Regulatory watch · Australia

Regulatory watch for Australian businesses

The rules that matter to Australian businesses on technology, privacy, cyber and AI, and what boards should do about each. Checked against primary sources; last checked 13 October 2026.

Commencing

  1. Privacy Act automated-decision transparency (APP 1.7–1.9)

    Commencing
    Key dates
    . Commences 10 December 2026
    Who it catches
    APP entities using personal information in decisions that could significantly affect people
    Regulator
    OAIC
    What boards should do
    Inventory every automated or AI-assisted decision about customers or staff, and have the privacy policy disclosures drafted before 10 December 2026.

  2. Children’s Online Privacy Code

    Commencing
    Key dates
    . Must be registered by 10 December 2026; exposure draft consulted March to June 2026
    Who it catches
    Social media, electronic and designated internet services likely to be accessed by children
    Regulator
    OAIC
    What boards should do
    Decide whether any service you run is likely to be used by under-18s, and if so assign an owner for the Code’s requirements.

  3. Scams Prevention Framework

    Commencing
    Key dates
    . Act in force February 2025; Rules from 1 September 2026; sector codes from 31 March 2027 or later
    Who it catches
    Banks, telcos and designated digital platforms
    Regulator
    ACCC (general), ASIC (banks), ACMA (telcos)
    What boards should do
    Confirm whether you are in, or a supplier to, a designated sector, and if so track the sector code that will bind you.

  4. EU AI Act

    Commencing
    Key dates
    . Prohibitions and AI literacy since 2 February 2025; high-risk (Annex III) from 2 December 2027; embedded (Annex I) from 2 August 2028, per the provisional agreement of 7 May 2026
    Who it catches
    Providers and deployers of AI placed on the EU market, including Australian exporters
    Regulator
    EU AI Office and national authorities
    What boards should do
    If you have EU customers or users, classify each AI use by risk tier and record who is accountable for it.

Proposed or paused

  1. Privacy Act Tranche 2 (Personal Data Protection Bill 2026)

    Proposed
    Key dates
    Exposure draft 31 August 2026; submissions closed 18 September 2026
    Who it catches
    Proposed to reach more small businesses; adds a direct right of action and impact assessments
    Regulator
    Attorney-General’s Department
    What boards should do
    If your turnover is under A$3M, plan on losing the small business exemption and budget for privacy impact assessments.

  2. Mandatory AI guardrails

    Paused
    Key dates
    Not pursued in the National AI Plan of 2 December 2025; AI Safety Institute from early 2026
    Who it catches
    High-risk AI settings
    Regulator
    Department of Industry
    What boards should do
    Rely on existing privacy, consumer and directors’ duties law for AI today, and watch for a revival of mandatory guardrails.

In force

  1. Privacy Act 1988 and Notifiable Data Breaches scheme

    In force
    Key dates
    Tiered civil penalties since December 2024
    Who it catches
    Businesses over A$3M turnover, plus health providers, data traders and AML/CTF reporting entities
    Regulator
    OAIC
    What boards should do
    Confirm you have a current privacy policy, a tested data breach response plan and a record of overseas disclosures.

  2. Statutory tort for serious invasions of privacy

    In force
    Key dates
    In force since 10 June 2025
    Who it catches
    Any organisation or individual, whatever its size
    Regulator
    Courts
    What boards should do
    Review surveillance, staff monitoring and any use of personal data that a reasonable person would find intrusive.

  3. Cyber Security Act 2024 ransomware payment reporting

    In force
    Key dates
    In force since 30 May 2025; grace period ended 1 January 2026
    Who it catches
    Businesses over A$3M turnover and critical infrastructure entities
    Regulator
    ASD and Home Affairs
    What boards should do
    Put the 72-hour ransomware payment reporting step into the incident response plan and test it.

  4. AML/CTF Tranche 2

    In force
    Key dates
    In force since 1 July 2026; enrolment by 29 July 2026
    Who it catches
    Lawyers, accountants, real estate agents, conveyancers, trust and company service providers
    Regulator
    AUSTRAC
    What boards should do
    If you provide a designated service, confirm enrolment and that AML/CTF customer data is now handled under the Privacy Act.

  5. APRA CPS 230 and CPS 234

    In force
    Key dates
    CPS 230 from 1 July 2025; transition for pre-existing contracts ended 1 July 2026
    Who it catches
    APRA-regulated entities and their material service providers
    Regulator
    APRA
    What boards should do
    If you supply a bank, insurer or super fund, know whether you are a material service provider and what their contract and resilience testing will require of you.

  6. AFS licence obligations (cyber)

    In force
    Key dates
    ASIC v FIIG Securities [2026] FCA 92, A$2.5M penalty, February 2026
    Who it catches
    AFS licensees
    Regulator
    ASIC
    What boards should do
    If you hold an AFS licence, evidence MFA, patching, testing, training and a tested incident response plan; the Federal Court has now penalised their absence.

  7. Directors’ duties (Corporations Act s 180)

    In force
    Key dates
    Ongoing
    Who it catches
    Company directors and officers
    Regulator
    ASIC
    What boards should do
    Minute how the board oversees technology, cyber and AI risk, and who reports on it and how often.

  8. Security of Critical Infrastructure Act 2018

    In force
    Key dates
    Ongoing
    Who it catches
    Critical infrastructure asset owners and operators
    Regulator
    Home Affairs
    What boards should do
    Confirm whether you, or a key customer, are a responsible entity, and what that requires of your supply contracts.

  9. Australian Consumer Law

    In force
    Key dates
    Ongoing
    Who it catches
    All businesses
    Regulator
    ACCC
    What boards should do
    Check every claim about AI capability, security or certification in your marketing can be evidenced.

Benchmarks we use

  1. Guidance for AI Adoption (six practices)

    Voluntary
    Key dates
    Released October 2025
    Who it catches
    All organisations using AI
    Regulator
    National AI Centre
    What boards should do
    Use the six practices as the baseline for your AI policy and register, and ask management to report against them.

  2. ASD Essential Eight

    Voluntary
    Key dates
    Ongoing
    Who it catches
    Benchmark for all; mandatory for many government entities
    Regulator
    ASD
    What boards should do
    Ask for your Essential Eight maturity level in writing, and the plan to raise it.

General information, not legal advice. Updated after each monthly review. Last checked 13 October 2026.