Is it legal to use AI in your Australian business?

Is there an AI Act in Australia?

No. The federal government’s National AI Plan, released on 02/12/2025, chose to rely on existing laws and regulators rather than a standalone AI Act, and did not pursue the mandatory guardrails it proposed in September 2024. The main AI-specific document for business is the National AI Centre’s Guidance for AI Adoption, which is voluntary. Your legal obligations come from privacy, consumer, spam and professional law applied to what your AI does.

Date	What happened	What it means for a small business
05/09/2024	Voluntary AI Safety Standard (10 guardrails) and a proposals paper on mandatory guardrails	Voluntary only
21/10/2025	Guidance for AI Adoption replaces the voluntary standard	A voluntary six-practice checklist
25/11/2025	Australian AI Safety Institute announced, inside the industry department	No new duties for business
02/12/2025	National AI Plan: existing laws and regulators, no AI Act	Comply with the laws you already know
20/07/2026	AI consumer-safety priorities announced, including a legislated Digital Duty of Care and privacy tranche 2	Watch for bills

Sources: the National AI Plan, the Guidance for AI Adoption and the minister’s AI consumer-safety priorities, checked October 2026.

The guidance’s six essential practices are: decide who is accountable, understand impacts and plan accordingly, measure and manage risks, share essential information, test and monitor, and maintain human control. For a ten-person business, that means a named owner for each AI tool, a list of what each touches, and a person checking anything that matters.

Which regulators oversee AI use in Australia?

There is no single AI regulator. The OAIC enforces the Privacy Act, the ACCC the Australian Consumer Law, and the ACMA the Spam Act and Do Not Call rules. Health practitioners also answer to AHPRA, and the TGA regulates AI software that suggests diagnoses. Financial services licensees answer to ASIC, lawyers to their legal profession regulators and courts, and tax agents to the Tax Practitioners Board. Each applies its existing rules to AI.

Regulator	Law or role	What it means for AI
OAIC	Privacy Act, Australian Privacy Principles, Notifiable Data Breaches	Personal information going into or out of AI is covered. Its AI guidance recommends keeping personal and sensitive information out of public AI tools
ACCC	Australian Consumer Law	You are responsible for claims your AI writes or says, and AI-written fake reviews are fake reviews
ACMA	Spam Act, Do Not Call Register	AI-written marketing emails and SMS need consent, sender identification and a working unsubscribe (ACMA)
AHPRA	Health practitioner standards and advertising	The practitioner stays responsible and AI scribes need informed consent (AHPRA); testimonials about clinical aspects are banned
TGA	Medical devices	A digital scribe that suggests diagnoses or treatment must be in the ARTG
ASIC	Financial services and credit licensees	Governance must keep pace with AI use (REP 798, 29/10/2024)
Legal profession regulators and courts	Conduct rules and court practice notes	No confidential or privileged information into public AI tools, and lawyers verify every output (NSW, WA and Victorian joint statement, 06/12/2024)
Tax Practitioners Board	Code of Professional Conduct	The registered agent stays responsible for AI-assisted work

Is it legal to use AI for emails, marketing, health notes or hiring?

Yes, with conditions attached to each. The law regulates what the AI does on your behalf, not the fact that you used it. Marketing still has to meet the Spam Act, claims still have to be true under the Consumer Law, personal information is still handled under the Privacy Act, and health, legal and tax professionals stay personally responsible for AI-assisted work. The table below gives the condition for each common use.

Using AI for	Legal?	The condition
Drafting customer emails and replies	Yes	A plan that does not train on your data, sensitive details kept out, and a person checking refunds, complaints and promises
Marketing emails and SMS	Yes	Consent, your business identified, and a free unsubscribe actioned within 5 working days
Ads, web copy and product claims	Yes	Every claim must be true and able to be backed up; AI-written claims are your claims
A website chatbot or AI receptionist	Yes	Say it is AI, keep it to answers you have approved, and hand anything unusual to a person
Asking for and replying to reviews	Yes	No fake reviews, no reviewing yourself or competitors, disclose incentives, never suppress negative ones (ACCC)
Clinical notes with an AI scribe	Yes, with conditions	Informed patient consent noted in the record, every note checked, and any scribe that suggests diagnoses must be in the ARTG
Health practice marketing	Yes, with limits	No testimonials about clinical aspects, and you are responsible for reviews on platforms you control (AHPRA)
Legal research and drafting	Yes, with limits	No confidential or privileged material in public AI tools, every output verified; in NSW, no AI-generated content in affidavits, witness statements or character references (SC Gen 23)
Bookkeeping and tax work	Yes	The Tax Practitioners Board’s Code still applies and the registered agent stays responsible
Screening job applicants	Yes, with care	Anti-discrimination law applies to the decision whoever or whatever makes it; have a person review rejections
Decisions that significantly affect people	Yes	From 10/12/2026, covered businesses must disclose substantially automated decisions in their privacy policy
AI-voiced sales calls	Yes, with limits	Do Not Call Register rules apply to telemarketing calls
AI-generated or edited images	Yes	Images must not mislead; NSW rental listings altered to hide faults will need disclosure, expected from early 2027 (NSW Government)

On chatbots, the warning case is Moffatt v. Air Canada (2024), where a Canadian tribunal held the airline responsible for wrong refund advice from its website chatbot. It is not Australian law, but it shows the risk. On customer data, the AI plan you choose decides whether the privacy conditions are met: our guide on whether customer data is safe in ChatGPT or Claude covers plans, the never-paste list and a privacy policy template.

