National AI Standards Are Coming. Here’s What AU Small Businesses Should Know

On 15 July 2026, Prime Minister Anthony Albanese stood at the University of Sydney and announced that Australia would establish mandatory national AI standards, and create an Office of AI inside the Department of the Prime Minister and Cabinet to write them. Legislation is now being targeted for early 2027.

If someone at your business has said “there are no AI rules in Australia, so we’re fine,” that position has a shelf life of months.

What that means for a small business is still being worked out. But the direction is set, and waiting until the rules are final before preparing is a bet that rarely pays off. Here’s what is actually known right now, and what you can do before the legislation lands.

What’s Being Built, and What Already Exists

Australia’s AI governance picture has layers, and they matter in different ways depending on your business.

The Voluntary AI Safety Standard (VAISS), published by the Department of Industry, Science and Resources (DISR) in September 2024, sets out 10 guardrails for organisations using AI. They cover accountability, transparency, testing, risk management, and data governance. Right now they are voluntary, no law compels you to follow them. But they are written to align with ISO/IEC 42001:2023, the international standard for AI management systems, and with the US NIST AI Risk Management Framework. They are, as one compliance firm put it, “the best available proxy for what a mandatory standard will require.”

The July 2026 announcement changes the frame. The new Office of AI is specifically tasked with designing and legislating a mandatory Australian Standard for AI. National Cabinet considered the approach in August 2026. The timeline points to legislation in early 2027.

What is not yet defined: which organisations will be captured, at what threshold, and whether obligations will fall on AI developers, businesses that deploy AI tools, or both. There is also no confirmed risk-tiering model, it is possible that a café using an AI scheduling tool faces different obligations than a lender using AI for credit decisions, but nobody outside government knows the specifics yet.

The Australian AI Ethics Framework and the earlier National AI Plan 2025 sit underneath all of this. They set the direction without creating enforceable rules. The Ethics Framework’s eight principles, fairness, accountability, transparency, privacy, safety, and others, have shaped every subsequent document, including the guardrails.

Why This Matters to SMBs Right Now

Three areas where the coming standards will touch small businesses directly, even if the law is still a year away.

Government procurement. Commonwealth agencies already face mandatory AI governance requirements, they must designate Accountable Officials, complete AI impact assessments, and publish transparency statements. When those agencies buy from suppliers, they increasingly ask whether the supplier’s AI use meets comparable standards. If you sell to government or want to, this is already a live question in tender processes. The VAISS guardrails are the checklist buyers are using.

Liability under existing law. As Layer3 Labs notes, Australia has no AI Act today, but existing laws already apply, the Privacy Act, Australian Consumer Law, and anti-discrimination legislation all reach AI systems. If your business uses an AI tool that produces a biased outcome, makes a misleading claim, or mishandles personal data, your liability sits under those existing frameworks right now. Documenting how you select and monitor AI tools is not future-proofing. It’s basic legal risk management today.

Customer and partner expectations. Larger businesses and corporate clients are starting to include AI governance clauses in contracts. If your business is a supplier in a larger supply chain, expect to be asked questions about your AI use within the next 12–18 months. Knowing what tools you use and being able to say how you’ve assessed them is a much better position than scrambling when the question arrives.

The ISO 42001 Question

ISO/IEC 42001 is the international standard for AI management systems, the AI equivalent of ISO 27001 for information security. It covers how an organisation governs AI: policies, risk assessments, roles and responsibilities, monitoring, and continuous improvement.

Formal certification is expensive and probably overkill for most small businesses right now. But the standard is worth knowing because the Australian guardrails are built on it, and any Australian mandatory standard is likely to reference it. Organisations that have documented their AI governance against the ISO 42001 framework will have a head start when mandatory requirements arrive, without needing to scramble for the framework itself.

The practical minimum: know what AI tools you use, who is accountable for each one, and what the risk of each tool producing a wrong or harmful output would be for your business. That is the core logic of ISO 42001 in three questions, and you don’t need a certification body to answer them.

What You Can Actually Do Now

These are concrete steps, not the usual “stay informed” advice.

Build an AI tool register. List every AI tool your business uses or plans to use. Include what it does, what data it touches, who approved it, and who is responsible for it if something goes wrong. One spreadsheet. Takes an afternoon. Without it, every other governance step is harder.

Read the 10 guardrails. The DISR Voluntary AI Safety Standard is published and free. Work through each guardrail and mark which ones your business already handles well and which ones you couldn’t answer. That gap list is your compliance work plan when mandatory rules arrive.

Check your contracts. If you use AI tools from vendors, read what their terms say about data use, model training on your data, and liability for errors. Most SMBs have clicked “accept” on terms they haven’t read. This matters more now.

Talk to your industry body. The AI Industry Association of Australia (AIIA) has published guidance and runs member briefings on the regulatory outlook. Standards Australia is directly involved in developing the AS ISO/IEC 42001 adoption. If you are in a regulated sector, finance, health, legal, your peak body is likely producing sector-specific guidance too.

Pick a person. Someone in your business needs to own the AI governance question. Not as a full-time job, just as the person who tracks what’s changing and flags it internally. In a small team, this might be the owner or a senior manager. The alternative is finding out about a new requirement when a client or regulator asks.

The Timeline, as It Stands

As of October 2026, the Office of AI is still in design mode. National Cabinet reviewed the approach in August. Legislation is expected, but not guaranteed, in early 2027. The VAISS guardrails remain voluntary in the meantime.

The EU AI Act, which Australia has been watching closely, provides one model: tiered obligations based on risk level, with the heaviest requirements on high-risk applications and lighter obligations for general business use. Whether Australia follows that structure is not yet confirmed, but it is the framework most likely to influence the final design.

The honest answer is that a lot is still undefined. But the direction is clear: mandatory requirements are coming, they will reference the existing guardrails and ISO 42001, and businesses that have done no preparation will face a compressed runway when the rules are published.

Starting now, even just with a tool register and a read-through of the guardrails, puts you well ahead of the majority of Australian SMBs.

More posts like this: Found on Reddit →

Sources

• PM Anthony Albanese, “AI in Australia’s Interests”, July 2026 announcement (pm.gov.au)
• Office of AI, Department of the Prime Minister and Cabinet (pmc.gov.au)
• Voluntary AI Safety Standard, DISR (industry.gov.au)
• The 10 Guardrails, DISR (industry.gov.au)
• National AI Plan 2025, DISR (industry.gov.au)
• Australia’s AI standards: what the July 2026 reversal means, Compliance Council
• Australia AI Regulation Overview, Regulations.AI
• AI Regulation in Australia: What Businesses Need to Know in 2026, Layer3 Labs
• ISO 42001 AI Management System: 2026 Certification Guide, Mindset Cyber
• ISO/IEC 42001:2023, AI Management Systems Standard (iso.org)
• Reddit r/australia discussion thread

📖 More deep dives: News Deep Dives

📖 More deep dives: News Deep Dives →