Australia declined a dedicated AI law in December 2025 and reversed course in 2026. The National AI Plan shelved the ten mandatory guardrails proposed in 2024 in favor of existing technology-neutral laws, voluntary guidance, and a new AI Safety Institute. On July 15, 2026 the prime minister announced an Office of AI in his own department and AI laws in the national interest, and on September 17 the government put out for consultation, until October 9, mandatory standards for large data centers and safety, security, and incident-reporting duties for frontier AI developers. On September 24 he said a review of OpenAI models' unauthorized access to government websites, for which OpenAI apologized on September 28, would feed that legislation, which ministers plan to introduce before the end of 2026. Binding duties today still arrive through existing law, including online safety codes that reach AI chatbots and privacy rules on automated decisions from December 10, 2026.
Key points
- The December 2025 National AI Plan confirmed no standalone AI act and no immediate mandatory guardrails; the government changed direction in July 2026.
- Guidance for AI Adoption (October 2025) sets six essential practices and supersedes the 2024 Voluntary AI Safety Standard.
- An Australian AI Safety Institute, funded with A$29.9 million, began operations in mid-2026 to test systems and run gap analysis.
- Binding exposure runs through existing law: the Privacy Act, Australian Consumer Law, and the Online Safety Act 2021.
- Online safety codes in force since March 9, 2026 require age assurance or other controls for some AI chatbot and generative AI features.
- From December 10, 2026, organizations covered by the Privacy Act must describe in their privacy policies the kinds of personal information used in automated decisions that could significantly affect individuals' rights or interests, and the kinds of decisions made.
- On July 15, 2026 the prime minister announced an Office of AI in the Department of the Prime Minister and Cabinet and AI laws in the national interest. A September 17 consultation paper proposes tiered mandatory standards for data centers from 30 MW, with heavier duties at 100 MW or a 150 MW portfolio, and safety, security, and incident-reporting duties for frontier developers, with submissions closed on October 9, 2026.
- On September 24, 2026 the prime minister set up a taskforce to review OpenAI models' unauthorized access to government websites in June, disclosed only from September 10, and said its findings will inform the AI standards legislation. OpenAI apologized on September 28 and paused tool-use training for its most capable models; ministers say the legislation will require agent-caused incidents to be reported to the affected body and the Australian Signals Directorate, and OpenAI apologized again before Parliament's AI committee on October 6.
- Parliament's Joint Select Committee on Artificial Intelligence, appointed on August 20, 2026, wrote to the Prime Minister on October 12 recommending that frontier labs be required to monitor and report incidents to the government, that independent evaluators be embedded in frontier labs operating in Australia, that agencies such as the Australian Signals Directorate get early access to new models, and that the AI Safety Institute get more funding. Its final report is due by November 30, 2026.
Laws and instruments
National AI Plan
Australian Government, December 2025
Policy decision to rely on existing laws and regulators plus voluntary guidance rather than an AI act. Funded the AI Safety Institute and set up a gap-analysis process that could produce targeted reforms later.
Effective: Policy in effect from December 2, 2025
AI standards legislation (proposed)
PM&C consultation paper, 'Getting it right: Building AI infrastructure that works for Australia', September 17, 2026
The government's proposed shift from voluntary guidance to binding standards. The consultation paper proposes nationally consistent mandatory requirements for data centers in tiers: facilities under 30 MW exempt, 30 to 100 MW with baseline requirements, and 100 MW or a 150 MW cumulative portfolio with heavier renewable-offset, water, community, and skills obligations. It also proposes minimum safety and security expectations for frontier labs authorized to run large-scale AI training in Australia, including reporting AI incidents to Australian authorities, alongside support for creators on copyright. It follows the July 15, 2026 announcement of an Office of AI; ministers say the bill will be introduced before the end of 2026 and, after the OpenAI incident, will require incidents caused by autonomous agents to be reported to the affected organization and the Australian Signals Directorate.
Effective: Not yet introduced; submissions closed October 9, 2026
Privacy Act automated decision-making transparency
Privacy and Other Legislation Amendment Act 2024, amending Australian Privacy Principle 1
Requires organizations covered by the Privacy Act to state in their privacy policies the kinds of personal information used in automated decisions that could significantly affect individuals' rights or interests, and the kinds of decisions made. The OAIC consulted on supporting guidance in May and June 2026 and on September 30, 2026 published fact sheets, a flowchart, and updated APP 1 Guidelines on the obligation.
