Australia: Role Guide

Verification required. Claims on this page about Australian law were compiled on 7 October 2026 from secondary web sources and from memory of the law. No primary legal text was read, and each claim is tagged [Reported], [Recalled], [Conflict] or [Unverified] as explained on the section home page. Check the primary text before relying on any of them. This is not legal advice.

Use the Australia AI Regulatory Hub for instrument detail, and the templates in this section.

AI practitioners

For engineers, data scientists and security staff.

• Record which automated decisions significantly affect people, and the data and automation level each one uses (AU-T1).
• Provide explanations that match your automated decision-making (ADM) statement.
• Control shadow AI. Staff using personal accounts is a reported risk.

Product companies

For vendors, SaaS providers and platforms.

• Give customers the facts they need for their own ADM statements.
• Avoid misleading claims about AI capability.
• Expect APRA-regulated customers to pass CPS 230 and CPS 234 duties down to you.

Auditors

For internal, external and assurance auditors.

• Test that ADM statements match the actual systems.
• Check shadow AI controls.
• Treat penalty claims as unverified until confirmed.

Implementors

For programme leads, GRC teams, CISOs and DPOs.

• Build an ADM register before 10 December 2026.
• Update privacy policies and notices.
• Adopt the Guidance for AI Adoption practices as policy headings (AU-T2).

Shared evidence list

• ADM register
• Privacy notices
• Shadow AI discovery
• Impact assessments
• Vendor due diligence

Report limitation sentence for auditors

"Criteria were taken from a regulatory register dated 7 October 2026, compiled from secondary sources and not verified against primary legal text. This report is not a legal opinion."