AI law in Australia: what businesses need to know

By the ITLAW Team · Last reviewed November 2026 · General information, not legal advice

Is AI regulated in Australia?

Yes, but indirectly. In 2024 the Government consulted on ten mandatory guardrails for AI in high-risk settings. On 2 December 2025 it released the National AI Plan, which paused those guardrails and confirmed that, for now, AI will be regulated through existing laws administered by existing regulators. The Plan also funded an AI Safety Institute to monitor emerging risks and advise the Government and regulators. Voluntary guidance from the National AI Centre sets out recommended practices for businesses adopting AI.

That means the practical question for a business is not “what does the AI law say?” but “which existing laws does this use of AI engage?”

Privacy: the biggest AI risk for most businesses

Entering customer or employee personal information into an AI tool is a use or disclosure under the Privacy Act 1988 (Cth). The OAIC has published guidance on using commercially available AI products and on developing and training generative AI models. Key points include:

• Do not enter personal information, and particularly sensitive information, into publicly available AI tools unless you have assessed the risks and the use is consistent with the purpose of collection.
• Information generated by AI about a person, including inferences and incorrect outputs, can itself be personal information.
• Using personal information to train or fine-tune a model is a separate purpose that may require consent.
• Check where the provider stores and processes data, as overseas disclosure rules (APP 8) may apply.

Automated decisions: new transparency rules from 10 December 2026

From 10 December 2026, if your business uses a computer program to make a decision, or to do something substantially and directly related to making a decision, that could reasonably be expected to significantly affect an individual’s rights or interests, your privacy policy must say so. It must describe the kinds of personal information used in those programs and the kinds of decisions involved.

This is wider than generative AI. Rule-based systems for credit approval, insurance pricing, fraud detection, recruitment screening, tenancy applications and account suspensions can all be caught. Start by listing every system that makes or shapes decisions about individuals.

Consumer law and AI

The Australian Consumer Law applies to AI-powered products and to claims about AI. Overstating what an AI feature can do, or “AI washing” a product, can be misleading or deceptive conduct. Businesses that deploy chatbots should remember they are generally responsible for what their chatbot tells customers about prices, refunds and product features.

Copyright and AI

Australia has no “fair use” doctrine and no exception for text and data mining. In October 2025 the Attorney-General ruled out introducing a text and data mining exception for AI training, and the Government is instead consulting on licensing arrangements. Training AI on copyright material without permission therefore carries real risk. On the output side, works generated by AI with little human input may not attract copyright protection, because Australian copyright generally requires a human author. See our IP online guide.

AI in the workplace

Using AI to recruit, monitor or manage staff engages discrimination law, the Fair Work Act 2009 (Cth), work health and safety duties and, in NSW, the Workplace Surveillance Act 2005. Algorithmic screening that disadvantages applicants based on a protected attribute can be unlawful even if the bias was unintended. See our technology in the workplace guide.

An AI governance checklist

• Keep a register of AI tools in use, who owns each one and what data goes in.
• Adopt an AI use policy for staff covering approved tools and prohibited data.
• Run a privacy impact assessment before deploying AI that uses personal information.
• Review AI vendor contracts for data use, training rights, security, liability caps and indemnities.
• Keep a human in the loop for decisions that significantly affect people.
• Update your privacy policy for automated decision-making before 10 December 2026.

Frequently asked questions

Is there an AI Act in Australia?

No. Unlike the EU, Australia has no AI-specific statute. The National AI Plan released on 2 December 2025 relies on existing technology-neutral laws, supported by an AI Safety Institute.

Can I put customer data into ChatGPT or similar tools?

Only with care. Entering personal information into an AI tool is a use or disclosure under the Privacy Act, so it must be consistent with why you collected it, and overseas disclosure rules may apply. Many businesses prohibit entering personal or confidential information into public AI tools.

What are the automated decision-making rules?

From 10 December 2026, APP entities must explain in their privacy policy when computer programs are used to make, or substantially help make, decisions that could significantly affect individuals.

Who owns content created by AI?

It depends on the tool’s terms and the level of human input. Australian copyright generally requires a human author, so purely machine-generated content may not be protected.

Further reading: National AI Centre guidance · OAIC guidance on AI and privacy