Does Australia have an AI law? Where AI regulation actually stands in 2026

Here is the clear version. As of 2026, Australia has no standalone AI Act and no mandatory AI-specific guardrails. That is a deliberate choice, not a gap waiting to be filled. And it does not mean AI is unregulated - it means the rules come from laws you already have to follow.

One note before we go further: this is general information, not legal advice. Where it touches your specific situation, confirm your position with a qualified privacy or commercial lawyer.

There is no “AI Act” - and that was the decision

On 2 December 2025, the Department of Industry, Science and Resources launched the National AI Plan. The most important thing it did was abandon a set of ten mandatory guardrails for high-risk AI that had been proposed back in September 2024.

Instead of writing new AI-specific law, the government chose to apply Australia’s existing, technology-neutral laws to AI. Its stated view is that those laws are “fit for purpose”. The shift was influenced by the Productivity Commission, which pointed to a large economy-wide opportunity from AI and urged pausing new AI-specific rules rather than rushing them.

So when someone asks “does Australia have an AI law?”, the honest answer is no - there is no single statute to point to. But that is the start of the story, not the end of it.

Your obligations come from laws you already have

The laws that govern your use of AI are the same ones that already govern your business. AI does not get its own carve-out, and it does not get a free pass. In practice, the relevant regimes are:

• Privacy. The Privacy Act 1988 (Cth) and the Australian Privacy Principles govern how you collect, use and disclose personal information - including when you feed it into an AI tool.
• Consumer law. The Australian Consumer Law still prohibits misleading or deceptive conduct. An AI-generated claim, quote or chatbot answer that misleads a customer is your problem, not the model’s.
• Anti-discrimination. If an AI tool produces biased outcomes in hiring, lending or service, anti-discrimination law applies as it always has.
• Work health and safety. WHS duties extend to how AI is deployed in your workplace.
• Intellectual property. Copyright and related rights still bind what you can ingest, train on and reproduce.

Enforcement sits with the regulators you already know: the Office of the Australian Information Commissioner (OAIC) for privacy, the ACCC for consumer law, eSafety for online safety, and ASIC in financial services. There is no new “AI regulator” that approves your tools before you use them.

What the AI Safety Institute is - and what it is not

This is where a lot of the confusion comes from, so it is worth being precise.

The Australian AI Safety Institute was announced on 25 November 2025 with $29.9 million in funding, sitting within the Department of Industry and working alongside the National AI Centre. It became operational in early 2026, and an Australia-UK AI safety partnership was announced on 25 May 2026.

Here is the part that matters for an SMB: the AI Safety Institute is advisory, not a regulator. It monitors and assesses AI risk, advises government, and can recommend changes to the law. It does not enforce anything, and it does not approve anything. You do not report to it, and you do not seek its sign-off before deploying a tool. If anyone tells you that you need “AI Safety Institute approval”, they have misunderstood what it does.

Copyright: no free pass for training data

A common assumption is that AI somehow loosened copyright. It did not. On 26 October 2025, the Attorney-General confirmed the government will not introduce a text-and-data-mining exception to the Copyright Act, rejecting a Productivity Commission proposal, and stated there are “no plans to weaken copyright protections”. A consultation on licensing for AI training continues through the Copyright and AI Reference Group (CAIRG), but the position today is straightforward: do not assume you can freely ingest or train on copyrighted material without a licence.

The one concrete near-term obligation

If you take one date away from this article, make it 10 December 2026.

That is when the Privacy Act’s automated decision-making transparency obligation commences. In short, if your business uses a computer program to make - or to substantially shape - decisions that significantly affect people, and personal information is involved, your privacy policy will need to disclose it. This is the closest thing to a concrete, AI-adjacent rule on the books, and plenty of SMBs are caught by it. We have written a full deadline-driven playbook on it in our piece on the Privacy Act’s automated-decision rules.

What is likely coming

The picture is not frozen. In February 2026 Senate Estimates, the Attorney-General confirmed a second tranche of Privacy Act reforms is being progressed. Expected measures include a “fair and reasonable” test for handling personal information, stronger protections for children (a Children’s Online Privacy Code is being developed), and possibly a direct right of action. As at June 2026 there is no Bill and no firm date, so this is a watch-list item rather than something to act on today.

The practical takeaway

The trap is waiting for an “AI Act” to tell you what to do. It is not coming in the form most people expect, and in the meantime the rules already apply. Privacy, consumer law, anti-discrimination, WHS and copyright bind your use of AI right now, and the December 2026 ADM obligation has a hard date attached.

That is genuinely good news for an operator who wants to move. You do not need to decode a new regime. You need to know where AI touches personal information and decisions in your business, run it against the laws that already exist, and keep oversight that is real.

To say it once more: this is general information, not legal advice. Confirm your specific obligations with a qualified privacy lawyer.

Where this fits

Working out which existing rules apply to your particular use of AI - and getting your governance, vendor checks and policies in order before December 2026 - is exactly what XLev’s consulting and AI governance work is built for. If the mixed messages have left you unsure where you actually stand, that is the place to start: a clear-eyed read of your obligations and a plan you can act on now, without waiting for a law that is not coming.