AI regulation in Australia: what changed in July 2026

TL;DR: Australia has no AI Act yet. On 15 July 2026 the government announced Australian Standards for AI, opened an Office of AI and aimed to legislate early in 2027. Large data centres get rules first. Privacy and consumer law already apply to your AI today, so start with a register, a data map and a named owner for every AI system.

Australia still has no AI Act. But on 15 July 2026 the rules started to move.

The Prime Minister announced a set of Australian Standards for AI. An Office of AI opened the same day. And the government wants the standards in law early next year.

So what does that mean if you build or buy AI software? Less than the headlines suggest for this year. A lot more for next year. And the laws that bite today were already here.

What changed on 15 July 2026

The Prime Minister's media release set out four things.

• Australian Standards for AI. They build on the existing Data Centre Expectations. The government says they'll be the first of their kind legislated anywhere.
• Rules for large data centres come first. They must underwrite their own new power supply and pay their full share of grid connection costs. They must cut power when the grid needs it, and use as little water as they can.
• An Office of AI. It sits inside the Department of the Prime Minister and Cabinet. Its job is to turn the standards into something that works across the country.
• Protection for creators. No company should train AI on Australian creative work without the artist's control.

National Cabinet was due to consider the plan in August. The government expects the standards to be legislated early in 2027. It also said it would set out its AI consumer safety priorities in the weeks after.

What's still not decided

Here's the thing. The first mandatory rules are about power, water and where data centres get built. That's measurable, so it's the easy part to write down.

The hard part is still open. How big does a business have to be before the rules apply? What are the penalties? Does anything beyond data centres get caught in the first bill?

Nobody outside government has those answers yet. So treat July 2026 as the direction of travel, not the finished rulebook.

The laws that already apply to your AI

This is the bit most people miss. Australian law is mostly tech-neutral. It cares about what happened, not whether a person or a model did it.

The National AI Centre keeps a plain list of how existing Australian law applies to AI. The big ones:

• Privacy law. The Privacy Act and the Australian Privacy Principles cover any personal data going into or coming out of an AI system. New rules for some automated decisions start on 10 December 2026.
• Consumer law. If your AI gives misleading output, that can be misleading conduct. Same goes for overselling what your AI can do, or staying quiet about when AI is being used.
• Work health and safety. A business can't shift the blame to the AI. If an AI tool creates risk for workers, it's still on you.
• Directors' duties and negligence. Poor security or sloppy risk checks on an AI system can land here too.

The OAIC's guidance on commercial AI products is blunt. Privacy duties apply to what you put into an AI tool and to what comes out. Its advice is to keep personal and sensitive information out of public AI chatbots.

If you want the detail on stripping personal data before it hits a model, our guide to PII redaction walks through it.

What government agencies already have to do

Commonwealth agencies are ahead of everyone else. The Policy for the responsible use of AI in government is now on version 2.0, and its core requirements are mandatory.

Agencies must have:

• an accountable official for AI
• a public AI transparency statement
• an internal register of AI use cases
• someone accountable for each use case
• staff training on AI
• an impact assessment for AI use cases

Why should a private business care? Because agencies buy software. If you sell AI into government, expect those questions to show up in the tender. Buyers who have to keep registers and named owners tend to ask their suppliers for the same.

Who does what now

The AI Safety Institute doesn't write the rules. It watches emerging risks and feeds advice to the regulators who do. Its findings are a decent early signal of where attention lands next.

The National AI Centre is the one to read today. It published the Guidance for AI Adoption in October 2025. It boils responsible AI down to 6 essential practices. It's an updated, simpler take on the older Voluntary AI Safety Standard.

How this compares to the EU

The EU went the other way. Its AI Act sorts every AI system into risk tiers and puts the heaviest rules on high-risk uses like hiring and credit.

Australia is starting narrow. Data centres first, where the rules are easy to measure. Broader AI rules come later, if the 2027 bill widens the scope.

If you sell AI into Europe, the EU rules can reach you wherever you're based. Here's what the EU AI Act means for Australian businesses, with a short audit you can run.

Data that leaves Australia

AI tools often send data offshore. Training, fine-tuning and every single prompt can run on servers in other countries.

That matters. Australian Privacy Principle 8 covers sending personal information overseas, and it doesn't care that the thing on the other end is a model.

So ask your AI vendor three things. Where does the processing happen? Is our data used for training? What happens to it after the call?

The July standards also bring the Federal Government into where large data centres get built. Watch that space. If data location is a deal-breaker for you, it's one of the reasons to build custom rather than rent a tool.

Creators and training data

The creator promise is short on detail. It could end up as licensing, payment, opt-outs or a mix. The government hasn't said which.

What's clear is the direction. If your AI trains on content you didn't make, expect to be asked where it came from and whether you had the right to use it. The publication ethics and IP questions around AI content are worth reading before that bill lands.

What to do this quarter

You don't need to wait for 2027. Most of this is cheap to set up now and painful to bolt on later.

1. List every AI system you run. What it does, what data it touches, and one named owner.
2. Run a quick impact check on anything that makes or shapes decisions about people. Start with the 6 practices in the Guidance for AI Adoption.
3. Map your data flows. Know what personal data goes in, where it's processed, and what comes out.
4. Put a person in the loop for any call with real impact on someone. Our guide to human in the loop covers where to draw that line.
5. Log and monitor. Record what the system decided and watch for model drift so you can show what happened when someone asks.
6. Fix your supplier contracts. Add clauses on testing, data sources and incident notice. This guide to vendor due diligence is a handy starting point.
7. Write it down. A short internal AI policy beats a long one nobody reads. Here's a practical take on AI policy development.

If you're starting from scratch, our AI software compliance guide covers the build-side checklist, and data governance for AI covers who owns the data.

Don't wait for the 2027 bill. The laws that bite right now are privacy and consumer law, and they already apply. Know where your data goes, log what your AI decides, and put a name next to every AI feature. That's most of the work. Doing it on day one costs far less than retrofitting it the week before a tender.

*James*

Where Devwiz fits

We build AI platforms, and we build the controls in from the first sprint. Registers, logging, data maps and human sign-off go into the same build as the product, not a clean-up job after launch.

Devwiz has shipped 200+ apps, including work for NSW Government (Justice and Corrective Services), Briometrix, Vivid and Huskee.

Scoping an AI build that has to survive a tender as well as a demo? Start with AI app development, or see how we turn a program into an AI platform. Worth a chat.

Frequently asked questions

Is there legislation to regulate AI in Australia?

Not a standalone AI Act yet. On 15 July 2026 the government announced Australian Standards for AI and expects to legislate them early in 2027. Existing laws like the Privacy Act and the Australian Consumer Law already apply to AI today.

What are the Australian Standards for AI?

A framework announced on 15 July 2026, with the new Office of AI driving it. The first rules target large data centres: their power supply, grid costs, water use and where they get built. The announcement also promised protection for Australian creators whose work trains AI.

How is AI regulated in Australia right now?

Through existing tech-neutral laws, like privacy, consumer law, work health and safety, and directors' duties. Commonwealth agencies also follow a mandatory AI policy. For everyone else, the National AI Centre's Guidance for AI Adoption is the best place to start.

When do the new automated decision rules start?

Privacy Act rules for some automated decisions start on 10 December 2026. If your system makes or shapes decisions about people, check how they affect you now.

Does the EU AI Act apply to Australian businesses?

It can. If you offer AI systems into the EU, the EU rules can reach you wherever you're based. Map each market you sell into separately.