When the National AI Plan was launched in December 2025, the Australian Government confirmed that it would not legislate a standalone AI Act. This decision drew binary responses: one group called it sensible pragmatism, the other a dangerous delay.

Focusing on where government has quietly made AI rules mandatory reveals a more coherent, if uneven, architecture than the “no Act” headline suggests. With the rapid rise in AI adoption, the Australian Government must continue to iterate through responsive approaches that no single Act could achieve. To do so, the Government could provide greater resources and technical capabilities to sectoral regulators, give greater definitional certainty through forthcoming Acts and ensure that privacy standards provide clear mandatory guardrails in the forthcoming Privacy Act.

The default is voluntary, with three exceptions

Up until now, the default regulatory position for technology companies has been voluntary and principles-based. New Australian AI Standards were announced in July 2026, with next steps discussed at the National Cabinet in August 2026, though the details of the safety-related plans remain unclear.

The National AI Plan sets out, among other actions, how to keep Australians safe through existing technology-neutral laws, including by establishing the AI Safety Institute. The National AI Centre’s Guidance for AI Adoption is the primary reference point for organisations trying to work out what “responsible AI” looks like in practice, but it carries no legal force. Businesses that ignore it face no direct penalty.

Critics, including legal academics, have called this false comfort: most of the laws being relied on were written before generative AI existed. This sort of criticism is steeped in recent experience: Australia’s Robodebt experience remains a stark reminder of what happens when an automated system outruns its oversight.

However, mandatory obligations exist, even though they are adopted unevenly. By pinpointing those regulatory levers, a more coherent picture of AI governance in Australia emerges.

1. Government has set a higher bar for itself

The government itself has set a high bar for Responsible AI in public administration. From 15 June 2026, the Digital Transformation Agency’s (DTA) updated Policy for the Responsible Use of AI in Government makes it mandatory for non-corporate Commonwealth agencies to maintain an internal register of every in-scope AI use case. This requires agencies to assign each case an accountable owner and complete an impact assessment covering fairness, safety, privacy, transparency, security and human-centred values before deployment. Foundational AI training also becomes compulsory for all Australian Public Service (APS) staff. Nothing equivalent is required of the private sector.

This is effectively government using its own operating standards to model the kind of governance it wants to see more broadly, but will only work if government is willing to remain consistently accountable. The tension is evident in the government’s own National Disability Insurance Scheme (NDIS) reforms, which would allow automated systems to make “evaluative determinations” in assessment processes that directly affect vulnerable Australians. This is precisely the kind of high-stakes, individual-facing automation the DTA policy was designed to govern carefully inside government’s own walls.

2. Mandatory rules are reactive, not general

The second cluster of mandatory obligations responds to harms that have already surfaced, rather than anticipating new ones. The Competition and Consumer Amendment (Unfair Trading Practices) Bill, passed in July 2026, introduces a technology-neutral prohibition on manipulative and distorting trading conduct. The bill's terms are designed to capture AI-enabled dark patterns, even though the drafting deliberately avoids naming AI directly.

Both instruments share a structure: identify a concrete, already-visible harm in a specific context, then extend an existing regulatory framework (consumer law) to cover it. Neither attempts to define or govern “AI” as a category.

3. At least one sector looked and decided not to legislate

The clearest evidence against the idea that Australia is moving too slowly toward inevitable AI-specific law comes from the health industry. The Therapeutic Goods Administration’s (TGA) review of whether AI in medical devices needed bespoke regulation found that 91 per cent of stakeholders considered its existing technology-agnostic framework robust enough to cope, with only targeted refinements to terminology and lifecycle responsibility flagged as necessary. That is a regulator actively testing the “do we need an AI law” question in its own domain, in public, and concluding in the negative.

Why this uneven AI governance model might be the right answer, not a failure

There is a strong case that a standalone AI Act would never have solved the actual governance problem. Most AI harms arise not from the underlying technology itself, but from the context in which it is deployed in a workplace, a health service, or a consumer transaction.

A single economy-wide standard is a blunt instrument that can be harmful or harmless depending on the application. From this perspective, the unevenness we are seeing in Australia might not be a delay for a gap in AI governance that will be filled later with a comprehensive AI Act. It may be the beginning of a deliberately sectoral approach in which supervision, monitoring and enforcement are carried out by regulators who understand the relevant context.

The most successful example is finance, where the Australian Prudential Regulation Authority (APRA) has gone further than most on AI-related corporate governance, built on work of the UTS Human Technology Institute. The Marketing industry is another sector where there has been discussion regarding AI disclosure and governance. Advertising, sales and customer service are areas of concern as they deal directly with consumers and their decision-making relates to issues of transparency, privacy and deception. This concern has reached the National AI Centre, which has provided advice in its guidance, Be clear about AI-generated content. As AI becomes more common in Marketing activities, pressure will grow for disclosure when customers interact with AI systems.

These examples highlight that the AI technology itself is not regulated, but the content it produces.

The unevenness only works if government finishes the job

Treating sector-by-sector regulation as a workable model rather than an incomplete one is a defensible approach, but it depends entirely on delivery. Three policy opportunities emerge.

1. Unlocking sectoral regulators' access to resources and technical capabilities to supervise AI risk effectively will be essential to ensure they can respond to emerging challenges. The new Office of AI in the Department of Prime Minister & Cabinet can leverage cross-government regulatory resources to allow sectoral regulators to take this forward. Practically, this could include shared access to technical expertise, AI risk-assessment capabilities and specialist advisory resources. This could build on the Australian Government’s existing Guidance for AI adoption, which provides practical guidance on areas including accountability, risk management, testing, monitoring and human oversight.
2. Definitional certainty is needed through instruments such as the Unfair Trading Practices Bill to resolve disputes with fast, practical guidance rather than years of ambiguity and costly litigation. Government could support this through clear statutory definitions accompanied by regulator-issued guidance, worked examples and sector-specific scenarios that can be updated as AI technologies and practices evolve.
3. Privacy standards will need to provide the flexibility of sectoral regulators to act when issues are on the horizon. The Privacy Act’s automated decision-making transparency obligations land in December 2026, the first real test of whether sectoral reform can move fast enough to matter. Government could support implementation through practical regulatory guidance on automated decision-making and mechanisms for regulators to review and update that guidance as new AI-enabled decision-making practices emerge.

These three steps will allow more adaptive approaches to AI governance than a single AI Act could ever achieve. Australia’s AI governance model is not an accident born of political caution, it is an emerging architecture, uneven by design, built on the premise that AI harms are best regulated in the context where they occur. The sustainability of this premise depends on ensuring that sectoral approaches have the regulatory levers and adaptive capacities necessary to handle emerging challenges with an ever-evolving technology.

 Dr Amara Atif is a Senior Lecturer in Computer Science at the University of Technology Sydney (UTS). Her research focuses on human-centred AI, learning analytics, and translating emerging technologies into responsible and inclusive higher education policy and practice.

Professor David Waller is a Professor of Marketing at the University of Technology Sydney. His research focuses on advertising and marketing communication, ethics and education.

Professor Dilek Cetindamar Kozanoglu is a Professor of Contemporary Technology Management in Computer Science at the University of Technology Sydney. Her research focuses on entrepreneurship, and technology and innovation management.

Image credit: Canva