On 10 November 2026, the Australian Government said it will legislate mandatory safety and security obligations for frontier AI companies and propose a new, targeted AI safety regulator to enforce them. The regulator would cover developers of the most advanced models, not the organisations that buy and use AI, and it does not exist yet: it still needs legislation, and no timeline has been given. For most organisations, the rules that actually bite in the next few months are the Privacy Act’s automated decision transparency duties from 10 December 2026 and, for financial institutions, APRA’s expectations on AI.
This analysis is for risk, compliance, privacy, security and technology leaders in Australian organisations and in global companies with Australian operations.
What the government announced on 10 November 2026
Two media releases from the Prime Minister’s office, issued with the Deputy Prime Minister, the Minister for Home Affairs and Cyber Security and the Minister for Industry and Innovation, set out the package.
The first, “New Australian AI safety and security protections”, says the government will “enshrine world leading mandatory Artificial Intelligence safety and security protections” in Australian AI Standards legislation. The protections apply to “all frontier AI companies that wish to operate in Australia”, with frontier AI described as the most sophisticated models at the cutting edge of current capability. Frontier companies would have to:
- maintain security controls across all stages of development and deployment;
- identify and manage serious risks associated with their models;
- allow independent evaluation of their models;
- notify the Australian Government of incidents rapidly;
- maintain and publish safety and security frameworks covering governance, risk management and transparency; and
- respond to updated standards and rules as technologies change.
On enforcement, the release says the government “will propose these protections be enforced by a new targeted regulator for AI safety”, working with the Australian AI Safety Institute. The regulator “would be able to enforce significant penalties”. It is not named, penalty levels are not given, and further details will come “in due course” after consultation.
The second release, “Strengthening Australia against AI-driven cyber incidents”, published the recommendations of a Rapid Review. The government commissioned it in September 2026 after OpenAI informed it that a rogue AI agent had infiltrated government websites, including the Medicare Statistics Reporting Service Portal. The review was led by the Department of the Prime Minister and Cabinet with the National Cyber Security Coordinator, the Office of AI, the Australian Signals Directorate, the Australian AI Safety Institute and Services Australia. It makes 18 recommendations, including mandatory AI company reporting of misaligned behaviour or cyber incidents and “consideration of reforming criminal law in cases of serious misconduct”. The government says it accepts the recommendations and has begun implementing them.
Announced versus proposed
| Measure | Status at 12 November 2026 |
|---|---|
| Mandatory safety and security obligations for frontier AI companies | Government policy, to be legislated through the Australian AI Standards; no bill published |
| New targeted AI safety regulator | Proposed; unnamed; needs legislation; no start date |
| Significant penalties | Proposed; amounts not specified |
| Mandatory incident notification by AI companies | Accepted recommendation and one of the six obligations; not yet law |
| Criminal law changes for serious misconduct | Under consideration only; no offence drafted |
| Rapid Review’s 18 recommendations | Accepted; implementation started |
How it fits with Australia’s wider AI framework
The new measures sit on top of a framework that has been building for a year. Our earlier guide to AI governance and training in Australia covers the privacy and APRA pieces in depth.
| Instrument | Date | Who it applies to | Binding? |
|---|---|---|---|
| Guidance for AI Adoption (AI6) | 21 October 2025 | Any organisation developing or using AI | Voluntary |
| Australian AI Safety Institute | Announced 25 November 2025 | Government technical body that tests and monitors advanced AI | Not a regulator |
| National AI Plan | 2 December 2025 | Government policy; relies on existing laws and regulators | Policy |
| APRA letter to industry on AI | 30 April 2026 | Banks, insurers, super trustees | Supervisory expectations under existing standards |
| Australian Standards for AI | Announced 15 July 2026 | Large data centres, AI training, creative works; now frontier AI safety | Legislation expected early 2027 |
| AI consumer safety priorities | 20 July 2026 | AI companies, consumer markets, workplaces and federal agencies | Proposals and consultations |
| Privacy Act APPs 1.7 to 1.9 | From 10 December 2026 | APP entities using computer programs in significant decisions | Yes, law |
The Minister for Industry said the AI Standards legislation “will build on the work of the National AI Plan”, which put safety at the core of the government’s agenda while relying on existing laws. The July 2026 consumer safety priorities point in the same direction for the wider economy: a proposed digital duty of care for AI companies, a second tranche of privacy reform, AI safety in the workplace, and options under consumer law for risks such as surveillance pricing and agentic commerce. All of these remain proposals.
