When There's No AI Act: How Standards Became the Standard of Care

Key Takeaways:

• Voluntary doesn’t mean optional. NIST AI RMF and ISO 42001 now define what good looks like, and regulators will measure you against them.
• December 10 has no phase-in. APP 1.7 to 1.9 apply to every automated decision made after that date, including on systems built years ago.
• Your scope is wider than you think. Personal information used anywhere in a program’s operation counts, not just in the decision. Even spreadsheets may qualify.
• Disclosures decay the day you publish them. Agentic workflows change weekly. A notice that’s accurate on December 9 can be wrong by March.
• Vendor PDFs aren’t evidence. A third-party platform doesn’t transfer your obligation. Regulators expect your own audit trail.

Australia chose existing law over a dedicated AI Act, and many teams read that as breathing room. It’s the opposite. Without a checklist, you’re judged against global standards, sector regulators, and Privacy Act penalties that reach $50 million, starting December 10.

Andrew Clearwater, Chief Trust Officer at Airia, and Matthew Hurford, Founder of Shinkō1, break down the ADM three-part test, what a defensible use case record looks like, and what your board needs before someone challenges a decision made 18 months ago.

Watch on demand before December 10 turns your AI inventory into evidence.