Australian Standards for AI 2027: What Businesses Must Know About the New Framework

On 15 July 2026, Prime Minister Anthony Albanese announced a landmark shift in Australia's approach to artificial intelligence governance. Moving decisively from voluntary guidelines to a mandatory national framework, the government unveiled plans for the "Australian Standards for AI" — a legally binding set of rules that will reshape how businesses develop, deploy, and operate AI systems in Australia.

For Australian businesses that rely on AI — and for the AI engineers who build and maintain those systems — understanding what is coming and preparing now is essential. The framework is targeted for legislation in early 2027, and the obligations it introduces will be significant.

Understanding the Australian Standards for AI Framework

Australia's current approach to AI regulation is technology-neutral and relies on existing laws — including the Privacy Act 1988, the Australian Consumer Law, and sector-specific oversight from regulators such as APRA, ASIC, and the TGA. While this framework has provided a degree of flexibility, it has also created uncertainty for businesses seeking clear guidance on their AI obligations.

The Australian Standards for AI will change this by establishing a consistent, legally binding set of rules that apply across all Australian states and territories. The framework is designed to give businesses the certainty they need to invest in AI while ensuring that AI development and deployment meets community expectations for safety, transparency, and accountability.

The National Cabinet is scheduled to review the proposed approach in August 2026, with legislation targeted for introduction in early 2027. Businesses should treat this timeline as firm and begin preparing now.

The Office of AI: Australia's New AI Regulator

A central element of the new framework is the establishment of the Office of AI within the Department of the Prime Minister and Cabinet. This new body will serve as Australia's primary AI regulatory authority, coordinating cross-portfolio efforts and leading industry engagement on the development and implementation of the Australian Standards for AI.

The Office of AI will work alongside existing regulators — including APRA, ASIC, the OAIC, and the Australian AI Safety Institute (AISI) — rather than replacing them. Sector-specific AI obligations in financial services, healthcare, and other regulated industries will continue to be administered by the relevant sector regulator, with the Office of AI providing overarching coordination and setting baseline standards that apply across all sectors.

The Australian AI Safety Institute, operationalised in early 2026, will provide independent technical analysis and safety testing of frontier AI models. Its findings will inform the development of the Australian Standards for AI and provide the Office of AI with the technical expertise needed to regulate rapidly evolving AI systems.

Key Obligations Under the Proposed Framework

While the full details of the Australian Standards for AI will be determined through the legislative process, the government has signalled several key areas of focus. AI engineers and the businesses they serve should be preparing for obligations in each of these areas.

Large-Scale AI Data Centre Requirements

The most immediately significant obligations under the proposed framework relate to large-scale AI data centres. The government has adopted a policy direction of "net generators, not net users," requiring data centre operators to contribute at least as much energy to the national grid as they consume.

Specific obligations for data centre operators are expected to include:

• New renewable energy generation — Operators will be required to underwrite new renewable energy generation and firming capacity, such as battery storage or dispatchable power. A standard renewable Power Purchase Agreement for existing generation is unlikely to satisfy these requirements.
• Grid connection costs — Operators will be required to pay their full share of grid connection costs, preventing these expenses from being passed to households or other businesses.
• Water efficiency — The standards will enforce requirements to maximise energy efficiency and minimise water usage, including paying for necessary water infrastructure upgrades.
• Scope of application — While exact definitions remain subject to consultation, the framework is expected to focus on "large AI data centres." The status of existing facilities and planned expansions is a key point to be clarified during consultation.

Privacy Act Automated Decision-Making Obligations

Separate from the Australian Standards for AI, but closely related, are the automated decision-making (ADM) transparency obligations taking effect on 10 December 2026 under the Privacy Act 1988. These require organisations to disclose the use of "substantially automated decisions" that significantly affect individuals' rights or interests.

AI engineers building systems that make or substantially inform decisions about individuals — including credit assessments, employment screening, insurance underwriting, and content moderation — must ensure their systems are designed to support the transparency disclosures their clients will be required to make. This includes maintaining audit trails, documenting decision logic, and enabling human review of automated decisions.

Copyright and AI Training Data

The government has made clear that Australian writers, artists, and journalists retain ownership of their work, and that AI training on Australian creative content without appropriate control or licensing is not acceptable. The government has explicitly rejected a text-and-data-mining (TDM) exemption for AI training, favouring a model where rights holders retain control and receive compensation.

AI engineers building or fine-tuning models on Australian content must ensure that appropriate licensing arrangements are in place. The Copyright and AI Reference Group (CAIRG) is continuing its work on this issue, and further guidance is expected before the end of 2026.