What are the penalties for getting it wrong?

The largest are under the Australian Consumer Law. For conduct on or after 28/03/2026, a company can be fined up to the greater of $100 million, three times the benefit gained, or 30% of adjusted turnover. Privacy penalties are now tiered, from OAIC infringement notices up to civil penalties for serious interferences with privacy, and individuals can sue for serious invasions of privacy. Spam breaches are actively enforced too.

• Consumer Law. Conduct before 28/03/2026 falls under the earlier $50 million regime (ACCC fines and penalties).
• Privacy Act. The 2024 amendments added OAIC infringement and compliance notices and a mid-tier civil penalty, and a statutory tort for serious invasions of privacy started on 10/06/2025 (OAIC).
• Spam Act. Lululemon paid $702,900 in March 2026 over more than 370,000 emails, including order emails carrying marketing content, sent without an unsubscribe (ACMA). AI makes it easier to send more messages, and easier to repeat a mistake at scale.
• Professional rules. Regulators such as AHPRA and the legal profession boards can take disciplinary action, which for a practitioner can matter more than a fine.

What AI and privacy rules are coming?

Three things are moving. From 10/12/2026, privacy policies must disclose substantially automated decisions that significantly affect people. The privacy tranche 2 exposure draft, released on 31/08/2026, proposes a fair-and-reasonable test for handling personal information and 72-hour breach notification, but is not yet in Parliament. And on 20/07/2026 the government named a legislated Digital Duty of Care among its AI consumer-safety priorities.

When	Change	Status
10/06/2025	Statutory tort for serious invasions of privacy	In force
10/12/2026	Privacy policies must disclose substantially automated decisions that significantly affect people (APP 1)	Legislated
By 10/12/2026	Children’s Online Privacy Code	Due
Exposure draft, 31/08/2026	Privacy tranche 2: fair-and-reasonable test, 72-hour breach notification, erasure right against large platforms only, small business exemption kept	Consultation closed 18/09/2026; not yet in Parliament
Announced 20/07/2026	Legislated Digital Duty of Care	Government priority
Early 2027 (expected)	NSW: disclose AI-generated or altered rental listing images that hide faults, penalty up to $22,000	Passed September 2026

Sources: the Parliamentary Library’s bills digest on the 2024 amendments and the Attorney-General’s Department’s privacy reform consultation, checked October 2026.

What should an Australian small business do now?

Name one person responsible for each AI tool, list what data each tool touches, move customer data onto business plans or API-based systems, write a one-page staff rule, check AI-written claims before they go out, keep marketing inside the Spam Act, keep a person on decisions that matter, and update your privacy policy before 10/12/2026. For routine AI use, that covers most of the legal risk.

1. Name an owner for each AI tool (the guidance’s first practice).
2. Keep a one-page AI register: tool, plan, purpose, what data goes in.
3. Put customer data on a business plan or API-based system that is not used for training by default.
4. Write the never-paste rule: tax file numbers, card and bank details, health information and privileged material stay out of chat apps.
5. Tell people when they are dealing with AI. Never let a bot pose as a person.
6. Check every claim before it is published. Prices, results and “Australia’s best” must be true and provable.
7. Keep marketing inside the Spam Act: consent, your business name and a working unsubscribe.
8. Keep a person on judgement calls: refunds, complaints, job application rejections, and clinical, legal, financial or tax advice.
9. Update your privacy policy: AI use, overseas processing and, from 10/12/2026, substantially automated decisions.
10. Check your professional body’s guidance. Our guides to AI for allied health practices, AI for law firms and AI for accountants using Xero go deeper for each profession.

When should you get legal advice about AI?

Get advice before you build anything that makes decisions about people (credit, eligibility, hiring), processes health or other sensitive information at scale, gives regulated advice, or creates brand-defining assets such as a logo, where Australian law on who owns AI output is unsettled. This guide is general information, not legal advice.

How On Autopilot can help

On Autopilot builds AI agents that work inside these rules. Our AI Front Desk ($1,500 setup plus $199 a month) never pretends to be a person, never asks for payment details, never asks for more health information than your own intake form already does, and hands anything unusual to your team. The AI Lead Engine ($2,000 setup plus $499 a month) qualifies each enquiry and drafts a reply in your voice, with your rules deciding what goes out straight away and what waits for a person. Both run on the Claude API, which is not used for training by default. We are not lawyers, but the free 30-minute AI audit with Jenn Yang flags the privacy and professional limits in your industry before anything is built. Managed AI starts at $1,500 a month.