A practical AI compliance checklist for Australian SMBs in 2026: what’s actually required now, what’s coming, and what’s still voluntary.
Knowing that AI regulation is changing in Australia is one thing. Knowing what your business is actually supposed to do about it by when is another, and most of what’s published online blurs the two together. This is the AI compliance checklist for Australia version: not the policy news, the practical steps. This information is general guidance, not legal advice, and given how fast this space is moving, it’s worth confirming current status with an advisor before your specific deadlines hit.
TL;DR: A firm Privacy Act deadline on 10 December 2026 requires disclosing automated decision-making in your privacy policy. APRA-regulated businesses face tighter obligations already in force. A mandatory national AI law was announced in principle on 15 July 2026 but isn’t legislated yet. Below is what to actually do now, not just what’s being discussed.
The one date every business should know
From 10 December 2026, businesses covered by the Privacy Act must disclose, in their privacy policy, where personal information is used in a computer program to make, or substantially assist, decisions that could significantly affect someone’s rights or interests. That covers AI-assisted credit decisions, hiring screens, pricing, and eligibility calls, more than most business owners initially assume. The Office of the Australian Information Commissioner ran consultation on the small-business exemption’s exact scope, closing 15 June 2026, with detailed guidance due by September 2026. Treat the exemption boundaries as unsettled until that guidance lands, and update your privacy policy disclosures well before December rather than waiting to see how the guidance shakes out.
If you’re in financial services, this already applies to you
APRA’s operational risk standard, CPS 230, took effect for banks, insurers, and super funds on 1 July 2025. It doesn’t mention AI by name, but it captures any AI system underpinning a critical business operation. On 30 April 2026, APRA issued an industry letter demanding a genuine step-change in AI risk governance, and vendor and AI contracts need to be CPS 230-compliant by their next renewal, no later than 1 July 2026. If your business sits inside or supplies into the financial services sector, this isn’t a future consideration, it’s a current one.
Is there an actual AI law yet? Be precise about this
No standalone AI Act exists in Australia today. Government policy through the December 2025 National AI Plan relied on existing laws, sector regulators, and voluntary standards, having stepped back from earlier 2024 proposals for mandatory guardrails on high-risk AI. That changed direction on 15 July 2026, when the Prime Minister announced the end of the voluntary-only approach and committed to legislating “Australian Standards for AI” alongside a new Office of AI. This is an announcement of intent, not enacted law, no bill text, commencement date, or exact scope has been confirmed as of this writing. The honest summary: mandatory AI law is coming, it is not yet in force, and the voluntary standards below remain the practical benchmark in the meantime.
The AI compliance checklist Australia SMBs actually need
Build an AI inventory. List every tool touching customer or employee data, chatbots, CRM AI features, automated scoring or recommendation systems, so you actually know what you’re governing.
Map each tool against the Privacy Act’s automated decision-making rules ahead of the 10 December 2026 deadline, and update your privacy policy disclosures now rather than in November.
Keep a human in the loop for any AI-assisted decision that materially affects a customer, credit, hiring, pricing, or eligibility.
Run vendor due diligence. Get contracts specifying data use, model behaviour, and any sub-processing arrangements. This is mandatory for APRA-regulated entities and good practice for everyone else.
Write a staff AI-use policy covering which tools are approved, what data can’t be pasted into them, and what needs to be disclosed to customers.
Disclose AI use to customers in support and service interactions where it’s material to the interaction.
Adopt a governance baseline even without a legal mandate, using the voluntary AI Safety Standard’s ten guardrails or the simplified six-practice Guidance for AI Adoption released in October 2025. Regulators tend to look more favourably on demonstrated intent than on having done nothing while waiting for a mandate.
Watch for two things specifically: the OAIC’s small-business exemption guidance due by September 2026, and any legislative detail following the 15 July 2026 announcement.
Why most businesses aren’t ready
Research from the National AI Centre found that a majority of Australian workers using AI at work are using tools their employer hasn’t approved or provided, meaning a large share of AI use is happening outside any organisation-controlled data governance framework entirely. Separately, industry research suggests fewer than one in four Australian organisations have mature AI governance or risk controls in place, despite AI adoption ranking as a top strategic priority for a significant share of governance leaders. The gap between “using AI” and “governing AI” is exactly where compliance risk sits, and working through an AI compliance checklist for your Australian business now is the difference between closing that gap deliberately and closing it after a regulator asks why you haven’t.
For the broader regulatory picture and how this developed, Avatar Studios’ AI regulation explainer covers the policy background in more depth. If you want help auditing your specific AI tools against these requirements, Avatar Studios’ strategy and advisory services can run that assessment directly.
Frequently Asked Questions
Is there an “AI law” in Australia yet, or is AI use just covered under existing laws?
There’s no standalone AI Act yet. AI use is currently governed through existing laws, primarily the Privacy Act, plus sector-specific regulators like APRA and voluntary standards. A mandatory national law was announced in principle on 15 July 2026 but has not been legislated.
Do I need to tell customers when they’re talking to an AI chatbot, not a human?
Disclosure obligations are tightening, particularly around automated decision-making from 10 December 2026. As general good practice, disclosing AI use in customer-facing interactions is increasingly expected even where not yet strictly mandated for your specific use case.
Does the Privacy Act’s small business exemption still protect my business if I use AI?
This is still unsettled. The OAIC is finalising guidance on exactly how the small business exemption applies to automated decision-making, expected by September 2026. Don’t assume the exemption covers you without confirming once that guidance lands.
What happens if my AI vendor, not me, mishandles customer data? Am I still liable?
Generally yes, at least in part. This is exactly why vendor due diligence, getting clear contractual terms on data use and sub-processing, matters, and why it’s now a formal requirement for APRA-regulated businesses specifically.
What’s the difference between the Voluntary AI Safety Standard and an actual legal requirement?
The Voluntary AI Safety Standard and the simplified Guidance for AI Adoption are not legally binding, but they function as the practical due-diligence benchmark regulators currently reference. A genuine legal requirement, once legislated following the July 2026 announcement, would carry enforcement consequences the voluntary standards do not.