Australia’s National AI Plan has confirmed what many expected but few have prepared for. No standalone AI Act is coming. AI governance in this country will continue to operate through existing laws and a voluntary framework, not a purpose-built regulatory structure.
That might sound like relief. But the implications are more significant than they appear.
The legal landscape
AI in Australian businesses is governed by three existing pieces of legislation. The Privacy Act 1988, the Australian Consumer Law, and the Online Safety Act 2021. Sitting alongside those is the government’s Voluntary AI Safety Standard, a ten-guardrail framework published as guidance rather than regulation. The AI Safety Institute, now operational with $29.9 million in government funding, will focus on research and assessment rather than enforcement.
The key word throughout is voluntary. There is no mandatory compliance obligation for most businesses beyond the existing laws that already applied before AI became a mainstream business tool.
What this means for your business
No rules are coming that will tell your team what they can and cannot do with AI. That means every business is now responsible for defining its own standards. What AI tools your team can use. What decisions AI is allowed to inform. What data can be processed by external systems. How employees are expected to use AI in their daily work.
Most Australian businesses have not had that conversation yet. The ones that have are already ahead.
The first-mover advantage
There is genuine competitive advantage in building internal AI governance before it is required. Businesses that define their own frameworks now will not be scrambling to catch up when a regulatory change forces the question. They will also have a clearer picture of how AI is being used across their operations, which makes it easier to identify where it is working and where it is not.
More practically, employees want to know what the rules are. One of the most common things we hear from business owners is that their team is using AI informally, in inconsistent ways, without any shared understanding of what is appropriate. That creates risk and it creates confusion. A clear internal standard removes both.
Where to start
A basic AI governance framework for an Australian SME does not need to be complex. It needs to cover four things. What tools your team can use and for what purposes, what data can be shared with external AI systems, how AI-generated outputs should be reviewed before acting on them, and who is responsible for the AI decisions your business makes.
If your business does not have those four things documented, the National AI Plan is a good reason to start.
Via SmartCompany, Australia’s National AI Plan confirms no AI Act
Get in touch at www.xsiv.au/#form