Frameworks · Australia
AI regulators and governance frameworks in Australia
Australia combines Privacy Act obligations on automated decisions with national guidance on AI adoption, government policy and state frameworks. These are the instruments that apply to Australian organisations, with the international standards most of them build on.
Who regulates AI here
- Office of the Australian Information CommissionerRegulates the Privacy Act, including the APP 1.7 to 1.9 rules on automated decisions and the Notifiable Data Breaches scheme.
- Australian Prudential Regulation AuthoritySets operational risk and information security expectations for banks, insurers and super funds, which reach the AI they run.
- Australian Securities and Investments CommissionOversees how financial services and credit licensees govern the AI they use with consumers.
- Digital Transformation AgencySets the policy for the responsible use of AI in Australian Government agencies.
- National AI CentrePublishes the Guidance for AI Adoption and its six essential practices for organisations using AI.
Australia
Australia combines Privacy Act obligations on automated decisions with national guidance on AI adoption, government policy and state frameworks.
LawPrivacy Act ADM transparencyPrivacy Act automated decision-making transparency (APP 1.7 to 1.9)From 10 December 2026 your privacy policy must disclose automated decisions that significantly affect people. What APP 1.7 to 1.9 require and who is caught.Voluntary frameworkAI6 Guidance for AI AdoptionGuidance for AI Adoption (AI6)The Guidance for AI Adoption sets six essential practices for governing AI in Australia. It replaced the Voluntary AI Safety Standard in October 2025.Voluntary frameworkAI Ethics PrinciplesAustralia's AI Ethics PrinciplesAustralia's eight voluntary AI Ethics Principles, published in 2019, are the baseline most Australian AI policy builds on. What they say and where they apply.Public sector policyDTA AI policyPolicy for the responsible use of AI in government (v2.0)Version 2.0 of the DTA policy for the responsible use of AI in government took effect on 15 December 2025. What Commonwealth agencies must do and by when.Public sector policyNSW AIAFNSW AI Assessment Framework (AIAF)The NSW AI Assessment Framework is the mandatory AI risk self-assessment for NSW government agencies, run on the AIAF Platform since 30 September 2026.Regulator guidanceAPRA AI expectationsAPRA letter to industry on artificial intelligenceAPRA's April 2026 letter sets minimum expectations for AI governance, security, suppliers and assurance at banks, insurers and super trustees. What it asks.Regulator guidanceOAIC AI guidanceOAIC guidance on privacy and AIThe OAIC's two AI guides explain how the Privacy Act applies to using commercial AI products and to training generative AI models. What they expect of you.Public sector policyNational AI assurance frameworkNational framework for the assurance of artificial intelligence in governmentAgreed by all Australian governments in June 2024, the national framework sets five cornerstones for assuring government AI against the AI Ethics Principles.Public sector policyQueensland AI governance (FAIRA)Queensland AI governance policy and FAIRAQueensland's AI governance policy requires agencies to govern AI with regard to ISO 38507 and assess it with a FAIRA. Version 2.0.0 took effect August 2026.Public sector policyWA AI Assurance FrameworkWA Government AI Policy and AI Assurance FrameworkWA government entities must complete an AI Assurance Framework self-assessment for any AI or automated decision project. How it works and when it is reviewed.Public sector policyVictorian generative AI guidelineVictorian administrative guideline on the safe and responsible use of generative AIVictoria's administrative guideline sets minimum requirements for generative AI use across the Victorian Public Sector. What it asks of agencies and staff.
International
Standards and frameworks that apply across borders. Most organisations use one of these as the backbone of their AI governance, whatever their jurisdiction.
StandardISO/IEC 42001ISO/IEC 42001:2023 AI management systemsISO/IEC 42001 is the certifiable international standard for an AI management system. What it requires, how Annex A works and how to get ready to certify.StandardISO/IEC 42005ISO/IEC 42005:2025 AI system impact assessmentISO/IEC 42005 is international guidance on assessing how an AI system affects people and society, when to assess, what to record and how it links to 42001.Voluntary frameworkNIST AI RMFNIST AI Risk Management Framework (AI RMF 1.0)The NIST AI RMF is a voluntary framework for managing AI risk through four functions, Govern, Map, Measure and Manage. What it asks and who uses it worldwide.Voluntary frameworkNIST Generative AI ProfileNIST AI RMF Generative AI Profile (NIST AI 600-1)NIST AI 600-1 applies the AI Risk Management Framework to generative AI. Its 12 risks, the suggested actions behind them and who uses the profile and why.StandardISO/IEC 23894ISO/IEC 23894:2023 Guidance on AI risk managementISO/IEC 23894 adapts the ISO 31000 risk process to AI. What the guidance covers, its AI risk sources and lifecycle mapping, and how it fits with ISO 42001.StandardISO/IEC 38507ISO/IEC 38507:2022 Governance implications of the use of AI by organizationsISO/IEC 38507 is guidance for boards on governing an organisation's use of AI. What it asks of directors, how it links to ISO/IEC 38500 and who uses it.Voluntary frameworkOECD AI PrinciplesOECD Recommendation of the Council on Artificial Intelligence (OECD AI Principles)The OECD AI Principles are the intergovernmental standard for trustworthy AI, adopted 2019 and revised 2024. The five principles and how to apply them.Voluntary frameworkHUDERIAHUDERIA: Risk and impact assessment of AI systems for human rights, democracy and the rule of lawHUDERIA is the Council of Europe's method for assessing AI risks to human rights, democracy and the rule of law. Its four elements, scoring and who uses it.LawCouncil of Europe AI ConventionCouncil of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225)The Council of Europe AI Convention is the first binding international treaty on AI. Who has signed and ratified, what it asks of parties and when it applies.Voluntary frameworkG7 Hiroshima Code of ConductHiroshima Process International Code of Conduct for Organizations Developing Advanced AI SystemsThe G7 Hiroshima Code of Conduct sets 11 voluntary actions for advanced AI developers, with OECD HAIP reporting. What it asks and who reports under HAIP 2.0.Voluntary frameworkUNESCO AI Ethics RecommendationUNESCO Recommendation on the Ethics of Artificial IntelligenceUNESCO's Recommendation on the Ethics of AI is the global standard its member states adopted in 2021. Its values, principles and Ethical Impact Assessment.
Questions
Does Australia have an AI law?
Not a standalone one. Australian organisations govern AI under existing law, most directly the Privacy Act, whose APP 1.7 to 1.9 rules on automated decisions apply from 10 December 2026, alongside national guidance and government policy.
What replaced the Voluntary AI Safety Standard?
The National AI Centre's Guidance for AI Adoption, known as AI6, which sets out six essential practices for organisations using AI.
Do the NSW AI Assessment Framework and the DTA policy apply to private companies?
No. They apply to NSW Government agencies and Australian Government agencies respectively. Suppliers to those agencies often meet them through contract terms.
Start with the AI you run.
Every framework begins with knowing which AI systems and agents you have. The AI register is free to start.