Australia Is Writing AI Law After All

On 2 December 2025, the National AI Plan shelved the ten mandatory guardrails the government had proposed a year earlier. No standalone AI Act. No AI-specific statute. Regulation would run through the laws already on the books, backed by an advisory safety institute with no enforcement powers.

A lot of Australian boards read that as permission to wait.

On 15 July 2026, the Prime Minister stood up an Office of AI inside his own department and committed to a set of legislated, mandatory Australian Standards for AI. The framework goes to National Cabinet this month. Legislation is flagged for early 2027.

The reversal is real. But the organisations now scrambling made a category error back in December: they mistook the absence of a new law for the absence of an obligation.

The Office of AI commenced operation on 15 July within the Department of the Prime Minister and Cabinet. Its job is to coordinate AI policy across portfolios — energy, copyright, productivity, education, labour — and to design the standards themselves. The government’s framing is that AI has been handled issue-by-issue and sector-by-sector, and that needs to stop.

Two things are worth reading carefully.

First, “standards” here means mandatory requirements, not voluntary technical specifications. The language deliberately echoes the voluntary guidance that came before it, but the intent is enforceable duties.

Second, the initial scope is narrower than the headline suggests. The first defined subjects are large data centres and the use of Australian creative works to train models. Data centre operators face obligations to underwrite their own power, pay full connection costs, curtail on demand, meet water-efficiency requirements, and avoid competing with housing for land. On copyright, the government reaffirmed there will be no text-and-data-mining exception — Australian creative work is not free training data.

If you are not building a data centre or training a foundation model, very little of the announced detail lands on you directly.

This is the third position the Commonwealth has held in under two years.

September 2024 brought a proposals paper with ten mandatory guardrails for high-risk AI — testing, transparency, accountability, human oversight, conformity assessment. It never became law.

December 2025 reversed it. The National AI Plan chose technology-neutral regulation through existing frameworks, with the National AI Centre’s Guidance for AI Adoption condensing the earlier voluntary standard into six essential practices.

July 2026 reversed it again, upstream. Rather than regulating AI systems in the abstract, the government is placing conditions on the infrastructure and the training inputs that make large-scale AI possible.

Three positions, one constant: at no point did Australian businesses stop being accountable for the decisions their AI makes.

We would be doing you a disservice by overstating this.

There is no exposure draft. No regulator has been named as the enforcement body. Coverage, penalty structure and commencement arrangements are all unresolved. National Cabinet has not yet agreed the approach, and the consultation that follows will involve states, territories, industry, trading partners and copyright owners before anything reaches Parliament.

Anyone selling you a compliance package against the Australian Standards for AI today is selling you something that does not exist.

• Find out where AI is already making decisions in your organisation. Most executives materially underestimate this. Assistants embedded in your CRM, service desk and HR platform are making or shaping decisions that carry legal weight under the Privacy Act, the Australian Consumer Law and directors’ duties — all of which apply today, with no transition period. The ACCC’s active enforcement on AI-washing is a present exposure, not a future one.
• Build against a real standard now. ISO/IEC 42001 and the National AI Centre’s six practices already exist, are already implementable, and map cleanly onto anything a mandatory framework is likely to require. An organisation with a functioning AI management system will adapt to the standards in weeks. An organisation starting from zero in 2027 will not.
• Fix the foundation, not the paperwork. Governance you cannot evidence is not governance. If you cannot say which data an AI system reasoned over, who was entitled to see it, and how the output was produced, you have a documentation exercise rather than a control. That traceability is an architecture property — it comes from a governed data layer, not from a policy document.

The regulatory picture will keep moving. Australia is legislating while the EU defers parts of its AI Act in the other direction, and the final shape of the Australian standards is genuinely unsettled.

None of that is a reason to wait, because the thing that determines whether you are ready was never the legislation. It is whether you know what your AI is doing and can prove it. Organisations that build that capability now will treat the 2027 standards as a mapping exercise. The rest will treat it as a crisis.