Regulating AI in Australia: where things stand in October 2026

Ask an Australian board what the law says about AI and the honest answer is that there is no single AI law. That is a deliberate policy choice, confirmed when the Government released its National AI Plan on 2 December 2025. It does not mean AI is unregulated. It means the rules are spread across laws that were not written with AI in mind, and that organisations have to assemble the picture themselves.

This briefing sets out the position as at October 2026, separating what is law, what is policy, what is under consultation and what is voluntary.

The policy decision: no mandatory guardrails, for now

In September 2024 the Department of Industry, Science and Resources released a proposals paper, Introducing mandatory guardrails for AI in high-risk settings. It consulted from 5 September to 4 October 2024 on ten proposed guardrails, how to define high-risk AI, and regulatory options for making the guardrails mandatory.

That approach has been set aside. The Department has stated that the Government “will not proceed at this time with previous proposals” to introduce mandatory guardrails, and that consultation feedback informed the National AI Plan instead.

The words “at this time” matter. This is a policy position, not a legal finding, and it can be revisited if the Government concludes existing laws are not coping.

What the National AI Plan commits to

The National AI Plan is government policy, not legislation. It is organised around three goals: capturing the opportunities of AI, spreading its benefits across the economy, and keeping Australians safe.

On safety, the Government’s April 2026 response to the Senate Select Committee on Adopting Artificial Intelligence describes the approach as building on existing economy-wide laws, with ongoing review and adaptation of those laws and the establishment of an AI Safety Institute. The laws it names cover privacy, administrative law, online safety, corporations, intellectual property, work health and safety, workplace relations, competition and consumer protection, and anti-discrimination.

The Australian AI Safety Institute

The Government announced the Australian AI Safety Institute on 25 November 2025, with the stated aim of having it operating in early 2026. Its role is to monitor, test and share information on emerging AI capabilities, risks and harms, to support agencies and regulators, and to work with the National AI Centre and international counterparts.

The Government’s Senate response records funding of $29.8 million over four years from 2025–26, and $7.9 million a year ongoing from 2029–30. It also says plainly that the Institute is not a regulator. For businesses, that means the Institute’s work is likely to shape guidance and policy, but enforcement will continue to come from the OAIC, the ACCC, ASIC, eSafety, the Fair Work Ombudsman and other existing regulators using their existing powers.

Law in force: existing laws applied to AI

Because there is no AI statute, the practical question is how existing laws apply to particular uses. Several points are already settled:

• Privacy. The Privacy Act 1988 applies to personal information used or generated by AI systems. The Privacy and Other Legislation Amendment Act 2024 added a requirement that, from 10 December 2026, privacy policies describe certain decisions made or substantially assisted by computer programs. That date is fixed in legislation.
• Consumer law. Treasury’s final report on AI and the Australian Consumer Law, published on 3 October 2025, concluded that the ACL, combined with other laws, can generally handle the challenges of AI products and services. The ACL’s existing prohibitions, including on misleading or deceptive conduct, apply to AI products and AI-related claims as they do to anything else.
• Online safety and criminal law. The Government’s Senate response points to the Online Safety Act 2021 and an August 2024 Criminal Code amendment dealing with non-consensual sexual material created or altered using AI.
• Sector rules. Financial services, health, critical infrastructure and other regulated sectors carry their own obligations, which apply to AI in the same way they apply to any other system.

Live reform and consultation

Two reform processes are directly relevant to AI.

Privacy tranche 2 (exposure draft). On 31 August 2026 the Attorney-General’s Department released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 with a consultation paper. Consultation closed on 18 September 2026. The draft does not contain AI-specific rules, but its proposed fair and reasonable test, changes to definitions and controller responsibilities would affect how organisations collect and use personal information in AI systems. The accompanying paper asks whether further reform is needed for AI. This is an exposure draft, not a bill before Parliament, and no commencement date has been announced.

Copyright and AI (consultation). On 26 October 2025 the Attorney-General announced that the Government would not introduce a text and data mining exception for training AI models. Work continues through the Copyright and AI Reference Group on licensing arrangements for AI training, on clarifying how copyright applies to AI-generated material, and on a possible small claims forum. The Government’s April 2026 Senate response said it was still considering that feedback.

Voluntary guidance

The Guidance for AI Adoption, published by the National AI Centre on 21 October 2025, replaced the Voluntary AI Safety Standard with six essential practices. It is voluntary. In practice, it is the most detailed statement of what the Government considers good AI governance, and organisations should expect it to be used as a benchmark. Non-corporate Commonwealth entities are separately subject to the Government’s policy for the responsible use of AI in government.

If you have EU exposure

The EU AI Act does not apply in Australia as a matter of Australian law. It can, however, apply to Australian organisations that place AI systems on the EU market or whose AI outputs are used in the EU. Its timetable has also shifted: the Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and deferred the main obligations for stand-alone high-risk systems to 2 December 2027. Australian organisations with EU customers or operations should take specific advice.

What this means for boards

The absence of an AI act is not a safe harbour. It shifts the burden onto organisations to show that their use of AI meets obligations they already have. The organisations best placed are those that know where AI is used, have assessed the uses that affect people, and can show the decisions they made and why.

General information, not legal advice. The position described is current at 17 October 2026 and may change. Confirm how any obligation applies to your organisation with your legal adviser.