This article summarises publicly available guidance from regulators and official sources. It is general educational information only and does not constitute legal or professional advice. Requirements vary by jurisdiction. Consult your regional authority or a qualified professional for advice specific to your situation.
In short: There is no single, dedicated AI law in Australia yet. Existing laws including the Privacy Act and the Australian Consumer Law already apply to how a business uses AI, and the government has published guidance, not binding law, on responsible AI use.
The plain-English answer, up front
Australia does not currently have a single, AI-specific law the way some jurisdictions are moving toward. What exists instead is a patchwork: general laws that already apply regardless of whether AI is involved, plus government-published guidance that shapes expectations without carrying the force of law. That's a genuinely more complicated answer than a simple yes or no, and it's the honest one.
Why this matters for your business
The absence of a dedicated AI law does not mean using AI carries no obligations. If your business handles personal information through an AI tool, the Privacy Act already applies. If an AI tool generates a customer-facing claim, the Australian Consumer Law already applies to that claim, regardless of what produced it. Waiting for an "AI law" to arrive before treating any of this seriously is the wrong reading of where things actually stand.
What regulators actually say
The Department of Industry, Science and Resources has published a Responsible AI framework outlining voluntary guidance for businesses, not a binding statute. The OAIC has issued specific guidance on how the existing Privacy Act applies to AI tools. The ASIC has flagged AI governance as a focus area for financial services specifically, and cyber.gov.au publishes AI-specific guidance for small business security. For the full picture across all of these, see our Australian government AI policy roundup.
What this looks like in practice
A 20-person business using an AI tool to draft customer emails and summarise documents is not waiting on a future AI law to have obligations today. If that AI tool processes customer personal information, Privacy Act obligations already apply to how that data is handled. If AI-drafted content makes a claim about pricing, availability, or a product feature, Australian Consumer Law already applies to whether that claim is accurate. The gap isn't in whether rules exist, it's that they weren't written with AI specifically in mind, which is exactly why government guidance exists to bridge that gap.
What you can do about it
Treat your existing Privacy Act and Australian Consumer Law obligations as already applying to any AI tool your business uses, rather than waiting for AI-specific rules to arrive. Keep a simple record of which AI tools your business uses and what they're used for, this is the basis of an AI register and makes any future compliance question far easier to answer. Review government guidance periodically rather than once, since this is one of the more actively evolving areas of policy.
Get started with a free AI register template
Our free AI register template gives you a starting structure for tracking which AI tools your business uses, what they're used for, and what data they touch, the practical first step regardless of how the regulatory picture develops from here.
Methodology (Real-World, Verified)
We test AI tools against real SMB workflows: the tasks a 20-person business actually uses AI for, not enterprise demos. Pricing is verified at the vendor's published rates, with AUD or other local-currency conversions noted where relevant. Compliance notes reference the legislation and regulatory guidance relevant to each article's region. Tools are assessed for suitability by a business with no dedicated IT department.
Related reading: our can staff upload customer data to AI tools, our AI and the Privacy Act guide, and our OAIC guidance on AI for businesses.
Is there an AI-specific law in Australia right now?
No, not a dedicated one. Existing laws like the Privacy Act and Australian Consumer Law apply to AI use, alongside voluntary government guidance on responsible AI.
Do small businesses need to worry about AI regulation the same way large enterprises do?
The underlying obligations (privacy, consumer law) apply regardless of business size, though the scale and complexity of compliance work is naturally lower for a smaller operation with fewer tools and less data.
Will Australia introduce a dedicated AI law soon?
Government guidance and policy in this area is actively evolving, and the answer may change. Check our government AI policy roundup for the most current summary rather than relying on a fixed answer here.
What happens if my business breaches an existing law using an AI tool?
The same consequences that would apply if a person had caused the breach, an AI tool being involved doesn't change your business's underlying obligation or liability under the Privacy Act or Australian Consumer Law.
Where can I get official guidance rather than a summary?
Go directly to the source: the OAIC for privacy-specific guidance, the Department of Industry, Science and Resources for the Responsible AI framework, and the ACCC for Australian Consumer Law guidance. Links to each are above.
The information in this article is general in nature. It reflects a summary of publicly available guidance and does not constitute legal, privacy, or professional advice. Your obligations will depend on your specific situation, jurisdiction, and business circumstances. Do not rely on this article as a substitute for qualified legal or professional advice.
<a href="/tools/ai-compliance-checker/">AI Compliance Checker</a> to check whether your AI tools meet your compliance obligations
Check Your Compliance