AI Compliance in Australia (2026): The Rules That Create Liability

If someone has told you a sweeping 'AI Act' is about to land that your business must comply with, they're wrong. As of 2026 Australia has no AI-specific statute, and the government has decided not to build one: the proposed mandatory AI guardrails were dropped in the National AI Plan of December 2025 in favour of a technology-neutral approach.

That's the good news and the trap in one sentence. Good, because there's no new AI regime to fear. A trap, because 'no AI Act' quietly gets read as 'no rules' — and there is exactly one dated obligation that lands on ordinary businesses on 10 December 2026, plus a stack of existing laws that already create real liability the moment you point an AI tool at customer or staff data. Here is the honest map, framed the way it actually bites: as risk.

The Privacy Act reforms passed in December 2024 added a transparency requirement for automated decision-making. From 10 December 2026, if your business is covered by the Privacy Act and you use personal information in a computer program to make — or substantially help make — a decision that significantly affects someone, you must update your privacy policy to disclose it.

In plain terms: if AI or automation helps decide things about people — credit or payment terms, hiring and screening, tenancy, insurance, eligibility — you have a privacy-policy update to make by December 2026. We set out exactly who is in scope in our note on the automated-decision disclosure rule. It is not a ban and not a right to human review — it is a notice obligation. The sensible move now is to work out which of your tools qualify, so the update is a small job later, not a scramble.

The Australian Consumer Law applies to AI without amendment — Treasury's own 2025 review found it 'fit for purpose.' That means two live exposures today, not someday. First, 'AI-washing': overstating what your AI does, or what a product's AI can deliver, is misleading conduct. Second, AI-generated marketing that misleads — fake-sounding reviews, manipulative checkout flows, invented urgency — is enforceable now, and the regulator is actively watching.

This is the area we see bite soonest, because it is where AI touches the public. We went deeper on where AI-generated marketing crosses the line in our note on dark patterns and the unfair-trading rules. If you are using AI to write ad copy, generate reviews or build landing pages, this is your first compliance review.

Want to know what this means for your business? We'll map it in one call.

The other place AI creates liability is inside your own team — AI used in hiring, rostering, performance management or termination. Get it wrong and it surfaces as a Fair Work claim, and those claims are rising sharply where AI is involved, as we set out in our note on AI-generated employer risk.

The rule of thumb: a human must own any consequential decision about a person; AI can inform it but not make it unchecked; and you need to be able to explain how the decision was reached. 'The system decided' is not a defence.

The government's Voluntary AI Safety Standard (2024) was refreshed in October 2025 into 'Guidance for AI Adoption' — six essential practices: decide who is accountable, understand your AI's impacts, measure and manage the risks, test and monitor it, keep a human in control of consequential decisions, and be transparent when AI is used.

It is voluntary. It is also the yardstick your insurer, your enterprise clients and any regulator will reach for if something goes wrong. 'We had no legal obligation' is a weak position when the government has published a plain-language standard and you ignored it. Treat the six practices as the floor, not an optional extra.

Make a list of where AI touches your business — which tools, doing what. You cannot govern, or disclose, what you have not mapped, and every regulator's guidance starts here. Flag any AI that helps decide things about people (credit, hiring, tenancy, insurance) — those are your December 2026 privacy-policy items. Don't AI-wash, and keep confidential or copyright material out of public AI tools without the rights to use them; there is no AI 'text and data mining' copyright exception in Australia.

Then put a one-page internal AI-use policy in place — approved tools, no client-confidential data in public models, human review of anything client-facing. That, plus the inventory, is 80 per cent of 'AI governance' for a business your size. If you are in financial services, ASIC and APRA now expect a formal AI governance framework and human accountability for high-risk decisions — existing obligations, applied to AI.

Key takeaways

Related notes

Not sure which of your tools are in scope for December 2026?

Book a call. We'll map where AI touches decisions in your business, what the law actually asks of you, and the short list of things worth doing before the deadline — no jargon, no scaremongering.