Skip to main content

    AI by country · Oceania

    AI in Australia: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Australia know before starting with AI?

    Australia has no standalone AI Act as of 29 October 2026. The Privacy Act 1988 is the main law that applies to AI that uses personal information, and from 10 December 2026 privacy policies must explain certain automated decisions. The National AI Plan of December 2025 relies on existing laws plus voluntary guidance, so a company should check its privacy policy, its data breach process and how it uses AI tools with customer data.

    At a glance

    Australia at a glance

    Key facts about Australia
    Data protection lawPrivacy Act 1988, in force, amended by the Privacy and Other Legislation Amendment Act 2024
    RegulatorOffice of the Australian Information Commissioner (OAIC)
    AI policyNational AI Plan (December 2025) and Guidance for AI Adoption (October 2025). No standalone AI law as of 29 October 2026
    Time zoneSeveral zones: AWST UTC+8 (Perth), AEST UTC+10 (Sydney, Melbourne, Brisbane), with daylight saving to UTC+11 in some states from October to April
    CurrencyAUD (Australian dollar)
    Business languageEnglish

    Why now

    Why Australia is worth watching

    Each point links to the document it comes from.

    • From 10 December 2026, organisations covered by the Privacy Act must describe in their privacy policy the kinds of decisions a computer program makes, or helps make, that could significantly affect a person.[2]

    • The OAIC published a fact sheet, a flowchart and updated APP 1 Guidelines on these automated decision rules on 30 September 2026.[2]

    • The National AI Plan, released in December 2025, has three goals: capture the opportunities of AI, spread the benefits and keep Australians safe.[6]

    • The plan does not create a standalone AI Act. Existing laws such as privacy, consumer, copyright and workplace law continue to apply.[6]

    • The National AI Centre released Guidance for AI Adoption in October 2025, built around six practices for organisations that build or use AI.[8]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    Privacy Act 1988 and the Australian Privacy Principles

    In force1988The OAIC says that using AI to generate or infer personal information counts as collecting it under APP 3, and that information put into an AI tool should generally be used only for the purpose it was collected for (APP 6). Its best-practice advice is not to enter personal information, especially sensitive information, into publicly available generative AI tools. Most small businesses with turnover of $3 million or less are exempt, but some, such as health service providers, are covered.[5]

    Privacy and Other Legislation Amendment Act 2024 (No. 128, 2024): automated decision transparency

    Phased2024The Act became law on 10 December 2024 and its automated decision rules (APP 1.7 to 1.9) apply from 10 December 2026. If a computer program uses personal information to make, or do something substantially and directly related to, a decision that could significantly affect a person's rights or interests, the privacy policy must say what kinds of personal information and decisions are involved.[1]

    Notifiable Data Breaches scheme (Part IIIC, Privacy Act 1988)

    In force2018If personal information held in or used by an AI system is exposed, the organisation must take all reasonable steps to assess a suspected breach within 30 days. Where a breach is likely to cause serious harm, it must notify the OAIC and affected people as soon as practicable.[4]

    Civil penalties for serious interference with privacy (section 13G)

    In force2022For a company, the maximum penalty is the greatest of $50 million, three times the benefit obtained, or 30% of adjusted turnover in the relevant period. Only the Federal Court can impose it, on application by the Information Commissioner.[3]

    Where AI fits first

    Where AI fits first

    Banking and lending

    Document checks, fraud alerts and drafting customer replies, with a person approving any credit decision.

    Credit providers are covered by the Notifiable Data Breaches scheme regardless of turnover. A credit decision made with a computer program will likely need describing in the privacy policy from 10 December 2026.[4]

    Health care

    Drafting clinical letters and summarising referrals, with clinicians checking every output.

    Small businesses that provide health services and hold health information are covered by the Privacy Act. Health information is sensitive information, which generally needs consent.[4]

    Retail and customer service

    Chatbots for order questions and product search across a catalogue.

    The OAIC says public-facing tools such as chatbots should be clearly identified as AI, and privacy notices should explain AI use.[5]

    Professional services

    Summarising contracts and internal documents using an enterprise AI tool that does not train on your inputs.

    Check the vendor's terms. The OAIC warns that personal information put into some AI products could be used by the provider and surface for other users.[5]

    Your first steps

    Your first steps

    1. Work out whether you are covered by the Privacy Act, including the small business exceptions for health services and trading in personal information.
    2. List every decision a computer program makes or helps make about people, and decide which could significantly affect them.
    3. Update your privacy policy before 10 December 2026 to describe those decisions and the kinds of personal information used.
    4. Set a rule for staff on what may and may not be entered into public generative AI tools.
    5. Do a privacy impact assessment before you buy or build an AI product, and read the vendor's terms on training and data use.
    6. Test your data breach process so a suspected breach can be assessed within 30 days and reported as soon as practicable.
    7. Read the Guidance for AI Adoption and pick the practices that fit your size.