What changes, and what does not, for organisations that use AI
What does not change
- No new obligations on AI users. Nothing in the 10 November releases imposes duties on organisations that deploy or buy AI. The obligations fall on frontier AI companies.
- No general AI act. Australia still regulates AI use through existing law: privacy, consumer, anti-discrimination, workplace and sector rules.
- Your existing duties stand. The Privacy Act, the Notifiable Data Breaches scheme, consumer law and, for financial institutions, APRA’s prudential standards continue to apply to AI as they do today.
What may change indirectly
- Better information from model providers. If frontier companies must publish safety and security frameworks and notify incidents, buyers should gain more material for due diligence and contracts.
- More attention on AI agents. The trigger for this package was an AI agent reaching government systems. Expect regulators, auditors and boards to ask harder questions about what your own agents can access.
- A stronger incident culture. Mandatory reporting for AI companies will make “AI incident” a recognised category. Organisations without an internal definition will look unprepared.
What organisations should do anyway: a checklist
- Finish your automated decision inventory before 10 December 2026. List every program, including vendor AI, that makes or substantially supports significant decisions using personal information, and update your privacy policy.
- Keep an AI register. AI6 recommends one. Record each tool, agent and AI feature, its owner, its data and its risk level.
- Ask model providers for their safety frameworks. Build incident notice, security and evaluation commitments into contracts now, rather than waiting for the law.
- Define AI incidents internally. Cover data exposure, harmful or misaligned outputs and agents acting outside scope, and link the process to your breach response.
- Limit what agents can do. Give agents least-privilege access, log their actions and keep humans in control of consequential steps. Our Securing AI Agents training covers these controls.
- Meet APRA’s expectations if you are regulated. Board AI literacy, an inventory, human involvement in high-risk decisions and tested fallbacks.
- Train people by role. Give every employee Safe AI at Work training, and give privacy, risk and legal teams AI Governance & Compliance training.
- Track the legislation. Watch for an exposure draft of the AI Standards legislation and consultation on the regulator.
Frequently asked questions
What is Australia’s new AI regulator?
It is a proposed, targeted regulator for AI safety that would enforce mandatory obligations on frontier AI companies, working with the Australian AI Safety Institute. As of 12 November 2026 it has no name, no legislation and no start date.
Does it apply to my organisation if we only use AI?
Not directly. The announced obligations apply to frontier AI companies that develop the most advanced models. Organisations that buy and use AI remain subject to existing law, including new privacy transparency rules from 10 December 2026.
Is mandatory AI incident reporting now law?
No. It is an accepted recommendation and one of the six planned obligations for frontier AI companies, but it will need legislation.
Will there be criminal penalties for AI companies?
The government is only considering criminal law reform for serious misconduct. Separately, it says the proposed regulator would be able to enforce significant penalties, without giving amounts.
How does this relate to AI6?
AI6, the six essential practices in the Guidance for AI Adoption, remains the voluntary reference framework for organisations using AI. The new obligations target developers and do not replace it.
This article is general information, not legal advice.
Get your organisation ready
Product Innovation Academy delivers corporate AI training and AI governance programmes for Australian organisations, with AI Security & Governance programmes run in partnership with AccuroAI. Request a proposal and we will tailor a programme to your tools, obligations and risk profile.
Sources
- Prime Minister of Australia, “New Australian AI safety and security protections”, 10 November 2026. pm.gov.au
- Prime Minister of Australia, “Strengthening Australia against AI-driven cyber incidents”, 10 November 2026. pm.gov.au
- The Conversation, “New AI regulator announced, as government considers criminal law change to keep erring frontier companies in line”, 10 November 2026. theconversation.com
- Prime Minister of Australia, “AI in Australia’s interests”, 15 July 2026. pm.gov.au
- Treasury Ministers, “AI consumer safety priorities”, 20 July 2026. ministers.treasury.gov.au
- Department of Industry, Science and Resources, “Australia to establish new institute to strengthen AI safety”, November 2025. industry.gov.au
- Department of Industry, Science and Resources, “National AI Plan”, 2 December 2025. industry.gov.au
- Department of Industry, Science and Resources, “Guidance for AI Adoption”, 21 October 2025. industry.gov.au
- OAIC, “New resources on transparency for use of AI and automated decision-making”, 30 September 2026. oaic.gov.au
- APRA, “APRA Letter to Industry on Artificial Intelligence (AI)”, 30 April 2026. apra.gov.au