Seven Commitments, Twelve Instruments: What Australian AI Obligations Actually Ask For
What Australian AI obligations actually ask for, and why no AI Act is coming to save you from finding out.
Key Takeaways:
- Australia chose not to legislate AI risk, and that decision already cost you the excuse. Twelve instruments bind private sector AI use today, and none of them say “artificial intelligence” in the title.
- A hard deadline is set for December 10, 2026. Australian Privacy Principles 1.7 to 1.9 require disclosure wherever a computer program materially shapes a decision that significantly affects someone. Nothing is grandfathered.
- Human sign-off does not exempt the system. A model that ranks, scores, or drafts a recommendation a person approves still counts, and so does a vendor’s system you never built.
- You do not need twelve separate compliance programs. Read the instruments side by side and the same seven commitments appear across every one.
- Every instrument resolves accountability to a named person. APRA expects lifecycle ownership, the Financial Accountability Regime names individuals, and neither anti-discrimination nor consumer law recognizes a model as a respondent.
If a regulator, a customer, or your board asked which law governs the AI system you deployed last quarter, could you name it?
Most executives assume the answer is coming later, once Australia passes its AI Act. It is not coming. The National AI Plan made that call in December 2025, and the July 2026 Office of AI announcement did not reverse it for enterprises. The standards being legislated target large data centers and model training, not the claims-triage model or the underwriting spreadsheet already running in your business.
That does not mean you are unregulated. It means the obligations were never collected in one place. Privacy law treats your AI as a computer program. Prudential standards treat it as an information asset and a dependency. Consumer law treats its outputs as representations. Anti-discrimination law treats its outcomes as decisions. Twelve instruments, twelve different reasons to apply, and a deadline in December that assumes you have already done the mapping.
Download the report to see the seven commitments underneath all twelve, and the 90-day plan to prove you meet them.