Australian Government AI Policy Roundup: OAIC, DISR, ASIC and ACSC Guidance in One Place

If your business uses AI tools and you want to know what Australian government agencies actually say about it, you'd need to hunt across five or six different websites to find out. That's time most small business owners don't have. This page pulls the key guidance from every major Australian government body into one place, explains what each one means in plain English, and links directly to the primary source.

You're not alone if you've heard terms like "OAIC" or "Responsible AI" and weren't sure which agency said what or whether any of it actually applies to a business your size. The short answer is: some of it does, some of it is voluntary, and knowing the difference matters. This page is your reference for all of it.

Why there are so many agencies and what each one covers

Australia's AI governance sits across multiple agencies because there is no dedicated AI regulator yet. Instead, existing regulators are applying their existing frameworks to AI. The Office of the Australian Information Commissioner handles privacy. The Department of Industry, Science and Resources handles the broader responsible AI framework for government and industry. ASIC handles financial services. The Australian Cyber Security Centre handles cyber risk.

For a small business, the practical consequence is that the guidance most likely to affect you depends on what your business does and what data your AI tools handle. An accounting firm faces OAIC and possibly ASIC considerations. A retailer faces OAIC considerations. Any business using AI to process personal information faces OAIC guidance regardless of industry.

OAIC: Privacy and AI guidance

The Office of the Australian Information Commissioner is the regulator most businesses using AI tools need to understand first. The OAIC enforces the Privacy Act 1988 and the Australian Privacy Principles (APPs), and AI tools that handle personal information about customers, employees, or clients fall squarely within their scope.

The OAIC has published guidance specifically addressing how organisations should think about AI and privacy. The core message is that using an AI tool does not change your obligations under the Privacy Act. If a tool processes personal information, the rules around collection, use, disclosure, and security still apply. The fact that a third-party AI vendor is handling the processing does not transfer your legal responsibility as the business.

Particularly relevant for businesses using cloud-based AI tools (which send data to overseas servers) is APP 8, which governs cross-border disclosure of personal information. Before sending customer or employee data to an AI tool hosted offshore, you need to take reasonable steps to ensure the overseas recipient handles it in a way consistent with the APPs. This is not optional.

The OAIC has also flagged automated decision-making (ADM) as a focus area. If your business uses AI to make or substantially assist decisions that affect individuals (loan applications, insurance, hiring, medical recommendations), you need to be aware that the OAIC is looking at whether these processes are transparent and whether individuals have recourse.

Primary source: oaic.gov.au/privacy/artificial-intelligence

For a full breakdown of what the OAIC's AI guidance means for your business, see our dedicated guide: OAIC AI Guidance: What Australian Businesses Need to Know. For a practical checklist, see: OAIC AI Compliance Checklist for Australian SMBs.

DISR: Australia's AI Ethics Principles

The Department of Industry, Science and Resources (DISR) published Australia's AI Ethics Principles as part of the national AI policy response, sometimes referred to informally as a responsible AI framework. The principles set out voluntary guidance for how organisations should develop and use AI responsibly. They are not law, but are increasingly referenced in government procurement and are a useful baseline for internal governance.

Australia's AI Ethics Principles centre on eight principles: human, societal and environmental wellbeing; human-centred values; fairness; privacy protection and security; reliability and safety; transparency and explainability; accountability (including human oversight); and contestability. For a small business, most of these principles translate into straightforward practices rather than complex compliance programs.

In practice, the DISR framework asks: do you know what your AI tools are doing and why? Can you explain to a customer or employee how an AI-assisted decision was reached? Have you thought about whether the AI tool could produce biased or unfair outputs in your specific context? These are reasonable questions for any business using AI in a consequential way, even if they are not legally mandated for private businesses right now.

DISR has also produced resources for businesses wanting to apply the framework, including a self-assessment guide. The framework is most directly relevant to businesses that use AI to make or influence decisions affecting customers, to businesses that develop or customise AI tools, and to businesses that sell to government (where responsible AI practices may be a procurement requirement).

