Australia Walked Back a Dedicated AI Act. Here's What Actually Governs AI There Now.

In September 2024, Australia's government proposed mandatory guardrails for AI used in high-risk settings, ten of them, covering everything from accountability and risk management to human oversight and record-keeping. By December 2025, the National AI Plan quietly dropped that mandatory framework. The government confirmed it will not proceed with AI-specific legislation. No dedicated AI Act is coming, at least not on the timeline or in the form that was originally proposed.

It would be easy to read that as Australia deciding AI doesn't need governing. That's not what happened, and treating it that way is the mistake we see AI vendors and buyers both making right now.

What actually fills the gap

The government's position is that existing law already governs AI outcomes, and that sector regulators enforce it within their own remit rather than a single new AI regulator doing it centrally. Privacy, consumer protection, anti-discrimination, and sector-specific prudential rules all apply to what an AI system does, regardless of whether the word "AI" appears anywhere in the relevant statute. For a bank, an insurer, or a super fund, that means APRA's existing prudential standards, CPS 230 for operational risk and CPS 234 for information security, apply to AI the same way they apply to any other system or process the entity relies on. For every organisation handling personal information, the Privacy Act 1988 and its Australian Privacy Principles apply regardless of whether that information passed through a model.

The voluntary standard that's doing more work than its name suggests

Alongside the mandatory guardrails, the government also published a Voluntary AI Safety Standard in September 2024, ten guardrails covering accountability, risk management, data protection, testing, human oversight, transparency, contestability, supply chain transparency, record-keeping, and stakeholder engagement. With the mandatory version shelved, this voluntary standard is now the closest thing Australia has to a named, government-endorsed AI governance reference. It carries no legal force, but it's what a board, an auditor, or a regulator reaches for when the question "is this AI governed properly" comes up, and "voluntary" has not stopped it from becoming the de facto benchmark.

What we did about it

OBEL's in-app compliance report maps 87 controls across nine frameworks. Two of those frameworks exist specifically because of this decision: APRA CPS 230 and CPS 234, paragraph-cited, eight controls each, and the AU Voluntary AI Safety Standard's ten guardrails, mapped control by control with an honest satisfied, partial, or planned status on each one. When we first ran that mapping, two of the ten guardrails came back planned: a way for someone affected by an AI decision to challenge it, and a documented process for engaging the people OBEL's decisions actually affect. We didn't leave them planned. Challenging an AI decision is now a real intake in OBEL's own product, logged to an auditable record, not just an email. Stakeholder engagement is now a documented quarterly review. Both are covered in more detail elsewhere on this site.

That's the practical difference between reading a policy shift as a talking point and reading it as a specification. Australia told every organisation operating there exactly which laws now carry the weight an AI Act would have carried. We mapped our controls to the actual paragraphs of those laws instead of waiting for legislation that, as of the December 2025 decision, wasn't coming.

“A shelved AI Act doesn't create a gap. It just makes the existing law the whole answer, and most AI vendors haven't checked whether their controls actually map to it.”

- ninthLABS Ventures

This piece was prepared by the OBEL editorial team at ninthLABS Ventures, drawing on public reporting of Australia's National AI Plan and OBEL's own in-app compliance mapping.