The six frontier AI obligations as controls and evidence a business can hold today

Piper Alderman says the announcement does not specify a commencement date or any specific thresholds for which companies or models fall in scope. It says most Australian organisations will not be frontier AI companies and that the obligations are not directed at them.

For an organisation that uses AI, Piper Alderman advises assessing whether that use gives rise to automated decision-making transparency requirements. Those requirements are in Part 15 of Schedule 1 to the Privacy and Other Legislation Amendment Act 2024. Part 15 commences on 10 December 2026 and adds Australian Privacy Principle 1.7.

The obligation covers every stage, so the control set starts at design and ends at retirement. For an AI system that means the data it is trained or run on, the pipeline that builds it, the permissions it holds in production and the logs it writes.

The Guidance for AI Adoption lists applying the Essential Eight Maturity Model to AI systems among its cybersecurity processes. Input and output controls, tool permissions and tenant boundaries sit beside the secure development controls in ISO/IEC 27001 Annex A 8.25 to 8.31 and the life cycle controls in ISO/IEC 42001 Annex A.6.

Give each AI system its own entry in the risk register: what it does, the data it reaches, what could go wrong, who owns the risk and how it is treated.

ISO/IEC 42001 asks for the risk assessment in clause 8.2, the treatment in clause 8.3 and an impact assessment in clause 8.4 for systems that affect people. Review each entry at a planned interval and after any significant change to the system or its use.

The release says only that companies will be required to allow independent evaluation of their models. The committee recommended independent, qualified and, over time, accredited individuals embedded in frontier labs with employee-like access. The government has not said which form evaluation will take.

For a business, independence means the people who test a system did not build it. The Guidance for AI Adoption asks for independent review, internal or external, of testing and evaluation for general-purpose AI systems and use cases that need enhanced practices. Its examples of safety evaluation include testing for jailbreaking or prompt manipulation, and red teaming.

The release sets no deadline beyond the word rapidly and does not define an incident. The Joint Select Committee on Artificial Intelligence recommended clear reporting deadlines. Its letter lists events that may be reported to a proposed parliamentary standing committee, including significant cyber incidents involving AI and unintended actions of AI agents and models.

A business can write the runbook around existing duties. An entity that suspects an eligible data breach must take all reasonable steps to complete its assessment within 30 days. The Guidance for AI Adoption asks developers and deployers to maintain two-way communication for incident reporting.

Build the AI inventory first, because every later check draws on it. The Guidance for AI Adoption asks for an organisation-wide inventory of each AI model and system that records accountable people, purpose, identified risks, the risk treatment plan and dates of review.

The committee's final report is due by 30 November 2026, and Australian Privacy Principle 1.7 commences on 10 December 2026. The government says further details of the legislation will become available as it completes its detailed work and consultation.