Public Sector AI Requirements

The Digital Transformation Agency (DTA) has already implemented mandatory policies for Commonwealth entities, including requirements for AI transparency statements and the appointment of Chief AI Officers. AI engineers working on government contracts must be familiar with these requirements and ensure that their systems meet the DTA's standards for transparency, accountability, and human oversight.

Common Mistakes Businesses Make With AI Governance

As Australia moves toward a mandatory AI governance framework, many businesses are discovering that their current AI practices fall short of what will be required. The following common mistakes are worth addressing now, before the new standards take effect.

• Treating AI governance as an IT issue rather than a business issue — AI governance requires input from legal, compliance, HR, and senior leadership, not just the technology team. Businesses that delegate AI governance entirely to their IT department are likely to miss critical risk and compliance considerations.
• Failing to document AI decision-making processes — The Privacy Act ADM obligations and the proposed Australian Standards for AI both require transparency about how AI systems make decisions. Businesses that cannot explain their AI systems' decision logic will struggle to comply.
• Using AI training data without verifying licensing — Many businesses are unaware of the copyright implications of using publicly available data to train AI models. The government's rejection of a TDM exemption means that using Australian creative content for AI training without a licence is a legal risk.
• Ignoring sector-specific AI obligations — Businesses in regulated industries — financial services, healthcare, insurance — face AI-specific obligations from their sector regulator in addition to the general framework. APRA's CPS 230 and CPS 234, for example, impose specific requirements on AI systems used in risk management and operational resilience.
• Underestimating the energy and infrastructure implications of AI — Businesses planning to build or expand AI infrastructure should factor the proposed data centre obligations into their planning now, rather than discovering them after construction has begun.

Australian Regulatory Context

The Australian Standards for AI will sit within a broader regulatory ecosystem that already includes significant AI-related obligations. AI engineers and their clients must navigate this ecosystem carefully.

The Competition and Consumer Amendment (Unfair Trading Practices) Act 2026, passed in July 2026, introduces a new principles-based prohibition on unfair trading conduct that takes effect on 1 July 2027. This provides an enforcement pathway for AI-enabled manipulation — including dark patterns, personalised pricing, and algorithmic nudging — that businesses must factor into their AI system design.

APRA's letters to regulated entities in April and May 2026 made clear that AI governance is now a core component of CPS 230 (operational risk) and CPS 234 (information security) compliance. Financial services businesses using AI in risk management, credit assessment, or customer-facing applications face specific obligations around model risk management, explainability, and human oversight.

The Office of the Australian Information Commissioner (OAIC) has also signalled that it will take an active role in enforcing the Privacy Act ADM obligations from December 2026, and that it expects organisations to have their transparency frameworks in place well before the deadline.

Questions to Ask When Engaging an AI Engineer

Choosing the right AI engineer is critical as Australia moves toward a mandatory AI governance framework. The following questions will help you assess whether a prospective AI engineer has the expertise and governance awareness your business needs.

• Are you familiar with the proposed Australian Standards for AI and the Office of AI? — Look for an AI engineer who is actively tracking the development of the new framework and can advise you on how it will affect your business.
• How do you approach AI transparency and explainability? — Ask for specific examples of how the engineer has designed AI systems to support transparency disclosures and human oversight.
• How do you manage AI training data licensing? — A responsible AI engineer should have a clear process for verifying that training data is appropriately licensed, particularly for Australian content.
• How do you handle AI model documentation and audit trails? — Ask about the engineer's approach to documenting model architecture, training data, decision logic, and performance metrics.
• Are you familiar with sector-specific AI obligations in my industry? — If your business operates in a regulated industry, ensure your AI engineer understands the specific obligations that apply to your sector.
• How do you stay current with AI regulation developments? — AI regulation is evolving rapidly. Look for an engineer who actively monitors regulatory developments and can advise you proactively.

How MyMoney® Can Help

As Australia's AI regulatory landscape transforms, businesses need AI engineers who combine deep technical expertise with a thorough understanding of the emerging compliance framework. The Australian Standards for AI, the Privacy Act ADM obligations, and sector-specific requirements create a complex environment that demands professional guidance.

MyMoney® connects Australian businesses with experienced AI engineers who understand both the technical and regulatory dimensions of AI deployment in Australia. Whether you need help designing a compliant AI system, preparing for the new standards, or navigating sector-specific AI obligations, our marketplace makes it easy to find the right professional.

Post a Brief to describe your AI engineering needs and receive proposals from qualified professionals. Or Browse AI Engineers to explore profiles, expertise areas, and client reviews. The time to prepare for Australia's AI governance future is now.