AI governance in Australia: what the rules ask of a board.

01What the rules actually are

For two years Australia consulted on mandatory guardrails for high-risk AI. The National AI Plan, released in December 2025, paused them. The government committed instead to managing AI through existing legal frameworks, with targeted reform where gaps appear, and an AI Safety Institute of about $30 million from 2026 to monitor the technology and advise industry and ministers, ABC News reported.

The voluntary guidance changed too. In October 2025 the National AI Centre's Guidance for AI Adoption replaced the Voluntary AI Safety Standard of September 2024, consolidating its ten guardrails into six essential practices. It creates no new legal duties, and it comes with templates, including an AI register.

1. Decide who is accountable.
2. Understand impacts and plan accordingly.
3. Measure and manage risks.
4. Share essential information.
5. Test and monitor.
6. Maintain human control.

02The laws a board already answers to

• Directors' duties. ASIC's position is that directors' duties of care and diligence extend to the adoption, deployment and use of AI, and that directors should know where their company uses it and relies on it.
• The Privacy Act 1988. Personal information in AI inputs and outputs is covered, and from 10 December 2026 privacy policies must describe decisions made or substantially assisted by computer programs, AI included.
• Consumer law. Misleading or deceptive conduct is prohibited whether a person or an AI tool produces it.
• Anti-discrimination law. A discriminatory decision is unlawful whether or not AI informed it.
• Sector rules. APRA-regulated entities answer to its prudential standards on operational risk and information security, and to its April 2026 expectations on AI.

03What the director's guide asks

The Australian Institute of Company Directors and the Human Technology Institute published version two of A Director's Guide to AI Governance on 29 June 2026, with a summary and checklist for small business and not-for-profit boards. Three expectations stand out.

• An AI register. The inventory should track all approved AI systems or tools with key information about them, with a process to update it regularly. It should include the AI the board and management use themselves.
• Accountability. Most large organisations should have one or more senior executives accountable for AI governance.
• Returns. The guide gives a section to measuring what AI returns, alongside the risks it carries.

The guide's own survey shows why. In a late-2025 survey of 419 directors and senior executives, 90 percent of organisations were using or planning to use AI, and nearly a third reported at least one use of agentic AI. Asked who is primarily responsible for AI operating safely and lawfully, 21.8 percent named the board.

ASIC's chair put the expectation plainly at the AICD's governance summit in March 2026: every board needs to have a conversation about AI use and determine its risk appetite and policies.

04Two dates on the calendar

From 10 December 2026, the automated decision-making transparency obligation applies. An organisation covered by the Privacy Act must describe in its privacy policy the decisions that computer programs, AI included, make or substantially assist, where those decisions could significantly affect people.

For banks, insurers and superannuation trustees, APRA's letter to industry of 30 April 2026 is already in force as a supervisory expectation. It asks for an inventory of AI tooling and use cases with ownership and accountability, and for boards with enough literacy to challenge management on AI. APRA found that governance and assurance practices were not keeping pace with AI adoption.

05Eight questions a board should ask about AI this quarter

1. Can we list every AI system and agent running in the business, with an owner for each?
2. What did AI cost us this year, attributed to a business unit, and who signed off each increase?
3. Who approved each agent that takes actions on our behalf, and what scope did they approve?
4. Which of our AI systems use personal information, and which decisions about individuals do they inform or make?
5. Does our privacy policy describe those decisions in the terms the law requires from 10 December 2026?
6. When an agent's model or tools change, does its approval come up for review?
7. If a regulator asked what an agent did last month, how long would the answer take?
8. Who in management is accountable for the answers to questions one to seven?