What Australian businesses need to know about AI governance.
Not every guideline is a law, and not every requirement applies to every business. Here is a clear starting point.
What changes in December 2026?
From 10 December 2026, amendments to the Australian Privacy Act introduce additional privacy-policy transparency requirements for certain automated decisions involving personal information. The requirements relate to specified decisions that significantly affect individuals' rights or interests, where applicable statutory conditions are met.
What else matters?
Australian Privacy Principles: existing obligations around personal information can apply when AI systems collect, use or disclose it. Sector requirements: regulated organisations may face additional rules. Voluntary guidance: Australian government responsible AI guidance and guardrails can help shape governance practices even where not legally mandated.
Practical questions for organisations
Where is AI being used? Which tools process personal information? Are consequential decisions made or substantially supported by automation? Can staff explain, review or override decisions? Who is accountable for vendors, incidents and monitoring?
Official resources
For current legal interpretation, consult the relevant official sources and qualified Australian legal advisers:
- Office of the Australian Information Commissioner (OAIC)
- Federal Register of Legislation
- Department of Industry, Science and Resources
- Digital Transformation Agency
Questions Australian businesses ask
Does every Australian business need AI certification by December 2026?
No. The December changes concern specified privacy-policy disclosures for certain automated decisions; they do not create a universal AI certification requirement.
What does an AI governance assessment cover?
Typically an AI inventory, data handling, privacy and security risks, decision oversight, supplier controls, accountability and monitoring.
Is ISO/IEC 42001 mandatory in Australia?
Not generally. It is an international AI management system standard that can support good governance; applicable laws and contractual requirements must be considered separately.
Can we use AI tools that process customer information?
That depends on the data, the tool, the intended use, contracts, privacy obligations and security safeguards. Review these before deployment.
Can Govern AI Aussie certify legal compliance?
No. Our assessments are advisory and technical; where legal opinions or specialist certification are needed, qualified independent professionals should be engaged.