Australia's AI rules in 2026: no AI Act, but one change worth knowing

If you've been waiting to see how Australia would regulate AI before using it in your business, 2026 gave an answer, and it's calmer than the headlines suggested. There's no standalone AI Act. The laws you already follow still apply, and there's one concrete new rule worth a Perth business owner's attention.

What the government decided

In December 2025, the National AI Plan set the direction. Rather than a dedicated AI law with mandatory "guardrails," Australia is relying on the laws it already has (privacy, consumer protection, copyright), backed by sector regulators and a new AI Safety Institute, funded and stood up in early 2026. An earlier proposal for ten mandatory guardrails on high-risk AI was set aside.

In plain terms: for most businesses there's no new licence to get and no AI-specific paperwork. The rules you already meet still apply when AI is part of the work.

The one date to diarise: 10 December 2026

From 10 December 2026, a Privacy Act reform takes effect. If your business is covered by the Privacy Act and you use someone's personal information in an automated or semi-automated decision that could significantly affect them, your privacy policy must say so: what data you use, and the kinds of decisions you make with it.

For most small businesses this is a small, sensible update: a short addition to your privacy policy if you let AI make or heavily shape decisions about people, such as automated approvals, scoring, or screening. Genuine human review, where a person actually makes the call, lowers your exposure. But the rule also covers "semi-automated" decisions, so if AI scores, screens or ranks people in a way that heavily shapes the outcome, you may still need to disclose it. If you're not sure whether you're covered, that's worth a quick check.

What this means in practice

• You don't need to stop using AI. The settled position is "apply existing law sensibly," not "wait and see."
• Be able to explain what your AI does with customer data. If you can't, that's the gap to close, for trust as much as for the rules.
• Keep a person genuinely in the loop on decisions that affect people. It's good practice, and where AI still heavily shapes the outcome, check whether your privacy policy needs to say so.

This isn't legal advice. If AI sits at the centre of how you make decisions about customers, a short chat with someone who knows the Privacy Act, or the Office of the Australian Information Commissioner, is money well spent.

The takeaway for Perth businesses is steady, not alarming: AI is welcome, the existing rules apply, and there's one privacy update to put in the calendar for December. If you're building AI into how you work and want it done in a way you can stand behind, we can help.