Artificial Intelligence Law in Australia

Introduction

Australia currently lacks a single, comprehensive regulatory framework governing artificial intelligence. Instead, AI-related legal issues are addressed through a patchwork of existing laws — privacy, consumer protection, anti-discrimination, tort, and sector-specific regulation — supplemented by voluntary ethics frameworks and policy guidance. This fragmented approach has attracted increasing criticism, and the Australian Government has signalled a shift toward mandatory regulation, particularly for high-risk AI applications. Understanding the Australian approach requires examination of the ethics framework, the existing legislative architecture, and the proposed reforms.

The Australian AI Ethics Framework

In 2019, the Australian Government released the Australian AI Ethics Framework, comprising eight voluntary principles developed by the CSIRO’s Data61. These principles are: (1) human, social and environmental wellbeing; (2) human-centred values; (3) fairness; (4) privacy protection and security; (5) reliability and safety; (6) transparency and explainability; (7) contestability; and (8) accountability. The principles are designed to guide organisations in the responsible design, development, and deployment of AI systems. They are enforced through a voluntary self-assessment tool rather than statutory obligation. The National AI Centre, established within CSIRO in 2021, coordinates Australia’s AI strategy, including industry engagement, research commercialisation, and the development of AI standards.

Privacy and Data Protection

The Privacy Act 1988 (Cth) is the principal legislative instrument governing the handling of personal information by Australian Government agencies and private sector organisations with an annual turnover exceeding AUD $3 million. The Act’s Australian Privacy Principles (APPs) impose obligations in relation to the collection, use, disclosure, quality, and security of personal information. The interaction between AI and the Privacy Act has been a central focus of law reform. The Privacy Act Review Report (2022) recommended significant reforms, including the introduction of a statutory tort for serious invasion of privacy, direct regulation of automated decision-making, enhanced consent requirements, and a new definition of “personal information” that captures inferred and technical data. The Government’s response has accepted many of these recommendations in principle, with legislation expected to be introduced progressively.

Sector-Specific Regulation

In the absence of a general AI law, sector-specific regulators have issued guidance addressing AI use within their domains. The Therapeutic Goods Administration (TGA) regulates AI-enabled medical devices under the Therapeutic Goods Act 1989 (Cth). Software that meets the definition of a medical device — including AI-based diagnostic and decision-support tools — must be included in the Australian Register of Therapeutic Goods. The TGA has issued specific guidance on the classification of Software as a Medical Device (SaMD). In financial services, the Australian Securities and Investments Commission (ASIC) has issued regulatory guidance on digital advice and automated decision-making, emphasising that the use of AI does not relieve a licensee of its obligations under the Corporations Act 2001 (Cth) to act efficiently, honestly, and fairly. Autonomous vehicles are regulated under reforms led by the National Transport Commission, which have amended the Australian Road Rules and state-based transport legislation to permit the operation of automated driving systems, provided a “authorised automated entity” accepts legal responsibility for the vehicle’s behaviour.

Tortious Liability and AI

The application of Australian tort law to AI-caused harm raises complex doctrinal questions. Liability for harm caused by an AI system may arise in negligence, breach of statutory duty, or under the Australian Consumer Law for defective goods or misleading conduct. The Civil Liability Act 2002 (NSW) and equivalent statutes in other states impose a duty of care on persons who supply professional services or manufactured products. Where an AI system operates with a degree of autonomy, questions arise as to whether the developer, deployer, or user is the appropriate defendant. The principles of contributory negligence and proportionate liability (applicable to claims for economic loss) may reduce recoverable damages where there is concurrent fault. Criminal liability for AI-related conduct is governed by the Criminal Code Act 1995 (Cth) and state criminal codes, which require proof of fault elements (intention, knowledge, recklessness, or negligence) that may be difficult to establish where decisions are made autonomously.

The Proposed Mandatory Regulation

In 2024, the Australian Government released its response to the Safe and Responsible AI consultation, signalling a move toward mandatory guardrails for high-risk AI. The proposed framework would require organisations deploying AI in high-risk settings — such as law enforcement, health care, employment, and critical infrastructure — to undertake conformity assessments, implement human oversight mechanisms, and ensure transparency and explainability. The Government has indicated that it will build upon the existing AI Ethics Principles and align with emerging international standards, particularly the European Union’s AI Act and the OECD AI Principles. Voluntary safety testing standards are also being developed in collaboration with the National AI Centre and Standards Australia.

The Human Rights Dimension

The Australian Human Rights Commission’s Human Rights and Technology Final Report (2021) was a landmark document that recommended a new regulatory framework for AI grounded in international human rights law. The report proposed a Human Rights and Technology Commissioner, a risk-based regulatory framework for AI, and amendments to the Disability Discrimination Act 1992 (Cth) and the Racial Discrimination Act 1975 (Cth) to ensure they adequately address algorithmic discrimination. While the Government has not adopted all recommendations, the report has significantly shaped the policy discourse and informed the mandatory guardrails proposal.