Primary source: industry.gov.au: Australia's AI Ethics Framework

ASIC: AI in financial services

The Australian Securities and Investments Commission regulates financial services businesses, and its guidance on AI is directly binding for licensees. If your business holds an Australian Financial Services Licence (AFSL), an Australian Credit Licence (ACL), or operates in financial services in any way, ASIC's AI-related guidance is not optional reading.

ASIC has been clear that existing obligations under the Corporations Act, ASIC Act, and National Consumer Credit Protection Act apply to AI-assisted processes just as they apply to human-led ones. If you use AI to assist with financial advice, lending decisions, insurance recommendations, or customer communications in a financial context, the obligations around best interests, disclosure, fairness, and accuracy still apply.

ASIC has highlighted specific risks it is monitoring: AI tools that produce inaccurate or misleading financial information, AI-driven marketing that exploits behavioural biases, and firms that rely on AI outputs without adequate human oversight or testing. ASIC has flagged that it will hold licensed businesses accountable for AI-assisted failures under existing law, even before any AI-specific regulation is enacted.

For businesses in accounting, bookkeeping, mortgage broking, financial planning, or insurance, the immediate practical step is to review any AI tool you use in client-facing or decision-supporting roles and confirm that a human is reviewing AI outputs before they influence client outcomes. ASIC's current guidance does not prohibit AI use, but it does require that AI use does not undermine existing obligations to clients.

Primary source: asic.gov.au: Responsible Use of Artificial Intelligence in Financial Services

ACSC and ASD: Cybersecurity guidance for AI

The Australian Cyber Security Centre (ACSC), part of the Australian Signals Directorate (ASD), publishes cybersecurity guidance for businesses of all sizes. Its AI-specific guidance focuses on the security risks that AI tools introduce, particularly for businesses that are not running enterprise-scale IT security programs.

The ACSC's guidance on AI for small businesses is published at cyber.gov.au and is practical rather than technical. The key risks it identifies are: sending sensitive business data to AI tools without understanding where that data goes or how it is stored; using AI tools that have not been vetted for security; falling for AI-generated phishing and social engineering attacks (which are now more convincing because AI makes them easier to produce); and relying on AI outputs that may be incorrect or manipulated.

For small businesses, the ACSC guidance translates to a handful of practical steps: check the security and privacy settings of any AI tool before connecting it to business systems; do not paste confidential client information into public AI tools unless you have reviewed the tool's data handling terms; train staff to be sceptical of AI-generated emails and requests, including those that appear to come from known contacts; and keep AI tools updated to reduce exposure to known vulnerabilities.

The ACSC also publishes the Essential Eight framework, which is a set of security controls applicable to any organisation. AI adoption does not change the Essential Eight, but the ACSC has noted that AI tools can complicate implementation if staff bypass existing security controls to use consumer AI tools on business devices or networks.

Primary source: cyber.gov.au: Small Business Cyber Security Guide

How the frameworks fit together for a small business

The four frameworks above address different dimensions of the same question: how do you use AI in a way that is safe, fair, and legally sound? OAIC covers what happens to personal data. DISR covers whether your AI use is responsible and explainable. ASIC covers whether your existing regulatory obligations are being met. ACSC covers whether your systems and staff are protected against AI-related security risks.

For most SMBs, the priority order is clear. Start with OAIC, because the Privacy Act is binding and the penalties for breaches are real. Then consider ACSC, because the security risks are immediate and practical. If you are in financial services, ASIC guidance is directly relevant to your licence conditions. DISR is worth reading if you are in government supply chains or want a structured way to think about responsible AI use internally.

None of these frameworks require you to stop using AI. They require you to use it with reasonable care and to understand the obligations that follow from the data your tools handle and the decisions they assist with. That is a manageable ask for a business that takes the time to read the guidance.

What to do next: practical steps for SMBs

The most useful starting point for any small business is to list the AI tools your team currently uses, then ask two questions about each one: does it handle personal information about customers or employees? And does it assist with decisions that could affect those people? If the answer to either is yes, the OAIC's guidance applies and the tool warrants a closer look at its data handling terms.

