Canberra’s AI Regulation Plan: No New Regulator Is Coming

After 18 months of deliberation, the federal government tabled its response to the Senate Select Committee on Adopting AI on 1 April. The answer business owners have been waiting for: Australia will not get a standalone AI regulator. Your existing industry watchdogs — ASIC, the ACCC, the OAIC, APRA — are the ones responsible for enforcing AI rules in their respective sectors.

For an SME owner who’s been watching the regulatory noise and wondering what actually applies to them, this is the most clarifying thing Canberra has said about AI all year.

The Senate Committee handed down 13 recommendations in September 2024 after a national inquiry that received submissions from industry, unions, academics and regulators. The headline recommendation: introduce dedicated, whole-of-economy legislation to regulate high-risk AI uses.

The government’s response doesn’t reject that recommendation — but it doesn’t act on it either. Instead, it maintains that existing laws are “fit for purpose” and confirms a sector-based enforcement model. ASIC watches financial services. The ACCC watches consumer markets. The OAIC watches privacy. APRA watches prudential risk. No new agency sits across them.

Alongside the response, the government committed $29.8 million over four years to the Australian AI Safety Institute, which became operational in early 2026. The AISI will monitor AI developments, publish guidance, and advise government — but it can’t fine you or compel disclosure. It’s a knowledge body, not an enforcer. The government also confirmed it is not introducing a text and data mining copyright exception — a signal that AI developers will need to licence content rather than scrape it freely.

For a trades business, the practical read is simple: if your software uses customer data, the OAIC’s privacy rules apply. If your AI scheduling tool makes performance claims, the ACCC’s consumer law applies. There’s no special AI carve-out and no new compliance layer — yet. The rules you already follow extend to the AI tools you adopt.

The voluntary Guidance for AI Adoption, published by the Department of Industry in October 2025, condenses ten earlier guardrails into six practices: accountability, stakeholder rights, risk management, transparency, monitoring, and human oversight. It’s not mandatory. But voluntary guidance has a habit of becoming the benchmark courts and regulators reach for when assessing what “reasonable” looks like. Reading it now is cheaper than explaining why you didn’t later.

For professional services firms, the sharper edge is the Privacy Act. We covered the December 2026 deadline in an earlier note — if you use AI to make or assist decisions that significantly affect individuals, your privacy policy must disclose it by 10 December. The government’s Senate response reaffirms that timeline. ASIC and the OAIC have both flagged AI governance as enforcement priorities for 2026.

Buried in the regulatory discussion is a funding pipeline. CRC-P Round 19, part of the government’s AI Accelerator initiative, opened on 18 March with $20 million earmarked for projects that develop or enhance AI systems. Applications close 12 May 2026 at 5:00 PM AEST.

The structure isn’t a simple grant application. Projects need at least two Australian industry organisations and one research organisation, with an SME as the lead applicant. Matched funding between $100,000 and $3 million is required. It’s designed for collaborative research — not solo adoption. But for trades or professional services businesses already partnered with an industry body or university on an AI pilot, this is real money on the table. A further $50 million is earmarked for CRC Round 28 in 2027, focused on establishing an AI Cooperative Research Centre to drive commercialisation.

Three things. First, read the six-point Guidance for AI Adoption from the Department of Industry. It takes ten minutes and sets the standard your regulator will likely measure you against, voluntary label or not. Second, check whether your industry association is assembling a CRC-P application before the 12 May deadline — you don’t need to lead it, but you should know if one’s forming. Third, if you haven’t started on the Privacy Act disclosure due in December, start now. Eight months sounds comfortable until you’re auditing five different software platforms to work out which ones use automated decision-making.

Key takeaways

Not sure which of these applies to your business?

A short conversation can map where you sit against the regulatory timeline and whether there’s a funding opportunity worth pursuing. Book a call to talk it through.