Australia's AI Rules Just Went From Voluntary to Legislated

Three months ago, we wrote that Canberra's AI regulation plan was voluntary guidance and sector-based enforcement. No new regulator. No new law. Existing agencies would handle it.

That changed on 15 July. Prime Minister Anthony Albanese announced the creation of an Office of AI within his own department and committed to legislating national AI standards by early 2027. When a PM takes a policy area out of the line ministry and puts it in his own office, it is no longer a watching brief. It is a defining agenda item.

Albanese called AI "a bigger challenge and a bigger opportunity than social media" in a speech at the University of Sydney. He laid out four commitments that shift the regulatory trajectory for every Australian business using AI tools.

First, an Office of AI inside the Department of the Prime Minister and Cabinet. Not advisory — coordinating. The Office will design national AI standards and align state and territory approaches. Albanese compared the model to how Australia governs civil aviation and genetics: centralised standards, distributed enforcement.

Second, those standards will be legislated. The PM will take the framework to national cabinet next month to seek agreement from premiers and chief ministers, then introduce legislation to parliament in early 2027.

Third, data centre regulation. Large operators will be legally required to underwrite their own power supply, act as net-generators returning more electricity to the grid than they consume, and minimise water use. The stated aim: AI infrastructure must not drive up household power prices or compete with housing for land.

Fourth, copyright protection. Albanese was blunt: "No company should use Australian books, music, art or news to build or train AI without the artist's control. Anything less is theft." AI developers will need to licence Australian content, not scrape it.

The Guidance for AI Adoption published by the Department of Industry in October 2025 — six practices covering accountability, stakeholder rights, risk management, transparency, monitoring, and human oversight — was labelled voluntary. We said at the time that voluntary government guidance has a habit of becoming the benchmark courts and regulators reach for.

That transition is now explicit. The PM's Office of AI will build on existing guidance to develop legislated standards. What was optional is becoming mandatory. The window to prepare is 12 to 18 months, not indefinite.

Professional services firms are already navigating the Privacy Act disclosure deadline on 10 December 2026: if you use AI to make or assist decisions that significantly affect individuals, your privacy policy must disclose it. The legislated AI standards arriving in 2027 sit alongside that requirement. Two regulatory milestones within six months.

For trades businesses, the practical question is which AI tools in your stack — scheduling software, quoting platforms, customer management systems, AI phone agents — will need to demonstrate compliance with national standards. The answer depends on what "high-risk" ends up meaning in legislation, but the direction is clear. The data centre buildout also has direct operational implications: net-generation power requirements mean more electrical, HVAC, and plumbing work tied to renewable energy infrastructure. We covered how the data centre boom is creating work for trades earlier this year.

For professional services firms, the sharper edge is compounding compliance. The Privacy Act disclosure, the AUSTRAC tranche-two AML obligations, and now legislated AI standards are arriving in sequence. Firms that have already documented their AI toolchain and governance practices will absorb each requirement incrementally. Those that have not will face three overlapping retrofit projects.

One: read the six-practice Guidance for AI Adoption from the Department of Industry. It takes ten minutes and will almost certainly shape whatever legislation follows. Knowing the practices now means you build to the right spec rather than retrofitting later.

Two: document your AI toolchain. List every AI-enabled tool your business uses, what data it touches, and what decisions it supports. When compliance obligations arrive, this inventory is the starting point. Building it now, while there is no deadline pressure, takes a fraction of the effort it will under the clock.

Three: ask your software vendors where they stand. If your practice management platform, accounting software, or field service tool uses AI features, the compliance obligation will eventually land somewhere in the supply chain. Vendors who can articulate their AI governance today are the ones worth staying with.

Key takeaways

Related notes

Not sure what the new AI standards mean for your business?

The regulatory landscape is moving faster than most SMEs expect. Book a call and we'll walk through what applies to your industry, your tools, and your timeline.