Australia’s AI Rules Are Changing (But Probably Not the Way You Think)
A lot of Australian small business owners got the same jolt late last year: “mandatory AI standards are coming.” A few forwarded the articles to their accountants. Some googled whether they needed a compliance consultant. Most filed it under “problems for future me.”
Future me has arrived. So here’s what actually changed, what didn’t, and the one document worth your time before your clients or suppliers start asking questions.
The mandatory proposal that got quietly shelved
In 2024, the Department of Industry floated a set of 10 mandatory guardrails for businesses using “high-risk” AI. That proposal is dead. The government decided it didn’t need a new AI-specific law, the Privacy Act and Australian Consumer Law already cover most of the conduct they were worried about.
This is actually significant. It means if your business uses AI in a way that misleads a customer or mishandles their data, you’re liable under existing law, not some new AI-specific regime. The standard of care is already there. AI just doesn’t give you an exemption from it.
So no, there’s no new mandatory AI compliance obligation for the average Australian small business as of October 2026. The AI Policy Tracker confirms it, and SafeAI Aus tracks the same position.
What did just become mandatory
In August 2026, National Cabinet endorsed mandatory standards for AI infrastructure, data centres, energy use, land, compute. Legislation is committed for early 2027.
This matters if you run a data centre. It probably doesn’t matter if you run a café, a construction firm, an accounting practice, or a consulting business that uses AI tools. As Tech Business News covered, this is aimed at hyperscalers and the physical infrastructure underpinning large-scale AI deployment.
The government also created the Office of AI within the Department of Prime Minister and Cabinet in July 2026, under the “AI in Australia’s Interests” framework. Its focus is infrastructure, strategic capability, and national interest, not small business compliance.
The voluntary standard that actually matters for you
The Voluntary AI Safety Standard (VAISS) was published in September 2024 by the Department of Industry, Science and Resources. It lays out 10 guardrails, things like being transparent about when AI is making decisions, testing for bias, keeping humans in the loop on high-stakes calls, and protecting personal data.
It’s voluntary. No one’s auditing you against it. But two things make it worth taking seriously.
First: the VAISS is designed to be consistent with AS ISO/IEC 42001, the international standard for AI management systems. That standard is what large clients and enterprise procurement teams are starting to reference in contracts. If you want to supply to a government agency, a bank, a listed company, or a large professional services firm in the next two or three years, there’s a reasonable chance their vendor questionnaire will ask whether you have an AI governance framework in place. VAISS gives you one.
Second: if something goes wrong and there’s a dispute, a customer complaint, a regulator inquiry, a civil claim, having followed the VAISS guardrails is the kind of thing that shows you acted in good faith. The government will reference it when assessing conduct. Courts will too, eventually.
You can read the full VAISS on the Department of Industry website. It’s not long. The guardrails section is the bit you want.
The three guardrails most AU small businesses will trip over
Transparency about AI use. If you’re using an AI tool to generate responses, summaries, or recommendations that your customers act on, the VAISS expects you to be upfront about it. Not necessarily with a disclaimer on every email, but your customers should know AI is in the loop when it affects them directly.
Data handling. Many AI tools pass your prompts, and your clients’ information, to overseas servers. That has Privacy Act implications for Australian businesses, particularly if you’re dealing with sensitive data. Before you use any new AI tool with client data, check where the data goes and whether you need a data processing agreement. We’ve covered what to look for on the security side in more detail if you want the specifics.
Human oversight on consequential decisions. If AI is feeding into a decision that materially affects a person, a credit decision, a hiring screen, a medical recommendation, the VAISS expects a human in the loop. For most small businesses, this is less about compliance and more about good practice. Automated decisions at scale are where things go wrong.
One document to read, one action to take
Read the VAISS. Seriously, it’s clearer than most policy documents, and the 10 guardrails are written in plain English.
Then consider putting a basic AI policy on paper for your business. Not because you’re legally required to. Because when a client or a supplier asks how you handle AI, and increasingly, they will, having a written answer is far better than making something up on the spot. We’ve put together an AI policy template for Australian small businesses that’s free to use and covers the main bases.
The mandatory stuff, the data centre rules, the Office of AI, the early 2027 legislation, doesn’t touch most Australian small businesses directly. But the voluntary standard does shape the environment you’re operating in. The businesses that treat it seriously now will have a cleaner answer when enterprise clients start asking the question.
More posts like this: Found on Reddit →
📬 The SmallBizAI Brief
One practical AI tip for Australian small business. Every Tuesday. Free.
Join business owners getting smarter about AI every week.
