 2026. List every computer program, including vendor tools, that makes or substantially supports significant decisions using personal information, and update your privacy policy.
- Discover workforce AI use. Find which AI tools staff use, approved or not, and which AI features are switched on in existing software.
- Set data rules for prompts. Publish an AI acceptable use policy that follows the OAIC’s advice: no personal or sensitive information in public generative AI tools.
- Adopt AI6 as your governance spine. Assign accountable owners, assess impacts, manage risk, be transparent, test and monitor, and keep humans in control.
- Brief the board. Give directors the AI literacy APRA expects and regular reporting on AI risk. AccuroAI’s executive reporting turns AI usage data into board-level views.
- Train by role and keep records. Use Safe AI at Work for every employee, AI Governance & Compliance training for privacy, risk and legal teams, Shadow AI & Prompt Data Leakage Defense for security teams, and AI Risk & Strategy for Leaders for executives and boards.
Frequently asked questions
Does Australia have an AI law?
Not a general one. The National AI Plan relies on existing laws and sector regulators, and the proposed mandatory guardrails for high-risk AI were put on hold. The Privacy Act, consumer law, anti-discrimination law and sector rules all apply to AI today.
What changes on 10 December 2026?
APP entities must disclose in their privacy policy the kinds of personal information used, and the kinds of decisions made or substantially supported, by computer programs where those decisions could significantly affect an individual’s rights or interests.
Can employees put customer data into ChatGPT or other public AI tools?
The OAIC recommends, as best practice, that organisations do not enter personal information, and especially sensitive information, into publicly available generative AI tools. Most organisations should provide an approved enterprise tool and train staff on what data can go into it.
Is the Voluntary AI Safety Standard still current?
It has been replaced by the Guidance for AI Adoption, published on 21 October 2025, which condenses its ten guardrails into six essential practices. Both are voluntary.
Does APRA require AI training?
APRA’s April 2026 letter expects boards to have sufficient AI literacy and expects staff training and education on AI use, misuse, limitations and secure practices. It is supervisory guidance on how APRA applies existing standards, and APRA has signalled it will act where entities fall short.
Get your organisation ready
Product Innovation Academy delivers corporate AI training and AI governance programmes for Australian organisations, with AI Security & Governance programmes run in partnership with AccuroAI. We tailor content to the Privacy Act, AI6 and, for financial institutions, APRA’s expectations. Request a proposal and we will design a programme around your tools and risk profile.
Sources
- Federal Register of Legislation, “Privacy and Other Legislation Amendment Act 2024”, as made 10 December 2024. legislation.gov.au
- OAIC, “New resources on transparency for use of AI and automated decision-making”, 30 September 2026. oaic.gov.au
- OAIC, “Guidance on privacy and the use of commercially available AI products”, 21 October 2024. oaic.gov.au
- OAIC, “Guidance on privacy and developing and training generative AI models”, 21 October 2024. oaic.gov.au
- Herbert Smith Freehills Kramer, “The draft Tranche 2 Privacy Act reforms: what’s there, what’s new and what’s missing”, September 2026. hsfkramer.com
- Department of Industry, Science and Resources, “Guidance for AI Adoption”, 21 October 2025. industry.gov.au
- Department of Industry, Science and Resources, “National AI Plan”, 2 December 2025. industry.gov.au
- PS News, “Mandatory AI guardrails put ‘on hold’ with the release of national plan”. psnews.com.au
- ABC News, “Labor aims to shape AI revolution with new data centre and AI copyright rules”, 15 July 2026. abc.net.au
- APRA, “APRA Letter to Industry on Artificial Intelligence (AI)”, 30 April 2026. apra.gov.au