Research
The PC told the committee its $116 billion estimate is not a cost-benefit analysis and it knows of nobody who has done one. It has not modelled AI job losses or payments to overseas AI providers, and the workplace department holds no data on whether employers consult staff about AI.
Data
The 139,000 is a modelled gap: fewer Skill Level 1 workers than baseline growth if education choices followed labour demand, offset by about 106,000 more trade and technical workers. JSA says the scenario does not consider AI, and the report’s baseline does not explicitly model it.
Government
The Secretaries Digital and Data Committee cites the risk of relying on a small number of overseas AI providers, in a communique published on 6 November. A week earlier, Home Affairs told a parliamentary committee its broader posture on open-weight models is still being worked through, and the AI Safety Institute described red flags.
Government
The DTA released its AI Reference Architecture on 30 October. The companion guide’s first worked example is Copilot, and it tells agencies an Australian data centre commitment for data at rest does not necessarily mean Australian processing, that security assessments may not cover every component, and that Copilot may shape official work without automatically keeping the prompts and outputs. Microsoft’s own page says queries from outside the EU may be processed in other regions.
Regulation
The OAIC received 5,268 privacy complaints in 2025–26, up 60 per cent. Its annual report, published on 22 October, says the rise appears to be attributable to concern about social media, AI companies and data brokers, citing its attitudes survey. Its sector table has no line for AI; social media complaints rose 125 per cent.
Government
Version 2.1 of the policy, published on 21 October, changes no requirement. It adds Appendix D, a classification agencies must use in registers, impact assessments and transparency statements: seven usage patterns where there were four, adding coding, workflow automation and strategic support, and decision-making redefined around rights or interests. The impact assessment tool still offers the old four boxes.
Regulation
The Privacy Commissioner says a shop or manufacturer that collects nothing may have no Privacy Act obligations; the software provider holding the data is likely the one that answers. Most collection needs no consent. On 7 October the OAIC announced an investigation into the maker of the HeyCyan app after it did not answer preliminary inquiries. Tranche 2’s erasure right would stop at large digital platforms.
Policy
Introduced on 15 October and sent to a Senate committee the same day, with 30 October 2026 set as the closing date for submissions. A service that generates material using AI is now an online service in its own right, and testing before deployment appears in the explanatory memorandum, not the Act. Schedule 3 still repeals every industry code and standard, and nothing requires output differentiation in their place.
Regulation
The Joint Select Committee on AI wrote to the Prime Minister on 12 October, before its report. It wants evaluators with employee-like access inside frontier labs, incident reporting with clear deadlines, early model access for agencies such as ASD where labs train here, and a register of sovereign AI companies. The report is due by 30 November.
Research
The AI Safety Institute published the report on 8 October. An AI can be right on the task it is checked on and still shift what its overseer believes about something else. The clear result came when an adversary controlled the verifier’s training; with less control the effect was inconsistent, a condition the Institute’s summary page leaves out.
Regulation
ASIC’s 30 September letter to bank boards lists the review among its new activities for 2026-27. Of the five sector letters ASIC published that day, it is the only one to give AI its own heading and an expected start. The markets letter says ASIC will assess and address AI-driven manipulation; the general insurance letter does not mention AI.
Regulation
Under rules ASIC made in September, a market participant must not act on a client’s order it ought reasonably suspect will have the effect of creating a false or misleading appearance, whether or not anyone intended it. The 2025 consultation paper proposed an intention test only; ASIC added the effect limb afterwards, citing agentic AI. Draft guidance was put out for comment with a closing date of 5 November 2026.
Research
eSafety surveyed 1,950 children aged 10 to 17 before the Age-Restricted Material Codes for AI services took effect on 9 March. 78% had used an AI assistant and 8% an AI companion; among assistant users, 46% had sought personal advice, such as about their health. One in five who had used either had a potentially inappropriate or harmful interaction.
Government
The DTA points to its agentic AI addendum as the foundation for Australia’s part in a new OECD working group. It tells agencies to make a human accountable for agents’ decisions and to keep oversight human-in-the-loop or human-on-the-loop. It also calls itself best practice guidance, and the binding AI policy lists the standard it extends under recommended actions.
Government
Its first meeting, on 26 June, considered two staff-facing AI uses at the Attorney-General’s Department and Services Australia; the DTA announced it 103 days later. The DTA will provide the Minister for Finance with the minutes and the advice issued to agencies, and the committee will publish communiques. The government’s AI policy, still version 2.0, does not mention the committee.
Policy
The 31 August exposure draft never says artificial intelligence. Its AI rule is one definition: personal information is collected however it is obtained, including by generating or deriving it, which the consultation paper says will make AI inferences count. Every collection would have to be fair and reasonable, and a sensitive inference would need consent unless an exception applies. Submissions closed 18 September; the commencement table is blank.
