What Do AI Laws in Australia Mean for a Small Business?
Quick answer
Australia has no single AI law, so AI laws in Australia for a small business today are existing laws applied to AI, led by the Privacy Act.
- Privacy rules cover what goes into AI tools
- Consumer law covers what AI tells customers
- The safety standard is voluntary, not law
- New privacy rule starts 10 December 2026
Australia has no AI law yet, but it does have an AI deadline. If software decides anything about your customers, your privacy policy may need to say so by 10 December 2026.
This guide sticks to what the regulators say on their own sites. It's general information, not legal advice. For your own case, talk to a lawyer.
Is There an AI Law in Australia Yet?
No, Australia has no standalone AI law, and the government plans to rely on the laws it already has. So the rules you follow today still apply when AI does the work.
The National AI Plan came out on 2 December 2025. It says existing laws "remain the foundation" for dealing with AI risks. Each regulator keeps an eye on AI in its own patch. A new AI Safety Institute will test AI risks and advise those regulators.
The plan also says the government "will not hesitate to intervene" if more rules are needed. So this can change. For now, there's no AI Act to sign up to and no AI licence to buy. Your job is to apply the laws you know to a new tool, the same as with any business automation.
Which Existing Laws Apply When a Small Business Uses AI?
Privacy, consumer, discrimination and negligence laws are the ones a small business is most likely to touch. The Department of Industry maps each AI risk to the law that covers it.
Its guide to the laws that apply to AI is long. Here it is cut down to the everyday jobs AI does in a small business.
| How you use AI | Law that can apply | What it means for you |
|---|---|---|
| Staff paste customer details into a chatbot | Privacy Act | Personal details have rules, whatever tool holds them |
| A website chatbot answers customers | Australian Consumer Law | Wrong answers, or hiding that it's AI, can mislead |
| AI writes quotes or reports | Consumer guarantees | Services must be done with due care and skill |
| AI screens job applicants | Anti-discrimination laws | Unfair results can breach the law |
The guide names "AI hallucinations", when a tool makes up a wrong answer, as a possible breach of the consumer guarantees. So a person checks any AI answer that can be out of date before a customer sees it.
Does the Privacy Act Cover Your Small Business?
Most businesses with turnover of $3 million or less are not covered by the Privacy Act, but some are covered at any size. Check this first, because it decides how much of the AI privacy advice is law for you.
The OAIC's small business page sets the line at $3 million a year. Turnover means all your income, not your profit. Above the line, you must follow the Australian Privacy Principles (APPs). These are 13 rules for how you collect, use and protect personal details.
Some smaller businesses are covered too. The list includes health service providers and any business that buys or sells personal details. So a physio clinic is covered from day one. Under the line and not on the list? Business.gov.au says you can still follow the APPs, and that's the safer habit.
What Does the OAIC Expect When You Use AI Tools?
The OAIC says privacy rules apply to what you put into an AI tool and to what comes out. Its advice is to keep personal details out of public AI chatbots.
The OAIC's guidance on AI products came out on 21 October 2024. It says not to put personal details, "particularly sensitive information", into free public AI tools. It also asks for three things:
- Label your chatbot so customers know it's AI, not a person.
- Update your privacy policy to say how you use AI.
- Check accuracy. Under APP 10, personal details in AI output must be correct, so a person checks them.
UnderCurrent Automations gives Australian clients one rule whatever their size. No customer names, contacts, health or money details go into a free chatbot. In the audits we've run, it's the first gap we look for.
What Changes for AI Laws in Australia on 10 December 2026?
From 10 December 2026, businesses covered by the Privacy Act must explain automated decisions in their privacy policy. It's the one AI-specific legal date a small business has to plan for right now.
An automated decision is a choice a computer program makes about a person. The rule comes from a 2024 change to the Privacy Act, and it's already law. The OAIC's consultation page says your policy must list the kinds of personal details used and the kinds of decisions made. It applies when three things are true. A computer makes the call, the call could really affect a person, and it uses their details.