From there, reviewing the primary source links in this article takes most businesses to the specific guidance relevant to them. The OAIC, ACSC, and ASIC all publish plain-language resources aimed at organisations without dedicated legal teams. You do not need a lawyer to read them, though legal advice is worth seeking if you are uncertain about your obligations under the Privacy Act or your licence conditions.

If you are looking for a structured checklist to work through your current AI tool usage against the OAIC's guidance, see the OAIC AI Compliance Checklist for Australian SMBs. For the Privacy Act's broader implications for AI, see AI and the Privacy Act: What Australian Businesses Need to Know. For the automated decision-making deadline and its implications, see Privacy Act ADM Deadline: What Australian Businesses Need to Do.

Related reading: our can staff upload customer data to AI tools and our free AI staff policy template.

Try our free AI Privacy Risk Scorer to score your current AI tool setup against Privacy Act requirements.

Try our free AI Policy Generator to generate a customised AI policy for your business.

Related reading: our free AI acceptable use policy template and our AI governance by region.

Related reading: Claude AI Review for Australian Business and Notion AI Review for Australian Small Business.

Is there an Australian AI law that businesses have to comply with?

Not yet. Australia does not have a standalone AI Act or dedicated AI legislation as of June 2026. Instead, existing laws apply to AI use: the Privacy Act 1988 (enforced by OAIC), the Corporations Act and ASIC Act (for financial services businesses), and general consumer law. The Responsible AI Framework published by DISR is voluntary for private businesses. Binding AI-specific regulation is expected to follow a phased approach, with mandatory requirements likely starting with high-risk sectors.

Does the OAIC's AI guidance apply to my small business?

If your business turns over more than $3 million per year, or if you operate in certain sectors (health, education, financial services), the Privacy Act 1988 applies to you and so does the OAIC's AI guidance. Businesses below the $3 million threshold are generally exempt from the Privacy Act, but some state-based privacy laws may still apply, and data breach risks remain real regardless of legal threshold. If you handle client data of any kind, the OAIC's guidance is worth reading even if you are technically exempt.

What is the DISR Responsible AI Framework and do I have to follow it?

The DISR Responsible AI Framework is a set of eight voluntary principles covering safety, transparency, fairness, accountability, and related considerations for AI use. It is not legally binding for private businesses at this stage. It is, however, increasingly referenced in government procurement and is likely to form the basis for future mandatory requirements, particularly in high-risk sectors. If you sell to government or want a structured way to assess your AI practices, working through the framework is a practical step.

My business is in accounting or financial services. Which agencies' guidance applies to me?

Both OAIC and ASIC guidance are relevant to you. OAIC applies because you handle personal information about clients. ASIC applies if you hold an AFSL or ACL, or provide financial services that are regulated under the Corporations Act or National Consumer Credit Protection Act. ASIC has confirmed that existing obligations around advice quality, disclosure, and client best interests apply to AI-assisted processes. Human review of AI outputs before they reach clients is the immediate practical requirement. The ACSC's cybersecurity guidance is also relevant given the sensitivity of financial data.

Can I use ChatGPT or similar tools for my business without breaching Australian privacy law?

You can, with care. The key question is whether you are inputting personal information into the tool. If you paste in client names, contact details, medical information, financial records, or any other information that identifies or could identify individuals, your Privacy Act obligations apply to that input. You need to check where the tool sends that data, whether it is used for training, and whether your privacy policy discloses this use to affected individuals. Using AI tools for tasks that do not involve personal information (drafting internal documents, generating ideas, summarising your own notes) carries far fewer privacy risks. For a full breakdown, see our OAIC AI guidance deep-dive.

Where can I find the primary source for each Australian government AI framework?

OAIC guidance is at oaic.gov.au/privacy/artificial-intelligence. DISR's Responsible AI Framework is at industry.gov.au under Science, Technology and Innovation. ASIC's AI guidance is at asic.gov.au under Regulatory Resources. ACSC's small business cybersecurity and AI guidance is at cyber.gov.au. All four primary sources are linked in the relevant sections of this page. This page is updated quarterly, last verified June 2026.