Policy
The 8 September exposure draft repeals every online safety industry code and standard, including the one that makes high impact generative AI services test their models and differentiate AI outputs, and the basic online safety expectations that name generative AI. No provision keeps them in force. In their place is one general duty, backed by 60,000 penalty units. The repeals start 12 months after Royal Assent, and as at 6 October the bill had not reached Parliament.
Government
The NSW Auditor-General counted the governance around AI at the 10 agencies with the highest AI use or greatest potential benefit. All 10 have addressed accountability and eight train staff, but only half have an AI policy, four have considered AI in their IT policies and one in procurement. A new mandatory AI Operational Policy now requires registration and a signed attestation, the first due 31 October 2027. It says nothing about tracking AI costs.
Policy
PSPF Direction 002-2026 was published on 29 September with AI in its title and frontier AI in its reasoning. What it requires is older than that. Every non-corporate Commonwealth entity must stocktake its legacy technology and send Home Affairs a risk management plan with a reduction target by 31 March 2027. Entities running Systems of Government Significance report on those by 31 December 2026, against measures in an explanatory note that is not out yet. No AI tool is banned, approved or named.
Policy
We read all 116 Australian Government AI transparency statements. On the one requirement a reader can check in a second, compliance is high and comparability is nil: at least 18 different wordings, most of them prose rather than a field. Two automated passes over the same 109 readable documents disagreed by 15, and hand-reading showed both had undercounted.
Policy
We reconciled the DTA’s index of mandatory AI transparency statements against the Finance register of Commonwealth entities and it balances exactly: 106 non-corporate entities, 95 statements, 11 accounted for. The carve-out is drawn by portfolio rather than function, so the Department of Veterans’ Affairs is outside a policy that binds the AFP. Three carved-out bodies published anyway.
Policy
Policy Advisory 001-2026 describes a vulnerability storm and exploit timelines collapsing from days to hours, then answers with patching, hardening and the Essential Eight. In the attached ASD framework, adopting AI is the fifth of six strategies and medium-term.
Policy
PSPF Policy Advisory 001-2025 confirms OFFICIAL information can be used with generative AI, and names Hosting Certification Framework providers, OpenAI and Anthropic as needing no additional Foreign Ownership, Control or Influence assessment. Every other provider must be assessed under a separate Direction before staff get access. An allow list you can read, beside a deny list you cannot.
Policy
PSPF Direction 001-2025 bans DeepSeek products, applications and web services from government systems, and a footnote excludes open sourced LLMs on three cumulative conditions: inspectable codebase, local deployment, mitigations in place. Since Direction 004-2025 took effect on 31 October 2025 the operative list has been the Commonwealth Technology Standard Deny List, which is not in the PSPF publications library.
Policy
The Senate select committee tabled its final report on 26 November 2024, recommending dedicated legislation for high-risk AI, work health and safety coverage, and transparency about copyrighted works in training data. Senate practice requires a response in three months. It was tabled in the House on 1 April 2026, in five thematic parts that refer to a numbered recommendation three times. The Senate’s own pages still do not record it.
Policy
The Policy for the responsible use of AI in government applies to all non-corporate Commonwealth entities and carries eight mandatory requirements. So does the Protective Security Policy Framework, whose Directions ban a named AI service outright. The APS AI Plan, the technical standard, the agentic addendum and the PSPF policy advisories are guidance. Corrected 29 August on a reader tip.
Policy
Eight mandatory requirements, read from the policy document rather than the summary of it. A scope test that excludes AI spellcheckers, a named human answerable for every in-scope use case, a register that goes to the DTA twice a year, and an impact assessment that must be finished before deployment. One deadline has passed, a cluster lands at the end of 2026, and everything already running is due by 30 April 2027.
Policy
The ACCC, ACMA, eSafety and the OAIC published 2026-28 priorities and a signed MoU two days apart in June. We read both plus all 2,332 words of the signed document. AI appears zero times, from a forum whose last three substantive publications were about AI.
Policy
The APS AI Plan published 15 deliverables against dated timeframes, and most of those dates have now passed. The oversight committee arrived, chaired by the DTA chief executive and seating the Privacy Commissioner and the head of the AI Safety Institute. Its own page says the advice is non-binding and that it does not replace agency accountability.
Policy
The OAIC's 30 September guidance: rule-based software counts, a human sign-off does not take a decision out of scope, and if in doubt, disclose.
Policy
The obligation commences 10 December 2026 under the Privacy Act. Three limbs, and the one that decides scope is whether a decision could reasonably be expected to significantly affect a person’s rights or interests. The OAIC consulted on exactly that, closed submissions on 15 June, and the guidance is not out.