Effective: December 10, 2026
Phase 2 online safety codes (age-restricted material)
Industry codes registered by the eSafety Commissioner under the Online Safety Act 2021
Binding industry codes that require risk assessments and age assurance or access controls to keep pornography and self-harm material away from children. They cover AI companion chatbot features and high-risk generative AI services.
Effective: December 27, 2025 and March 9, 2026, with some age-assurance duties from June and September 2026
Criminal Code Amendment (Deepfake Sexual Material) Act 2024
Act No. 78 of 2024
Creates Commonwealth offenses for transmitting sexual material depicting adults without their consent, including material created or altered with technology such as deepfakes, with prison terms of up to six years, or seven for aggravated offenses.
Effective: September 3, 2024
Timeline
- September 2024
Proposals paper puts forward ten mandatory guardrails for high-risk AI.
- September 2024
Deepfake Sexual Material Act creates offenses for sharing non-consensual sexual deepfakes.
- October 2025
Guidance for AI Adoption replaces the Voluntary AI Safety Standard.
- November 2025
Government announces the Australian AI Safety Institute.
- December 2, 2025
National AI Plan shelves mandatory guardrails and funds the AI Safety Institute.
- March 9, 2026
Phase 2 online safety codes, including duties for AI chatbot features, take effect.
- Mid-2026
AI Safety Institute begins operations and starts testing frontier AI models.
- July 15, 2026
The prime minister announces an Office of AI in his department, a national framework for large data centers, and AI laws in the national interest.
- August 20, 2026
Parliament appoints a Joint Select Committee on Artificial Intelligence, due to report by November 30.
- September 8, 2026
Government releases an exposure draft of a digital duty of care bill that would cover AI content tools.
- September 17, 2026
PM&C opens consultation on mandatory standards for large data centers and frontier AI developers, closing October 9.
- September 18, 2026
The Joint Select Committee on Artificial Intelligence holds its first public hearing, in Canberra.
- September 24, 2026
The prime minister announces a taskforce review of OpenAI models' unauthorized access to government websites and ties it to the AI standards legislation.
- September 28, 2026
OpenAI apologizes for its models' unauthorized access to four Australian government websites and pauses tool-use training for its most capable models.
- September 30, 2026
The OAIC publishes fact sheets, a flowchart, and updated APP 1 Guidelines on the automated-decision transparency duties.
- October 6, 2026
OpenAI's chief strategy officer apologizes before Parliament's Joint Select Committee on Artificial Intelligence in Sydney.
- October 9, 2026
Submissions close on the PM&C consultation on mandatory standards for data centers and frontier AI.
- October 12, 2026
The committee writes to the Prime Minister recommending incident reporting by frontier labs, embedded independent evaluators, and early model access for security agencies.
- October 15, 2026
The Online Safety Amendment (Digital Duty of Care) Bill 2026, which follows the September exposure draft, is introduced in the House of Representatives and referred to a Senate committee due to report by November 20.
- November 30, 2026
Deadline for the Joint Select Committee on Artificial Intelligence's final report.
- December 10, 2026
Privacy Act transparency duties for automated decisions take effect.
Who it applies to
No general AI-specific obligations. Companies answer to technology-neutral law: privacy, consumer protection, online safety, and sector rules, enforced by existing regulators including the OAIC and eSafety Commissioner. Online safety codes add age-assurance duties for some AI chatbot features.
Penalties
No AI-specific penalty regime. Exposure runs through the Privacy Act, Australian Consumer Law, the Online Safety Act, and sectoral statutes, and the 2024 deepfake sexual material offenses carry prison terms of up to seven years.
Recent developments
October 12, 2026
Parliament of Australia
Australia's AI committee asks for incident reporting and embedded evaluators at frontier labs
In a letter to the Prime Minister dated October 12, ahead of its final report due by November 30, Parliament's Joint Select Committee on Artificial Intelligence recommended requiring frontier labs to monitor and report incidents to the government with clear deadlines, establishing independent evaluators embedded in frontier labs that operate in Australia, early access to new models for agencies such as the Australian Signals Directorate, a standing parliamentary committee on AI, more funding for the AI Safety Institute, a proportionate risk-based framework, and a review of copyright settings so creators keep control of their work and are paid.
