Section
What Australian AI regulation actually requires, federal and state, read from the consultation papers, plans, letters and audit reports themselves, every claim linked to its document with the date we read it.
Government
The secretaries’ two sentences on open-weight models, the GovAI figures as at October 2026, the Commonwealth’s current rules as Home Affairs sketched them, and the AI Safety Institute’s caution.
Government
The companion guide to the DTA’s AI Reference Architecture (30 October) works through Microsoft 365 Copilot: where data is processed, what security assessments cover, and what records it keeps. Plus its advice on buying an AI call centre agent, and where the architecture sits among the rules.
Regulation
The OAIC’s 2025–26 annual report: 5,268 complaints, social media up 125 per cent, and an attribution to AI companies that rests on the regulator’s attitudes survey rather than its complaint data. What it lists as AI work, and the two December dates that matter more.
Government
Policy v2.1 (21 October) leaves every requirement as it was and adds a mandatory classification of AI use: coding, workflow automation and strategic support are new patterns, and decision-making now turns on effect on rights or interests. The DTA’s impact assessment tool still uses the old labels, as did 45 of 116 transparency statements we saved on 30 September, and no date is set to change them.
Regulation
The Privacy Commissioner’s reading of who the Act binds, when consent is needed and why the notice duty is thin, alongside the OAIC’s 7 October investigation into the maker of the HeyCyan app. Tranche 2 would add a fair and reasonable test, but its erasure right stops at large digital platforms.
Policy
Introduced on 15 October; Senate committee submissions closed on 30 October. AI services are named outright and pre-deployment testing reaches the explanatory memorandum, but Schedule 3 still repeals every industry code and standard, and nothing requires output differentiation in their place.
Regulation
The committee’s 12 October letter asks for mandated evaluators inside frontier labs, incident deadlines, a standing parliamentary committee, protections for what labs report, and pro-Australian procurement. It names the Medicare incidents as the trigger. The full report is due by 30 November.
Regulation
The banking letter is the only one of ASIC’s five 2026-27 sector letters to give AI its own heading and an expected start; ASIC will collaborate with APRA to minimise duplication. The letter does not say whether the findings will be published. The general insurance letter does not mention AI.
Regulation
ASIC’s amended market integrity rules add an effect limb for client orders, which its consultation paper did not propose; ASIC cites agentic AI. ASIC’s draft guidance says the testing rule does not apply to a client’s own algorithm; both limbs apply to its orders. The rules commence on 18 March 2028; comments on the draft guidance closed on 5 November 2026.
Government
The addendum the DTA points to as it joins an OECD working group puts a human accountable for agents’ decisions, and oversight in or on the loop, under “Agencies must”. It calls itself best practice guidance; the binding policy strongly recommends the standard it extends.
Government
The first meeting, on 26 June, considered two staff-facing AI uses and was announced on 7 October. Under the terms of reference, the Minister for Finance receives the minutes and the advice issued to agencies; the public gets communiques. The AI policy, still version 2.0, does not mention the committee.
Policy
The 31 August exposure draft never says artificial intelligence. One definition does the work: information an organisation generates or derives about you counts as collected, so an AI inference would face a fair and reasonable test and, if sensitive, a consent rule with exceptions. It is a draft, with no commencement date.
Policy
The 8 September exposure draft repeals every online safety industry code and standard, including the one that makes high impact generative AI services test their models and differentiate AI outputs, and the basic online safety expectations that name generative AI. No provision keeps them in force. One general duty takes their place, 12 months after Royal Assent.
Government
The NSW Auditor-General counted the governance around AI at the 10 agencies with the highest AI use or greatest potential benefit. All 10 have addressed accountability and eight train staff, but only half have an AI policy, four have considered AI in their IT policies and one in procurement. A new mandatory AI Operational Policy now requires registration and a signed attestation, the first due 31 October 2027.
Government
PSPF Direction 002-2026 was published on 29 September with AI in its title and frontier AI in its reasoning. What it requires is older than that. Every non-corporate Commonwealth entity must stocktake its legacy technology and send Home Affairs a risk management plan with a reduction target by 31 March 2027. Entities running Systems of Government Significance report on those by 31 December 2026, against measures in an explanatory note that is not out yet. No AI tool is banned, approved or named.
Policy
The Standard exists to make these statements comparable. Reading all 116, the date is there far more often than any scan sees, expressed in at least 18 forms, most of them prose. Two passes over identical documents disagreed by 15 and both were too low. A requirement that is met but cannot be compared at scale is one nobody can audit, including the department that wrote it.