Policy
119 pages by Gradient Institute on what happens when AI agents from different organisations meet. Three governance tiers, a map of who can act on each risk, and a set of gaps that fall to no one: there is no trusted issuer for agent identity, and the report says no single party has the standing or the funding model to become one.
Policy
The memorandum with Singapore was signed on 16 December 2024, a year before the Canada and UK ones, and its text is published. We read it: no binding obligations, each side bears its own costs, and every mechanism it creates is permissive. The first dialogue it has produced met on 30 July, and its own review window opens on 16 December 2026.
Policy
We read both Directions to Comply on the eSafety register. Each names the provider a high impact generative AI DIS with a tier 1 risk profile, each cites the same two compliance measures, and the first of those reaches the moment before the material exists: what a service will let a user ask it to generate.
Policy
Signed 25 May 2026. What is public is a three-bullet overview, where the Canada agreement eleven weeks earlier was published in full, clauses and all. Because we read that one, we can say precisely what this overview does not answer: whether it binds anyone, whether it funds anything, and what may actually be shared.
Policy
The full text is published, so we read it. Seven areas of cooperation including talent exchange between the two AI safety institutes, and two hard deadlines. It creates no legally binding obligations, has no financial implication for either country, and ends on six months' notice. The workplan is due around 1 September.
Policy
The ACITI Partnership was announced in November 2025 in a joint statement that led with green energy innovation, resilient supply chains and critical minerals, and said the partnership would also examine artificial intelligence. The memorandum, whose signing was announced in July 2026, sets up a joint working group with four streams, and every one of them is AI. Minerals, energy and net zero do not appear in it at all.
Policy
It is eight months old, it sits inside the department whose policy it informs, and its technical partners include the Australian Signals Directorate, which the ministerial release did not mention. The multi-agent project credited to it was published four months before it existed and funded by the department. And the international network it belongs to has quietly dropped the words “AI Safety” from its name.
Policy
Six ministers jointly named the government’s AI safety priorities on 20 July: a Digital Duty of Care, a second tranche of privacy reform, workplace AI safety, consumer-law options covering agentic commerce and surveillance pricing, and a framework for automated decision-making inside federal agencies. Four lead ministers share them, the release gave none a date, and two have since reached draft bills.
Policy
Updated OAIC guidance implements what the Administrative Review Tribunal decided in the Bunnings matter, covering 62 stores between 2018 and 2021. It clarifies when the consent exceptions apply to biometric collection in retail, restates that a precautionary approach is required, and cites a survey finding that 45 per cent of Australians now rate facial recognition among the biggest privacy risks they face. The Kmart matter is still live.
Research
The privacy regulator's triennial national survey puts AI companies equal-last on trust, level with data brokers. Ninety-six per cent want conditions before an AI decides anything about them, and of the eight conditions measured in both 2023 and 2026, every one rose. We read the 80-page report and set it against the regulatory posture Australia actually chose.
Policy
In 2024 the government proposed ten mandatory guardrails for high-risk AI and three ways to make them law, up to an Australian AI Act. The plan that answered commits to none of it; the word "guardrails" does not appear once in its 37 pages. We read both documents end to end, and here is what actually binds an Australian AI deployer today.
Policy
Zero mentions of artificial intelligence, machine learning or generative in the whole Act. The category that catches AI services is defined by what it is not, and the reason turns on a question worth asking about your own product: who is the other end-user?
Policy
The Attorney-General has announced the government is not considering a text and data mining exception. That settles the question most of the argument has been about, and it makes the three areas actually on the table worth reading.
Regulation
The words ASIC attributes to the court do not appear in its judgment. What does is a five-factor test for what counts as adequate, and an express statement that the law does not demand perfection.
Government
Schedule 6 of the Age-Restricted Material codes names AI companion chatbots, deems some generative services highest-risk without an assessment, and regulates platforms that host uploaded models.
Government
Its sibling instrument covers messaging and email, and does not contain the word once. What it says about AI instead, and the qualification that matters.
Government
A binding standard defines a “high impact generative AI DIS” and tells its provider what to do, including differentiate AI outputs. Read clause by clause.
Regulation
Twelve expected actions, four board-level demands, one enforcement precedent named as the standard.
Government
Only 38 per cent of AI-adopting agencies have an AI policy, and 5 per cent have AI procurement guidance. The audit scorecard, charted.
Data
NAIC and CSIRO's census of the ecosystem: 25 clusters, Melbourne on top, patents near-quadrupled, and a commercialisation gap the report names itself.
Industry
The most concrete case yet of an ASX-listed company naming AI as the reason for a quantified cut. The filing's own numbers complicate the framing.
