Every Australian AI framework on one page
There are more frameworks than laws. Most of them are voluntary, most of them overlap, and only a few are written for a business your size. This page says what each one is, who wrote it, and whether you need to care.
The one-minute version
- Australia has no AI-specific law. The mandatory guardrails proposed in 2024 were formally abandoned in the National AI Plan released on 2 December 2025, in favour of updating existing laws and issuing guidance. The obligations that bind a business today come from existing law: privacy, consumer law, employment law, and sector rules.
- What exists instead is guidance. The federal Guidance for AI Adoption (October 2025) is the one written for ordinary businesses. Everything else is either for government, for developers, or for organisations large enough to want a certificate.
- If you read one thing, read the six practices in the Guidance for AI Adoption. If you hold personal information, read the OAIC's guidance on AI products as well. That is the whole reading list for most businesses under 50 staff.
Frameworks are what larger customers, insurers and tender panels quote back at you. "Which framework do you follow?" is now a line in supplier questionnaires. You do not need to follow all of them. You need to know which one applies to your situation and be able to say so in a sentence.
The frameworks, and who each one is for
| Framework | Who wrote it | Who it is for | Do you need it? |
|---|---|---|---|
| Guidance for AI Adoption (2025) | Department of Industry, Science and Resources, with the National AI Centre | Any Australian organisation using AI. Six essential practices, published by the National AI Centre on 21 October 2025, in a foundations version for organisations starting out and an extended version for those scaling AI. | Yes. This is the baseline. It is voluntary but it is what everyone else measures you against. |
| Voluntary AI Safety Standard (2024) | Department of Industry, Science and Resources | The ten-guardrail predecessor of the Guidance. Published 5 September 2024 and formally replaced by the Guidance for AI Adoption on 21 October 2025. | No. Read the Guidance instead. Know the name in case a customer or a questionnaire still cites it. |
| Australia's AI Ethics Principles (2019) | Australian Government | Eight principles: human, societal and environmental wellbeing; human-centred values; fairness; privacy protection and security; reliability and safety; transparency and explainability; contestability; and accountability. | Useful language for a policy. Not a checklist. |
| OAIC guidance on commercially available AI products (2024) | Office of the Australian Information Commissioner | Any business covered by the Privacy Act that uses AI tools with personal information. | Yes if the Privacy Act applies to you. It is the regulator's own position, and it is short. |
| NSW AI Operational Policy 2026 and the NSW AI Assessment Framework | NSW Government (Department of Customer Service, Digital NSW). Made mandatory for agencies by circular DCS-2026-02 on 30 July 2026. | NSW Government agencies, and their suppliers when AI is part of what is delivered. Every agency must appoint an accountable official, register every AI use case, assess it with the 16-question framework, and refer high and critical risk cases to the AI Review Committee. | Only if you sell to NSW Government. Then yes, because your customer has to assess what you supply and will ask you the framework's questions. The NSW page explains how to borrow it anyway. |
| Commonwealth AI policy for government | Digital Transformation Agency | Australian Government agencies and the AI systems they buy. | Only if you sell AI-enabled services to the Commonwealth. |
| ISO/IEC 42001 (2023) | International Organization for Standardization | Organisations that want an auditable AI management system and a certificate. Mostly software vendors, regulated firms and government suppliers. | Not for most small to medium businesses. Relevant if a large customer asks for it or you sell AI products into enterprise. |
How to answer "which framework do you follow?"
For most businesses the right answer is one sentence: "We follow the Australian Government's Guidance for AI Adoption, and we handle personal information in line with the OAIC's guidance on AI products." If you can say that and point to a written set of AI rules for your team, you are ahead of the customer asking the question.
If you supply government, add the relevant state or Commonwealth policy. If you build AI products, ISO 42001 becomes a real conversation. For everyone else it is a distraction.
The one thing to do next
Take the two-minute Exposure Check. It tells you which of these you actually need to act on, based on what your business holds and who it sells to.
Where to check for yourself
- Guidance for AI Adoption (DISR)
- Voluntary AI Safety Standard (DISR)
- Australia's AI Ethics Principles
- OAIC: privacy and the use of commercially available AI products
- NSW AI Assessment Framework (Digital NSW)
- ISO/IEC 42001
4 Sep 2026: first published. 16 Sep 2026: NSW row updated for the AI Operational Policy 2026 and circular DCS-2026-02. Next check: when the Australian Government releases anything under the National AI Plan that changes the voluntary status of the Guidance.