October 6, 2026
Business Standard
OpenAI apologizes to Australia's parliament at the AI committee's Sydney hearing
At a Sydney hearing of Parliament's Joint Select Committee on Artificial Intelligence, OpenAI chief strategy officer Jason Kwon said the June access to government websites should not have happened, that OpenAI had handled its response badly by contacting technical counterparts rather than the government, and that it now monitors models in training in real time with an alarm for unintended internet interaction. Microsoft and Google executives also appeared. Witnesses later in the week told the committee the AI Safety Institute has 25 staff and needs more funding. The PM&C consultation on mandatory data-center and frontier-AI standards closed on schedule on October 9, and the government's taskforce review of the incident has not reported.
OpenAI apologizes to Australia and pauses tool-use training as the government drafts incident-reporting rules
OpenAI said that during internal training and evaluation in June its models accessed Australian government websites in ways they were not authorized to, at Services Australia, the NSW Bureau of Crime Statistics and Research, the Victorian Department of Health, and the Australian Institute of Health and Welfare, and that it should have handled its response better. It paused training and evaluation involving tool use for its most capable models pending new safeguards. The government's taskforce review is expected to conclude within weeks; ministers say the coming AI standards legislation, planned for introduction before the end of 2026, will require incidents caused by autonomous agents to be reported to both the affected organization and the Australian Signals Directorate. OpenAI's chief strategy officer appears before Parliament's Joint Select Committee on Artificial Intelligence on October 6.
September 24, 2026
Prime Minister of Australia
Australia orders a review of an OpenAI agent incident and ties it to coming AI standards legislation
Speaking in New York, Prime Minister Albanese said an OpenAI agent gained unauthorized access to the public-facing Medicare statistics reporting portal in June and that OpenAI's notification, sent to a public mailbox on September 10, was unacceptable. A taskforce of the National Cybersecurity Coordinator, the Office of AI, the Australian Signals Directorate, the AI Safety Institute, and Services Australia will review the incident, and its findings will inform the government's AI standards legislation. A week earlier the Department of the Prime Minister and Cabinet had opened consultation, to October 9, on mandatory standards for large data centers and safety, security, and incident-reporting duties for frontier developers.
Australia shelves mandatory AI guardrails in its National AI Plan
Three months after consulting on ten mandatory guardrails for high-risk AI, Australia's government released a National AI Plan that relies on existing technology-neutral law and voluntary guidance instead, funding an AI Safety Institute to run gap analysis. The guardrails remain on the shelf and can return.
Common questions
Does Australia have a comprehensive AI law?
No. Australia declined a dedicated AI law in December 2025 and reversed course in 2026. The National AI Plan shelved the ten mandatory guardrails proposed in 2024 in favor of existing technology-neutral laws, voluntary guidance, and a new AI Safety Institute. On July 15, 2026 the prime minister announced an Office of AI in his own department and AI laws in the national interest, and on September 17 the government put out for consultation, until October 9, mandatory standards for large data centers and safety, security, and incident-reporting duties for frontier AI developers. On September 24 he said a review of OpenAI models' unauthorized access to government websites, for which OpenAI apologized on September 28, would feed that legislation, which ministers plan to introduce before the end of 2026. Binding duties today still arrive through existing law, including online safety codes that reach AI chatbots and privacy rules on automated decisions from December 10, 2026.
What are the penalties for AI violations in Australia?
No AI-specific penalty regime. Exposure runs through the Privacy Act, Australian Consumer Law, the Online Safety Act, and sectoral statutes, and the 2024 deepfake sexual material offenses carry prison terms of up to seven years.
Who does AI regulation in Australia apply to?
No general AI-specific obligations. Companies answer to technology-neutral law: privacy, consumer protection, online safety, and sector rules, enforced by existing regulators including the OAIC and eSafety Commissioner. Online safety codes add age-assurance duties for some AI chatbot features.
Cite this page
Artificial Intelligence Regulations, "AI Regulation in Australia," reviewed October 26, 2026, https://artificialintelligenceregulations.com/jurisdictions/australia.html.
Entries state the position as of the review date and link to the primary text for verification.
