Australia's AI Compliance Overhaul 2025–2026: What Professional Services Must Do Now

For international professional services firms operating in the Asia-Pacific region, the regulatory ground beneath AI deployment is shifting faster than many compliance teams have anticipated. Australia and New Zealand have each taken deliberate, structured steps to govern artificial intelligence — and the obligations they are introducing carry direct consequences for businesses that use AI to inform decisions affecting individuals. If your organisation operates in Australasia, or processes data relating to individuals in these jurisdictions, this briefing is for you.

From Principles to Enforceable Obligations

Australia has long signalled its intent to govern AI through existing legal frameworks rather than a single legislative instrument. That approach is now producing concrete, enforceable requirements. The National AI Plan 2025, released in December 2025, sets out a broad strategic vision focused on economic opportunity, public safety, and responsible deployment. Alongside it, the establishment of the AI Safety Institute (AISI) in January 2026 signals that Australia is not content to leave responsible AI as an aspiration — it is building institutional infrastructure to hold organisations to account.

For professional services firms, the policy direction matters less than what it produces in practice. And what it is producing is a wave of specific, measurable compliance obligations.

The Privacy Act Amendments: The Deadline Your Team Cannot Miss

The single most consequential development for businesses is the amendment to the Privacy Act 1988 (Cth). From 10 December 2026, new transparency obligations under APP 1.7 to 1.9 will require organisations to disclose in their privacy policies whether they use automated systems — including AI — to make or substantially assist decisions that may have a significant effect on individuals.

The scope of this requirement is broad. Affected decisions include loan approvals, insurance pricing, tenant applications, and job application processing. If your organisation uses AI-assisted tools at any point in these workflows, and those tools influence outcomes for individuals in Australia, disclosure is mandatory.

The penalties for non-compliance are not trivial. Infringement notices can reach approximately AUD 66,000, while civil penalties for serious breaches may reach AUD 50 million. The Office of the Australian Information Commissioner (OAIC) is already consulting on guidance to support implementation — which indicates active regulatory attention, not a dormant rule on paper.

For global enterprises with shared AI systems or centralised decision-making platforms, this creates an immediate question: do your current privacy policies accurately reflect how AI is used within Australian-facing operations? For many organisations, the honest answer will be no.

Government Sector Requirements: A Signal of What Comes Next

Australia's updated Policy for the Responsible Use of AI in Government (v2.0), effective December 2025, imposes structured governance requirements on Commonwealth entities. These include mandatory accountable officials for AI use cases, internal AI use case registers, transparency statements, and risk-based impact assessments.

While this policy applies directly to government departments and agencies, professional services firms should read it carefully. Government procurement is a significant revenue stream for many consultancies, legal firms, and technology service providers. As Commonwealth entities build out their internal AI governance requirements, they will increasingly expect — and in many cases contractually require — that their suppliers and partners demonstrate equivalent standards.

The AI Plan for the Australian Public Service 2025 reinforces this trajectory, focusing on trust, capability, and responsible tooling. Firms tendering for public sector contracts in Australia should begin aligning their AI governance documentation accordingly.

New Zealand: Principles in Practice

New Zealand has opted for a principles-led approach, integrating AI expectations into existing legal and regulatory settings rather than introducing standalone legislation. The National AI Strategy, launched in July 2025, establishes the overarching direction, with an emphasis on innovation tempered by public trust. The Public Service AI Framework (2025) provides practical guidance for government agencies on responsible design and deployment.

Like Australia's government sector requirements, New Zealand's framework carries indirect implications for private sector firms. Organisations working alongside New Zealand public agencies — or delivering AI-enabled services into that market — will need to demonstrate that their systems align with the values and risk expectations the framework sets out. Privacy obligations under New Zealand's existing Privacy Act 2020 already impose accountability requirements, and regulators have shown a clear appetite for extending their reach into automated decision-making contexts.

What This Means for International Firms

The Australasia developments are not isolated. They reflect a global pattern: regulators are moving from voluntary principles to enforceable transparency requirements, and they are doing so by integrating AI obligations into existing legal frameworks — privacy law in particular.

For international professional services businesses, this creates a layered compliance challenge. Your AI systems may be developed and governed centrally, but they are deployed across multiple jurisdictions, each with its own obligations. A model that works compliantly in one market may create material exposure in another if it lacks jurisdiction-specific disclosure, documentation, or oversight mechanisms.

The practical implication is that AI governance can no longer be treated as a single global policy exercise. Firms need compliance infrastructure that is both consistent in its principles and adaptable in its application — capable of mapping AI use cases to jurisdiction-specific requirements and keeping pace as those requirements evolve.

Priority Actions for Compliance Teams

Organisations with Australian or New Zealand operations should treat the following as immediate priorities:

Audit your AI use cases. Identify every instance where AI is used to make or assist decisions that affect individuals. This is the foundation for everything that follows.

Review your privacy policies. Assess whether current disclosures meet — or can be updated to meet — the APP 1.7 to 1.9 requirements before the December 2026 deadline. Do not wait for finalised OAIC guidance to begin this work.

Map your accountability structures. Who is responsible for each AI use case? Can you demonstrate a chain of accountability that would satisfy a regulator? If not, build it now.

Assess your procurement exposure. If you work with Australian or New Zealand government entities, understand what AI governance standards those clients will expect from their suppliers and begin closing any gaps.

Build for multi-jurisdictional compliance. Australasia is one piece of a larger picture. Ensure your AI governance framework is structured to accommodate obligations across all relevant jurisdictions — not just the most demanding one.

Talk to Ops Intel

Navigating AI compliance across multiple jurisdictions requires expertise, precision, and an understanding of how regulatory frameworks interact in practice. Ops Intel helps international professional services firms and global enterprises build AI governance programmes that are robust, defensible, and designed to keep pace with a rapidly evolving regulatory environment.

If the developments outlined in this briefing raise questions about your current compliance position, we are ready to help you answer them. Contact Ops Intel today to discuss your AI compliance obligations and find out how we can support your organisation across Australasia and beyond.