Australia Is Moving to Legislate AI Standards. Here's What That Means for Your Business

For the past couple of years, Australia's answer on AI regulation has been "not yet". The December 2025 National AI Plan leaned on existing laws, sector regulators and voluntary guidance rather than a standalone AI Act. That position has now shifted.

On 15 July 2026, the Prime Minister announced plans to legislate the Australian Standards for AI and established an Office of AI inside the Department of the Prime Minister and Cabinet. National Cabinet is considering the Standards this August, and legislation is expected to be introduced to Parliament in early 2027.

If you run an SMB and your first instinct is to file this under "problems for 2027", I get it. But if you have watched professional services firms scramble through any new compliance regime, you already know how this movie goes: the businesses that started early did the work calmly and cheaply, and the ones that waited paid consultants a premium to panic on their behalf.

What we actually know so far

It's worth separating the confirmed from the speculative, because there will be a lot of vendor noise about this.

Confirmed: the government intends to legislate the Australian Standards for AI; an Office of AI now exists within PM&C to coordinate; National Cabinet considered the Standards in August 2026; and draft legislation is expected in early 2027. The earlier settings (existing laws, sector regulators, the Australian AI Safety Institute, voluntary guidance) remain in force in the meantime.

Not yet known: the final scope, which obligations will apply to small businesses versus developers of AI systems, transition timelines, and penalties. Anyone selling you a compliance package with those details today is guessing.

Why this lands differently for SMBs

Most Australian SMBs are no longer AI bystanders. Adoption has roughly doubled in eighteen months, and it's concentrated in exactly the areas regulation tends to care about: customer data, decisions and money.

That gap (most businesses using AI, almost none with mature practices around it) is precisely what standards legislation exists to close. Which tells you roughly what the obligations will look like even before the drafting is public: know what AI you use, know what data it touches, be able to show a human is accountable for what it does.

Regulation rarely rewards the clever. It rewards the documented.

Five things worth doing before the rules land

None of these require guessing the legislation. All of them are things a well-run business should have anyway, and each one gets cheaper the earlier you do it.

1. Build an AI register. One spreadsheet: every AI tool in use, who uses it, what data goes in, what decisions it touches. If you've read our piece on Shadow AI, this is the same audit. Legislation just turns it from good hygiene into likely obligation.
2. Write the one-page AI policy now. Approved tools, prohibited data, who signs off on new ones. When standards arrive, you'll be editing a document instead of starting one.
3. Put a human accountability line on every automated decision. For each place AI acts on a customer (scoring, routing, drafting, pricing) name the person accountable for its output. This is the near-universal core of every AI standards regime published anywhere.
4. Fix your data governance where it actually lives. For most SMBs that's the CRM. Access controls, retention, knowing which fields hold personal information. Standards compliance will be measured against systems, and for you the system is the portal.
5. Ask your vendors the question in writing. "How will your product help us comply with the forthcoming Australian AI Standards?" You'll learn a lot from who answers plainly and who sends marketing.

The lesson from the last deadline

We spent a good part of the last year helping newly regulated businesses get ready for obligations they had never carried before, and the pattern was unmistakable. The requirements were knowable months in advance. The businesses that treated them as an operations project (records, systems, one accountable owner) sailed through. The ones that treated them as a legal emergency in the final quarter paid three times as much for the same outcome, delivered worse.

AI standards will run the same course. The difference is you're reading this at the start of the window, not the end.

The takeaway

Australia is moving from voluntary AI guidance to legislated standards, with an Office of AI to drive it and legislation expected in early 2027. The details aren't final; the direction is. Every sensible preparation step is something your business benefits from regardless: an AI register, a short policy, accountable humans and clean data governance.

Start the spreadsheet this week. Future you, reading the draft legislation next year, will be very glad it exists.