Policy
106 non-corporate Commonwealth entities, 95 mandatory AI transparency statements, and every one of the 11 gaps accounted for against the policy’s own carve-out text. The defence exemption is written by portfolio, so it reaches veterans’ compensation; the intelligence exemption is written by function, so the AFP stays inside the policy for everything else. All 116 links on the index resolve.
Policy
Eight mandatory requirements, read from the policy PDF rather than the web summary. The scope test that excludes AI spellcheckers, the register that goes to the DTA every six months, and the assessment that must be finished before deployment. One deadline has already passed and existing use cases are due by 30 April 2027.
Policy
DP-REG is the ACCC, ACMA, eSafety and the OAIC. Its 2026-28 priorities and its signed MoU do not use the word AI once, and its three previous substantive publications all did.
Policy
The APS AI Plan published 15 deliverables against dated timeframes and most of those dates have passed. The oversight committee arrived, chaired by the DTA chief executive and seating the Privacy Commissioner and the head of the AI Safety Institute. Its own page says its advice is non-binding and that it does not replace agency accountability.
Policy
We read the 224-page compilation. The Act never says artificial intelligence, machine learning, generative, algorithm or chatbot, yet it binds AI providers, because designated internet service is a residual category defined by subtraction. The prior question the obligations pieces assume.
Policy
Australia has no text and data mining exception and the Attorney-General has said the government is not considering one. What the Copyright and AI Reference Group is, and the three priority areas that are actually on the table.
Regulation
ASIC tells boards their cyber risk management must be demonstrably effective and proportionate, as set out in the court's FIIG judgment. Those words are not in it. What is in it is a five-factor test, an express rejection of a standard of perfection, and a court-supervised compliance programme worth more attention than the $2.5 million penalty.
Government
Queensland's Audit Office found the department responsible for AI policy has limited visibility of AI use across government. Five weeks later NSW counted 357 tools across 21 agencies. Different methods, same blind spot.
Government
The OAIC's 30 September guidance: rule-based software counts, a human sign-off does not take a decision out of scope, and if in doubt, disclose.
Government
The obligation commences 10 December 2026 under the Privacy Act. Three limbs, and the one that decides scope is whether a decision could reasonably be expected to significantly affect a person’s rights or interests. The OAIC consulted on exactly that, closed submissions on 15 June, and the guidance is not out.
Government
The Australia-Singapore AI memorandum was signed on 16 December 2024, a year before the Canada and UK ones, and its full text is published. No binding obligations, each side bears its own costs, every mechanism permissive. Its first dialogue met on 30 July, and its own review window opens on 16 December 2026.
Government
Schedule 6 of the Age-Restricted Material codes has bound designated internet services since 9 March 2026. It reuses the high impact generative AI DIS category for age-restricted material, names AI companion chatbots in a note, sends sole-purpose generative services straight to Tier 1, and creates a category for platforms that host uploaded models.
Government
The relevant electronic services standard, covering messaging and email, was determined by the same Commissioner on the same day under the same section. It does not use the word “generative” once. What it says about AI instead, and why that is not the same as a loophole.
Government
A binding industry standard defines a “high impact generative AI DIS” and tells its provider to prevent certain outputs, test models and differentiate AI outputs. Made by the eSafety Commissioner, not the AI portfolio. Read clause by clause.
Government
Eight months old, inside the department it advises, partnered with the Australian Signals Directorate, and citing a report published before it existed. What the primary documents actually say.
Government
Six ministers named the safety agenda that followed the guardrails process. Four lead ministers share the five priorities, the release dated none of them, and two have since reached draft bills.
Regulation
Updated OAIC guidance implements the Bunnings tribunal findings and clarifies when the consent exceptions apply to biometric collection in retail. The Kmart matter is still before the Tribunal.
Government
The Auditor-General counted 21 of 26 major agencies using AI, 38 per cent with a formal AI policy, and 5 per cent with AI procurement guidance. The scorecard, charted from the audit itself.
Regulation
Twelve expected actions, four board-level demands, and one enforcement precedent named as the standard. What Commissioner Constant's open letter actually requires, quoted from the letter.
Safety
OpenAI rates all three GPT-5.6 models High capability for cyber and biological risk. Washington reportedly held the launch for testing. Australia, by explicit design of the National AI Plan, had nothing to hold it with.
Policy
Ten mandatory guardrails and a possible AI Act were consulted on in 2024. The plan that answered commits to none of them, and "guardrails" does not appear once in its 37 pages. What binds an Australian AI deployer today.
