Australian Government says it will legislate six safety and security obligations for frontier AI companies
The government says it will propose a new targeted regulator for AI safety to enforce the obligations. It also released and accepted the 18 recommendations of a rapid review into an AI agent's infiltration of an Australian Government health website.
What the government announced
The Prime Minister, the Deputy Prime Minister, the Minister for Home Affairs and Cyber Security and the Minister for Industry and Innovation issued a joint media release on 10 November 2026. It says mandatory safety and security protections will be legislated through the Australian AI Standards.
The government will propose a new targeted regulator for AI safety, working with the Australian AI Safety Institute. The regulator would be able to enforce significant penalties for AI companies that fail to comply. Companies will be required by the regulator to do six things.
- Maintain security controls across all stages of development and deployment
- Identify and manage serious risks associated with their models
- Allow independent evaluation of their models
- Provide mandatory notification of incidents to the Australian Government rapidly
- Maintain and publish safety and security frameworks to ensure good governance, risk management and transparency
- Respond to updated standards and rules as technologies change
Timing, definitions and where the six came from
The release gives no penalty amount or start date and does not define an incident or a serious risk. The only timing it gives for incident notification is the word "rapidly". Piper Alderman says the announcement does not include draft legislation. A release of 15 July 2026 said the standards were "expected to be legislated early next year".
The government says the protections are aligned with interim report recommendations from the Joint Select Committee on Artificial Intelligence, whose final report is due by 30 November 2026. A second release on 10 November says the government accepted the 18 recommendations of a rapid review into an AI agent's infiltration of an Australian Government health website.
Who has to act
The release says the protections will apply to all frontier AI companies that wish to operate in Australia. Piper Alderman says most Australian organisations will not be frontier AI companies and that the obligations are not directed at them.
For an organisation that uses AI, Piper Alderman advises assessing whether that use gives rise to automated decision-making transparency requirements. Those requirements are in Part 15 of Schedule 1 to the Privacy and Other Legislation Amendment Act 2024. Part 15 commences on 10 December 2026 and adds Australian Privacy Principles 1.7 to 1.9.
What Australian Privacy Principle 1.7 covers
Principle 1.7 covers an APP entity that has arranged for a computer program to make a decision, or to do a thing substantially and directly related to making one. The decision must be one that could reasonably be expected to significantly affect an individual's rights or interests, and the program must use personal information about that individual.
The amendment applies to decisions made after it commences, whether the program was arranged before or after that day.
The release describes frontier AI as the most sophisticated models and gives no legal definition or threshold. It lists no requirement for organisations that deploy or use AI.
What to do now
List each computer program that makes, or does a thing substantially and directly related to making, a decision that could significantly affect an individual. From 10 December 2026 the privacy policy must state the kinds of personal information those programs use, the kinds of decisions made solely by them, and the kinds of decisions they do such a thing for.
The incident response plan comes second, because the 30-day assessment duty already applies. An entity that suspects an eligible data breach must take all reasonable steps to complete its assessment within 30 days.
- Privacy policy: check it states the decisions about individuals that programs make or help make and the personal information used
- Incident response plan: check it names AI-related events and a step to assess a suspected data breach within 30 days
- Supplier contracts: check how each AI supplier reports incidents to you and how you report faults back
- AI register, if you build AI or have higher-risk uses: check each system lists accountable people, purpose and risks
Where the supplier and register checks come from
Piper Alderman suggests organisations review incident response arrangements so they address AI-related events, including AI-enabled cyber attacks, and review procurement processes and supplier contracts to account for AI-specific risks.
The implementation guidance in the Guidance for AI Adoption is for teams that build or customise AI systems or manage higher-risk use cases. It asks for an inventory of each AI model and system, and for two-way communication between developers and deployers for incident reporting. An organisation earlier in its AI use is told to start with the foundations guidance.
Sources
- PrimaryPrime Minister of Australia, New Australian AI safety and security protections (joint media release, 10 November 2026)Retrieved 15 Nov 2026
- PrimaryPrime Minister of Australia, Strengthening Australia against AI-driven cyber incidents (joint media release, 10 November 2026)Retrieved 15 Nov 2026
- PrimaryJoint Select Committee on Artificial Intelligence, letter to the Prime Minister (12 October 2026)Retrieved 15 Nov 2026
- PrimaryParliament of Australia, Joint Select Committee on Artificial IntelligenceRetrieved 15 Nov 2026
- PrimaryPrime Minister of Australia, AI in Australia's interests (media release, 15 July 2026)Retrieved 15 Nov 2026
- PrimaryFederal Register of Legislation, Privacy and Other Legislation Amendment Act 2024 (No. 128, 2024), section 2 and Schedule 1 Part 15Retrieved 15 Nov 2026
- PrimaryNational AI Centre, Guidance for AI adoption: implementation guidance (5 May 2026)Retrieved 15 Nov 2026
- PrimaryAttorney-General's Department, Privacy Reform consultation paperRetrieved 29 Oct 2026
- SecondaryPiper Alderman, Mandatory AI safety and security protections for frontier AI: Australia sets its direction (11 November 2026)Retrieved 15 Nov 2026
