Section
What Australian AI regulation actually requires, federal and state, read from the consultation papers, plans, letters and audit reports themselves, every claim linked to its document with the date we read it.
Policy
Eight mandatory requirements, read from the policy PDF rather than the web summary. The scope test that excludes AI spellcheckers, the register that goes to the DTA every six months, and the assessment that must be finished before deployment. One deadline has already passed and existing use cases are due by 30 April 2027.
Policy
DP-REG is the ACCC, ACMA, eSafety and the OAIC. Its 2026-28 priorities and its signed MoU do not use the word AI once, and its three previous substantive publications all did.
Policy
The APS AI Plan published 15 deliverables against dated timeframes and most of those dates have passed. The oversight committee arrived, chaired by the DTA chief executive and seating the Privacy Commissioner and the head of the AI Safety Institute. Its own page says its advice is non-binding and that it does not replace agency accountability.
Policy
We read the 224-page compilation. The Act never says artificial intelligence, machine learning, generative, algorithm or chatbot, yet it binds AI providers, because designated internet service is a residual category defined by subtraction. The prior question the obligations pieces assume.
Policy
Australia has no text and data mining exception and the Attorney-General has said the government is not considering one. What the Copyright and AI Reference Group is, and the three priority areas that are actually on the table.
Regulation
ASIC tells boards their cyber risk management must be demonstrably effective and proportionate, as set out in the court's FIIG judgment. Those words are not in it. What is in it is a five-factor test, an express rejection of a standard of perfection, and a court-supervised compliance programme worth more attention than the $2.5 million penalty.
Government
Queensland's Audit Office found the department responsible for AI policy has limited visibility of AI use across government. Five weeks later NSW counted 357 tools across 21 agencies. Different methods, same blind spot.
Government
The obligation commences 10 December 2026 under the Privacy Act. Three limbs, and the one that decides scope is whether a decision could reasonably be expected to significantly affect a person’s rights or interests. The OAIC consulted on exactly that, closed submissions on 15 June, and the guidance is not out.
Government
The Australia-Singapore AI memorandum was signed on 16 December 2024, a year before the Canada and UK ones, and its full text is published. No binding obligations, each side bears its own costs, every mechanism permissive. Its first dialogue met on 30 July, and its own review window opens on 16 December 2026.
Government
Schedule 6 of the Age-Restricted Material codes has bound designated internet services since 9 March 2026. It reuses the high impact generative AI DIS category for age-restricted material, names AI companion chatbots in a note, sends sole-purpose generative services straight to Tier 1, and creates a category for platforms that host uploaded models.
Government
The relevant electronic services standard, covering messaging and email, was determined by the same Commissioner on the same day under the same section. It does not use the word “generative” once. What it says about AI instead, and why that is not the same as a loophole.
Government
A binding industry standard defines a “high impact generative AI DIS” and tells its provider to prevent certain outputs, test models and differentiate AI outputs. Made by the eSafety Commissioner, not the AI portfolio. Read clause by clause.
Government
Eight months old, inside the department it advises, partnered with the Australian Signals Directorate, and citing a report published before it existed. What the primary documents actually say.
Government
Six ministers named the safety agenda that followed the guardrails process. Each priority has a different lead minister and a different law, and none of them carries a published date.
Regulation
Updated OAIC guidance implements the Bunnings tribunal findings and clarifies when the consent exceptions apply to biometric collection in retail. The Kmart matter is still before the Tribunal.
Government
The Auditor-General counted 21 of 26 major agencies using AI, 38 per cent with a formal AI policy, and 5 per cent with AI procurement guidance. The scorecard, charted from the audit itself.
Regulation
Twelve expected actions, four board-level demands, and one enforcement precedent named as the standard. What Commissioner Constant's open letter actually requires, quoted from the letter.
Safety
OpenAI rates all three GPT-5.6 models High capability for cyber and biological risk. Washington reportedly held the launch for testing. Australia, by explicit design of the National AI Plan, had nothing to hold it with.
Policy
Ten mandatory guardrails and a possible AI Act were consulted on in 2024. The plan that answered commits to none of them, and "guardrails" does not appear once in its 37 pages. What binds an Australian AI deployer today.