    AI services for Australia

    AI consulting and development for teams in Australia

    We work remotely with companies in Australia, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. India is on UTC+5:30, so a 9:30 to 18:30 Indian day runs 04:00 to 13:00 UTC. Sydney and Melbourne are on UTC+11 during daylight saving (October to April), which gives about 2 hours of overlap with a 9:00 to 17:00 local day (15:00 to 17:00 local time), or 3 hours on UTC+10 in winter; Perth on UTC+8 overlaps for about 5 hours (12:00 to 17:00 local time). With the eastern states, we agree a fixed overlap window for calls and do the rest of the work in writing, so you get updates at the start of your next day.

    Questions

    Common questions about AI in Australia

    Does Australia have an AI law?

    Not a standalone one as of 29 October 2026. The National AI Plan relies on existing laws such as privacy, consumer and workplace law, plus voluntary guidance. New targeted laws may still follow, so check for updates.

    What changes on 10 December 2026?

    Covered organisations must say in their privacy policy what kinds of personal information their computer programs use and what kinds of significant decisions those programs make or help make. The OAIC published guidance on this on 30 September 2026.

    Can my staff use ChatGPT-style tools with customer data?

    The OAIC's best-practice advice is not to enter personal information, especially sensitive information, into publicly available generative AI tools. Using an enterprise tool with clear data terms, and a written staff rule, lowers the risk.

    What are the penalties for getting privacy wrong?

    For a serious interference with privacy, a court can order a company to pay up to the greatest of $50 million, three times the benefit gained, or 30% of adjusted turnover for the period.

    We are a small business. Does any of this apply to us?

    Businesses with annual turnover of $3 million or less are generally exempt from the Privacy Act. There are exceptions, for example if you provide health services, trade in personal information or are related to a covered entity.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] Federal Register of Legislation (Australian Government), 2024-12-10. Privacy and Other Legislation Amendment Act 2024, No. 128, 2024(legislation.gov.au)
      Full title and what we used it for

      Privacy and Other Legislation Amendment Act 2024, No. 128, 2024. Primary. Used for the Act's name, number, date of 10 December 2024 and status shown on the register.

    2. [2] Office of the Australian Information Commissioner, 2026-09-30. New resources on transparency for use of AI and automated decision-maki…(oaic.gov.au)
      Full title and what we used it for

      New resources on transparency for use of AI and automated decision-making. Primary. Used for the 10 December 2026 start date, what privacy policies must contain under APP 1.7 to 1.9, and the resources released on 30 September 2026.

    3. [3] Office of the Australian Information Commissioner, 2024-12-01. Guide to privacy regulatory action, Chapter 6: Civil penalties(oaic.gov.au)
      Full title and what we used it for

      Guide to privacy regulatory action, Chapter 6: Civil penalties. Primary regulator guide, published December 2024. Used for the section 13G maximum penalty for a body corporate and that penalties are sought from the Federal Court.

    4. [4] Office of the Australian Information Commissioner, 2026-10-29. Data breach preparation and response, Part 4: Notifiable Data Breach (N…(oaic.gov.au)
      Full title and what we used it for

      Data breach preparation and response, Part 4: Notifiable Data Breach (NDB) Scheme. Primary, accessed on this date. Used for Part IIIC, the 22 February 2018 start, the 30 day assessment rule, notification as soon as practicable, the $3 million small business threshold and its exceptions, and coverage of credit providers.

    5. [5] Office of the Australian Information Commissioner, 2025-01-17. Guidance on privacy and the use of commercially available AI products(oaic.gov.au)
      Full title and what we used it for

      Guidance on privacy and the use of commercially available AI products. Primary. Published 21 October 2024, last updated 17 January 2025. Used for APP 3 and APP 6 points, the advice on public generative AI tools, chatbot labelling and privacy impact assessments.

    6. [6] MinterEllison, 2025-12-03. Australia introduces a national AI plan: Four things leaders need to kn…(minterellison.com)
      Full title and what we used it for

      Australia introduces a national AI plan: Four things leaders need to know. Law firm summary, used for interpretation. Used for the plan's three goals, no standalone AI Act and reliance on existing laws. The Department of Industry website, which hosts the plan itself, did not load for us on 29 October 2026, so we could not read the primary text.

    7. [7] Digital Policy Alert, 2025-12-02. National AI Plan 2025 (Australia)(digitalpolicyalert.org)
      Full title and what we used it for

      National AI Plan 2025 (Australia). Secondary tracker. Used to confirm the plan was released by the Department of Industry, Science and Resources on 2 December 2025 and is adopted.

    8. [8] OECD.AI Policy Observatory, 2025-10-01. Guidance for AI Adoption: Implementation Guidance (Australia)(oecd.ai)
      Full title and what we used it for

      Guidance for AI Adoption: Implementation Guidance (Australia). Policy database entry describing the Australian Government guidance. Used for its October 2025 release and its six practices.

    This is general information, not legal advice. Laws and guidance change, and we could not read the National AI Plan on the government's own site, so those points rest on a law firm summary and a tracker. Check with a qualified Australian lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Australia?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score