Mandatory AI Rules Hit Australian Government in June. Here’s Why SMEs Should Care.

On 15 December 2025, the Digital Transformation Agency published Version 2.0 of the Policy for the Responsible Use of AI in Government. It’s not a suggestion. The first mandatory requirements take effect on 15 June 2026, with the rest following in December 2026.

This is the Australian Government’s most concrete step toward AI governance to date. Every Commonwealth agency must now designate an accountable official for AI, conduct impact assessments against Australia’s AI Ethics Principles using a new standardised tool, and ensure all staff complete foundational AI training. The DTA has also published new procurement guidance for agencies buying AI tools or services.

If your business supplies products or services to any Commonwealth agency — and many trades and professional services firms do, whether directly or through subcontracting — this changes the conversation. Agencies will now need to assess the AI risk profile of the tools they procure. That means your quoting software, your scheduling platform, your document automation system, or any tool that uses AI will face a new layer of scrutiny before it gets approved.

The practical implication: if you’re an SME selling to government and your tools use AI (even basic automation or machine learning), expect procurement teams to ask questions they haven’t asked before. Can you explain how your AI makes decisions? Do you have a data governance policy? Can you demonstrate that your system aligns with Australia’s AI Ethics Principles? If you can’t answer those questions, you’re at a disadvantage — not because the technology is wrong, but because the compliance conversation has changed.

Separately, the Department of Industry, Science and Resources updated the Guidance for AI Adoption in October 2025, streamlining the previous 10-guardrail Voluntary AI Safety Standard down to six essential practices. These aren’t mandatory for the private sector, but they’re the closest thing Australia has to a national AI governance framework — and they’re a reasonable benchmark for any business thinking about AI adoption.

The six practices cover: establishing AI governance, identifying and managing risks, being transparent about AI use, protecting data and privacy, ensuring human oversight, and monitoring AI systems over time. None of this is onerous for a well-run SME. Most of it amounts to: know what AI you’re using, understand what it does with your data, and have a human in the loop for decisions that matter.

For businesses considering AI adoption, these practices are a useful readiness checklist. If you can tick most of them off before you start, your implementation is far more likely to stick — and if government contracts are part of your revenue, you’ll be ahead of the compliance curve rather than scrambling to catch up.

Three things. First, read the DTA’s updated policy — it’s publicly available and shorter than you’d expect. Second, audit what AI is already in your business. Many SMEs are using AI without realising it — your CRM’s lead scoring, your accounting software’s auto-categorisation, your scheduling tool’s route optimisation. Know what’s there. Third, if you supply to government, start building a simple one-page AI register: what tools use AI, what data they access, and who’s accountable for each. That’s the document procurement teams will eventually ask for.

Key takeaways

Not sure where AI already sits in your business?

A 30-minute call is enough to work out whether the new rules affect your business — and what to do about it.