Don't wait for the OAIC's guidance on this rule. It only asked for views on that guidance in May 2026, and the law sets the start date either way. If software approves refunds, ranks job applicants or sorts customers on its own, list those decisions now. The APP 1 guidelines already show what a privacy policy has to cover.
Is the Voluntary AI Safety Standard Law in Australia?
No, the Voluntary AI Safety Standard is not law, and its 10 guardrails add no new legal duties. It's a checklist for using AI safely inside the laws you already have.
The Voluntary AI Safety Standard came out on 5 September 2024. Its 10 guardrails run from naming who is in charge to testing a tool before you use it. On 21 October 2025, the National AI Centre published a simpler version, the Guidance for AI Adoption, with 6 essential practices. Both are free to read and use.
For a small business, start where both start: name one person who is in charge of AI. Guardrail 1 and practice 1 say the same thing. Add some basic AI training for staff, and you've covered what matters most for a team of five or fifty.
Worked Example: A Bookkeeping Firm Using AI
This is a worked example, not a client story. It shows how these laws land on one ordinary business, with a sum you can check.
Picture a bookkeeping firm with 8 staff and $3.2 million in turnover, so the Privacy Act covers it. Each person pastes 4 client emails a day into a free chatbot to draft replies.
Client records sent to a free chatbot
- Staff, 8
- × Client emails each a day, 4
- × Working days a year, 230
- = Client records a year, 7,360
That's 7,360 client records a year, sent to a tool the firm can't control.
The website chatbot isn't labelled, and the billing software pauses overdue clients on its own. That pause is an automated decision, so it goes in the privacy policy by 10 December 2026. The fix is three short documents: a tool list with a data rule, a privacy policy that covers AI and automated decisions, and a chatbot label. Then the firm can automate more of its work and know where the data goes.
A Checklist for AI Laws in Australia
Most small businesses can meet today's AI rules with seven checks, and none of them needs a lawyer to start. Work through them in order.
The small business AI law checklist
If you want help placing a tool or a decision on that list, book a consult with UnderCurrent Automations. We'll map where your customer data goes today.
Frequently asked questions
Is it legal to use ChatGPT for business in Australia?
Yes, using ChatGPT or other AI chatbots for business is legal in Australia. No law bans them. What matters is how you use them. If the Privacy Act covers your business, the OAIC says privacy rules apply to anything you type in and anything that comes back. Its best-practice advice is to keep personal and sensitive details out of public chatbots. Consumer law still covers what you tell customers.
Do I have to tell customers I'm using AI in Australia?
There's no general Australian law that says every use of AI must be disclosed. But the OAIC expects customer-facing chatbots to be clearly labelled as AI, and wants privacy policies to explain how you use it. The Department of Industry also notes that staying silent about AI use can count as misleading under the Australian Consumer Law. Labelling your chatbot is the safe default for any business.
Who regulates AI in Australia?
No single body regulates AI in Australia. Each regulator handles AI harms in its own area. The OAIC covers privacy, the ACCC covers consumer law, and financial regulators cover banking and insurance. The National AI Plan of December 2025 set up an AI Safety Institute. It tests AI risks and advises regulators, but it doesn't issue fines or licences to small businesses.
Will Australia bring in mandatory AI guardrails?
Not for now. The government asked for views in 2024 on mandatory guardrails for AI in high-risk settings. The National AI Plan of December 2025 then chose to build on existing laws instead of a new AI Act. The plan says the government will step in if more rules are needed. A small business should follow the current rules and check industry.gov.au for changes once or twice a year.
Does the EU AI Act apply to Australian businesses?
The EU AI Act can apply to some Australian businesses, but only through their links to the EU. The Department of Industry notes that Australian businesses may need to follow overseas laws that reach beyond their own borders. If you sell AI-based services to customers in the EU, get advice on whether it covers you. Most small businesses serving local Australian customers won't need to act on it.
