Lexora

Practice 04 · Regulatory Readiness & Compliance

Separate what is law from what is proposed, and act on the right one.

Knowing which privacy, data and AI obligations apply to you and from when, separating enacted law from proposals, guidance and voluntary standards, and showing your board that obligations are owned.

Start with the Regulatory Readiness Consultation Discuss your needs

The business problem

Privacy, data and AI regulation is moving on several fronts at once. Much of what is published is proposal, consultation or voluntary guidance rather than enacted law. Organisations either over-react to headlines or miss the obligations that already have dates attached.

11 Dec 2024
Most first-tranche Privacy Act reforms commenced.
10 Dec 2026
Automated decision-making disclosures commence, and the Children's Online Privacy Code is due to be registered.
41
Proposed reforms in the second-tranche exposure draft, which is not yet law.

Lexora labels every development it writes about by status, so you can see at a glance what is law today, what has a start date, what is still being debated, and what is voluntary. Our Insights follow the same rule.

We do not present voluntary frameworks as mandatory, and we do not assume overseas laws apply to Australian organisations. Where they might, we test it against your activities.

Our compliance work is advisory. We identify obligations, map them to your operations and track them over time. Formal legal interpretation remains with your lawyers.

The status ledger

Four columns. Nothing in the wrong one.

We sort every development by its legal status before we advise on it. Verified October 2026; dates are taken from primary sources.

01Law in force

  • Privacy and Other Legislation Amendment Act 2024

    Status: Law in force

    The first tranche of Privacy Act reforms. Most changes commenced on 11 December 2024; automated decision-making disclosures commence on 10 December 2026.

  • GDPR (European Union)

    Status: Law in force

    Can apply to Australian organisations that offer goods or services to, or monitor, people in the EU. It does not apply automatically to every Australian organisation.

02Commencing

  • Automated decision-making disclosures (APP 1.7 to 1.9)

    Status: Law, commencing later

    Privacy policies must describe certain automated decisions from 10 December 2026.

03Proposed or in progress

  • Children's Online Privacy Code (OAIC)

    Status: Being finalised

    Being finalised by the OAIC, which must register it by 10 December 2026. Its commencement date has not yet been set.

  • Privacy Amendment (Personal Data Protection) Bill 2026

    Status: Exposure draft

    Released on 31 August 2026 for consultation. Not yet introduced to Parliament and has no commencement date.

04Guidance & voluntary

  • Guidance for AI Adoption (National AI Centre)

    Status: Regulator guidance

    Voluntary Australian Government guidance, October 2025. Not legislation.

  • ISO/IEC 42001 and ISO/IEC 27701

    Status: Voluntary standard

    International management system standards. Certification only through accredited bodies.

Not every headline is an obligation.

Services & deliverables

What you receive.

  1. 01

    Obligations register

    The privacy, data and AI obligations that apply to you, each with a status label, source, owner and date.

  2. 02

    Applicability assessment

    Which developments apply to your organisation and activities, including any overseas exposure.

  3. 03

    Readiness roadmap

    What to do now, what to prepare and what to watch, sequenced against commencement dates.

  4. 04

    Board reporting pack

    A concise, repeatable view of obligations, status and actions for directors.

Engagement process

How the work runs.

  1. 1

    Scan

    Identify relevant laws, codes, guidance and standards.

  2. 2

    Classify

    Label each by status, from law in force to voluntary standard.

  3. 3

    Apply

    Test applicability to your organisation and activities.

  4. 4

    Track

    Assign owners and dates, and report on progress.

A way to start

Regulatory Readiness Consultation

A working session and short report that sets out which privacy, data and AI developments apply to you, labelled by status, with the next steps for each.

Discuss the Regulatory Readiness Consultation

Fixed scope and fee, confirmed in writing after a free call. This is an advisory engagement, not legal advice.

Typical timeframeAbout two weeks

What it includes

  • Pre-session questionnaire on your activities and exposure
  • Facilitated working session with your leadership
  • Obligations snapshot labelled by legal status
  • Short report with now, prepare and watch actions

Questions we help answer

If you are asking these, we should talk.

  1. Which privacy, data and AI obligations apply to us, and from when?
  2. What is coming that we should prepare for, and what can we safely watch?
  3. How do we show our board that obligations are tracked and owned?
  4. Do any overseas laws genuinely apply to us, and to which activities?

Related insights

Reading for this practice

  • Draft in preparationA briefing for this practice is being prepared. It will be dated and sourced when published.See all insights

Related engagements

Discuss your governance needs.

A free 20-minute call to understand your situation and recommend the right first step. Scope and a fixed fee are confirmed in writing before any work starts.

Discuss your governance needs Send an enquiry