Compliance
Australia's AI Laws Are Coming. A Timeline for Small Business
What is already law, what is due before Christmas, and what is promised for 2027
Most of what a small business needs to do for 2027 is useful in 2026 anyway: know what your systems do.
For most of the last two years, the Australian answer to "what are the AI rules?" was "the ones you already had": privacy, consumer law, workplace safety and anti-discrimination law, applied to new tools. That is changing. On 15 July 2026 Prime Minister Anthony Albanese announced that Australian Standards for AI would be written into law, and a bill is expected in early 2027.
The details are thin, and several dates in between matter more to a small business than the headline. Here they are in order.
What has happened, and what is coming?
Australia · AI rules, 2026 into 2027
18 February: a NSW workplace duty for "digital work systems" becomes law. Passed on 12 February and assented on 18 February. A digital work system is "an algorithm, artificial intelligence, automation or online platform", and a business using one to allocate work must manage, so far as is reasonably practicable, the risk that it creates excessive workloads, unreasonable performance metrics, excessive surveillance or discrimination. The main duties start later, on proclamation, at least a month after SafeWork NSW publishes its guidelines.
1 July: anti-money-laundering rules reach accountants, lawyers and real estate. Relevant here because a small practice that becomes an AML/CTF reporting entity is treated as covered by the Privacy Act for those activities.
15 July: the announcement. Australian Standards for AI, and a new Office of AI inside the Department of the Prime Minister and Cabinet from that day. The speech named education and training, workplace rights and productivity, and made specific promises about large data centres and copyright.
20 August: a parliamentary inquiry. The Joint Select Committee on Artificial Intelligence was appointed on 20 August. One of its terms of reference is explicitly about the rate of AI adoption, and the barriers to it, for small, medium and family businesses.
26 August: National Cabinet backs the plan. The Commonwealth said it intends to "legislate the AI standards in early 2027", and states and territories committed to "consistent mandatory standards for data centre energy, water and land-use". The July announcement had already reversed the December 2025 decision against a standalone AI Act.
31 August: privacy reform, round two. An exposure draft of the next Privacy Act changes. It leaves the small business exemption in place.
September added pressure. On 22 September Australia joined 19 other countries and the EU in a statement calling for AI to stay under "human direction, oversight and control". A day later, the Prime Minister disclosed that an OpenAI agent had reached non-public files in a Medicare statistics portal, and he raised the notification delay directly with OpenAI's chief executive.
The two dates to put in the diary: 10 December 2026, when privacy policies must list automated decisions, and whatever date SafeWork NSW publishes its digital work systems guidelines, which starts the one-month clock on the NSW duty.
What is still to come?
By 30 November: the inquiry reports. This is the document most likely to say anything specific about small business.
10 December: businesses covered by the Privacy Act must describe, in their privacy policy, the kinds of decisions a program makes about people and the personal information it uses. We cover the test in detail in a separate article.
Early 2027: the AI standards bill. Until it is published, nobody outside government knows what it will require of a business your size.
What should a small business do now?
Everything on this timeline asks the same first question: what AI and automation do you use, and what does it do? Answering it is cheap, useful straight away, and not wasted whatever the 2027 law says.
- Keep a register. Each AI tool or automation, what it does, what information it touches, who owns it.
- Mark anything that makes decisions about people. Clients, applicants, staff. Those are the ones every rule above cares about.
- Check the 10 December rule if you are covered by the Privacy Act.
- If you employ people in NSW and software allocates their work, rosters or targets, note it now and read the SafeWork NSW guidelines when they land.
- Read the inquiry report when it lands at the end of November, or ask someone to summarise it for you.
Sources: France 24/AFP on the 15 July speech, SBS News, Parliament of Australia, Joint Select Committee on AI, NSW legislation, Act No. 5 of 2026, SafeWork NSW, Al Jazeera on the 22 September statement. This article is general information, not legal advice.
Key takeaways
- The detail is not written yetThe 2027 standards were announced with few specifics. Anyone selling certainty about them is guessing.
- Two dates are real now10 December for privacy-policy disclosure of automated decisions, and the NSW workplace duty once SafeWork NSW publishes its guidelines.
- Start with a registerA list of your AI tools, what each does and who owns it is what every one of these rules will ask for first.
Frequently asked
Is there an Australian AI Act?
Not yet. In December 2025 the government decided against a standalone AI Act. On 15 July 2026 the Prime Minister reversed course and announced Australian Standards for AI to be written into law. In August National Cabinet backed legislating them in early 2027, including mandatory standards for large data centres.
Will the new AI laws apply to small businesses?
We do not know yet. The mandatory requirements described so far are mostly about large data centres, copyright and workers. The parliamentary inquiry due to report by 30 November is specifically looking at AI adoption by small, medium and family businesses, so watch that report.
Does the NSW digital work systems law affect me?
If you employ people in NSW and use software, algorithms or AI to allocate their work, it will. Its main duties start on a date set by proclamation, no earlier than a month after SafeWork NSW publishes guidelines. The duty is to manage, so far as is reasonably practicable, the risk that allocating work this way creates excessive workloads, unreasonable metrics, excessive surveillance or discrimination.
What should I do now, before the laws are written?
Keep a register of the AI tools and automations you use, name an owner for each, and check your privacy policy against the 10 December rule if you are covered by the Privacy Act. None of that is wasted, whatever the 2027 law ends up saying.