Australia's new national AI standards: what they mean for your business
Updated: Oct 24
For the past several years, Australia's approach to AI regulation could be summed up in a single word: voluntary. There were principles, guardrails and adoption guides, all sensible and all optional. Most businesses read the headlines, nodded, and got on with using whatever AI tools helped them work faster.
That changed on Wednesday. The government has announced it will legislate mandatory national AI standards, and while the fine print is months away, the direction of travel is now settled. If your business uses AI anywhere near your customers, you'll need to understand what has been announced and what sensible preparation looks like.
What did the Prime Minister announce?
In a keynote speech in Sydney titled "AI in Australia's interests", the Prime Minister set out a significant change of direction. Three elements matter most for business:
Mandatory Australian AI Standards. A single, nationally consistent framework covering the economic, social, national security and environmental dimensions of AI, rather than a patchwork of state-by-state rules.
A new Office of AI. Established immediately within the Department of the Prime Minister and Cabinet to coordinate the design of the standards across government.
A firm line on copyright. The government continues to rule out a text and data mining exemption, and the Prime Minister said Australian creative works should not be used to train AI without their creators' control, including over price.
The standards will also carry specific obligations for large AI data centres, including underwriting new power supply, paying for grid connections and water infrastructure, and minimising water use. Those rules are aimed at infrastructure operators rather than the businesses using AI tools, but they signal how detailed the eventual standards are likely to be.
How is this different from what came before?
Until now, Australia's guidance has been voluntary: the AI Ethics Principles in 2019, the Voluntary AI Safety Standard in 2024, and the National AI Centre's Guidance for AI Adoption in October 2025. As recently as August 2025, the Productivity Commission's interim report recommended against mandatory guardrails, favouring existing technology-neutral laws instead. This week's announcement reverses that direction.
The question is no longer whether AI will be regulated in Australia. It's how, and how soon.
When will the new AI rules apply?
Not yet. The announced timeline is National Cabinet consideration in August and legislation introduced early next year. The specific obligations that will apply to everyday businesses using AI have not been published, so anyone telling you precisely what you'll need to comply with is, at this stage, guessing.
One date is already fixed. Privacy reforms passed in 2024 mean that from 10 December 2026, organisations covered by the Privacy Act must disclose in their privacy policy the kinds of personal information used, and the kinds of decisions made, when a computer program makes or substantially assists decisions that could significantly affect an individual. That obligation exists regardless of what the new standards eventually say.
What does this mean for businesses that use AI rather than build it?
Most of our clients don't build AI. They use it to draft documents, answer enquiries, write marketing copy, schedule jobs and sort applications. In our view, regulation appears to be focussed on where AI touches decisions about people and where customers could be misled, so that's where to look first.
Finance: ASIC has been clear that licensees remain fully responsible for AI-assisted advice and services, and that the best interests duty applies regardless of how automated the process is. Its review of AI use by licensees, *Beware the gap* (Report 798), found adoption running ahead of governance. If you use AI to draft Statements of Advice or triage clients, document how a qualified person reviews the output.
Property: tenant screening, applicant ranking and automated valuations are the kinds of decisions that can significantly affect an individual, which brings the 10 December privacy disclosure into play. AI-written listing copy also remains subject to the Australian Consumer Law, so every claim still needs to be accurate.
Wineries: most winery AI use (cellar door chatbots, product descriptions, marketing) is lower risk, but consumer law still applies to what those tools say on your behalf. Tasting notes and claims about awards, origin or production methods need the same accuracy whether a person or a program wrote them.
Trades: an AI-generated quote, scope or warranty explanation is still your quote, scope and warranty. If a tool drafts it, someone qualified should check it before it reaches the customer.
What about your website content and AI standards?
The government's copyright position is about whether creative works can be used to train AI models without permission, and the detail of how that will work has not yet been released. We need to separate two things that often get blurred together: content used to train a model, and content an AI tool retrieves and cites when it answers someone's search.
For most businesses, the second is the one that matters commercially. When a customer asks an AI tool which accountant, agent, winery or electrician to call, you want your website to be among the sources it reads and names. The policy debate is largely about the first.
What should Australian businesses do now?
The good news is that the preparation is neither complicated nor expensive, and the National AI Centre's existing Guidance for AI Adoption already points the way:
List every AI tool your business uses, including AI features built into software you already pay for, such as your CRM, accounting package or booking system.
Name one person responsible for how AI is used across the business.
Write a short AI policy covering what staff can use, what information they can enter, and when output must be checked by a person.
Identify where AI touches decisions about customers, and review your privacy policy well before 10 December.
Make sure a qualified person reviews AI output before it reaches a customer, particularly for advice, quotes and listings.
If the standards land as expected, businesses that have done this will be well ahead. If they land differently, you'll still have better control of a technology most businesses adopted faster than they planned for.
Regulation usually arrives after a technology has already changed how business works, and AI is following the same pattern. The businesses that come through these transitions comfortably are rarely the ones that waited for the final rules. They're the ones that understood what they were already doing and tidied it up early.
If you'd like a second opinion on how AI is being used across your marketing and website content, and whether it's helping or quietly creating risk, we're always happy to talk it through.
FREQUENTLY ASKED QUESTIONS
Is there an AI law in Australia right now?
Not a standalone one. As of July 2026, Australia has no dedicated AI Act, and AI use is governed by existing technology-neutral laws such as the Privacy Act, the Australian Consumer Law and sector rules like financial services obligations. On 15 July 2026, the government announced it will legislate mandatory national AI Standards, with legislation expected to be introduced early in 2027.
Can I still use ChatGPT and other AI tools in my business?
Yes. Nothing announced in July 2026 restricts businesses from using AI tools. Existing obligations still apply, so anything you publish or send must be accurate and not misleading, personal information must be handled in line with privacy law, and licensed professionals remain responsible for their advice. A short internal AI policy covering what staff may enter into these tools is a sensible precaution.
When do Australia's new AI standards start?
No start date has been announced. The Prime Minister will seek agreement on the standards at National Cabinet in August 2026, and legislation is expected to be introduced early in 2027. Obligations would apply only once that legislation passes. Separately, a Privacy Act requirement to disclose automated decision-making in privacy policies starts on 10 December 2026.
Will the AI standards apply to small businesses?
That isn't known yet, because the detailed obligations haven't been published. The July 2026 announcement focused on the national framework, copyright and data centres. Existing laws already apply to small businesses that use AI, including consumer law. The 10 December 2026 privacy disclosure applies to organisations covered by the Privacy Act, which generally means businesses with annual turnover above $3 million plus some smaller businesses, such as health service providers.
What is the Office of AI?
The Office of AI is a new unit within the Department of the Prime Minister and Cabinet, established on 15 July 2026. Its role is to coordinate the design of Australia's mandatory AI Standards, bringing together the work of different government agencies into a single, whole-of-government approach.
