Australia signals tested-first rules for frontier AI as the privacy regulator opens a smart glasses investigation

Two developments in Australia last week point the same way for any business building or selling AI there: the government wants companies to prove their safety processes work, and the privacy regulator is prepared to use its formal powers when a technology company will not answer its questions.

The minister sets out how frontier AI will be regulated

Speaking at a trust and safety event in Sydney on Thursday 8 October 2026, Andrew Charlton, Assistant Minister for Science, Technology and the Digital Economy, set out the government's approach to the most capable AI models.

His central argument was that voluntary codes are not enough for the most serious risks. In his words, "voluntary regulation and codes are fast and flexible, but they fail the incentive test". He also warned that detailed, prescriptive rules risk falling behind a technology that moves this quickly.

The alternative he described is systems regulation, where the onus sits on companies "to build and run a rigorous process", the government sets the standard that process must meet, and companies are held accountable for whether it works. Reporting of the speech says the approach would be modelled on how Australia regulates banking and aviation, and that overseas AI firms wanting to operate in Australia would first have to show their models have been properly tested to prevent harm. Those rules are still being finalised.

This is a stated direction, not a law in force. But it tells you what will be asked: not whether you have an AI policy, but whether you can show your risk process exists, runs, and catches problems.

The OAIC opens an investigation into a smart glasses app maker

On 7 October 2026 the Office of the Australian Information Commissioner opened an investigation into Shenzhen Qingcheng Future Technology, the developer of the HeyCyan smart glasses phone app. The app is used in Kmart's Anko smart glasses and in low-cost products sold on Big W Marketplace and Amazon.

The investigation was opened under section 40(2) of the Privacy Act 1988 after the company did not respond to the regulator's preliminary inquiries. Privacy Commissioner Carly Kind said that without a response she had "no assurance that it is protecting personal data of Australians as required by the Privacy Act", and that opening an investigation lets her use her full range of powers. She also urged retailers to consider whether it is appropriate to keep selling these devices.

The OAIC published a blog alongside it, "Smart glasses under the microscope", summarising its preliminary inquiries with manufacturers and distributors including Meta, Kmart and Google.

What this means for your business

Both stories reward the same thing: being able to answer a regulator quickly, with evidence. A company that cannot show how it assesses AI risk, or that goes quiet when asked how it handles personal data, is the one that ends up under formal investigation.

If you use AI in client work or sell into Australia, three questions are worth answering now: who owns AI risk in your business, where is it written down, and could you produce it within days if a regulator or a client asked?

Ops Intel writes AI compliance frameworks for businesses worldwide, including Australia. To see what one covers, visit Ops Intel.