Recently, regulators have explained how current laws apply to businesses’ use of AI and its risks.
They discussed how companies were using AI in their businesses, how it was being governed and how risks were being managed.
Relevant existing Australian laws include:
• directors’ duties under the Corporations Act 2001;
• obligations of Australian Financial Services Licence holders under the Corporations Act and Australian Securities and Investments Commission Act 2001;
• obligations of APRA-regulated institutions;
• workplace regulation; and
• the Privacy Act 1988 (Cth).
AI advertising
ASIC has updated its guidance in RG 234 to include clarification that the law and ASIC’s guidance also apply to AI-generated advertising. It also discussed the obligation to disclose the features, benefits and risks or limitations of using customer tools and tool capability, including AI-enabled tools.
Automated decision making and disclosure
The Office of the Australian Information Commissioner has published an Automated Decision-Making Issues Paper prior to giving guidance on the automated decision-making transparency obligation.
Frontier AI Models
APRA and ASIC have focused on the risk of “frontier” AI models that can identify vulnerabilities in your systems.
APRA expressed concern that frontier AI is not just a cyber risk issue. It’s a third-party risk, a concentration risk and a sovereign access risk. A critical business process, control or cyber-defence capability that depends on a single offshore frontier AI model may be disrupted not only by an outage or cyber incident but by a regulatory decision made overseas.
See APRA’s Letter to industry
Similarly, ASIC has written to licensees and market participants to urgently strengthen their cyber resilience measures, as frontier artificial intelligence intensifies the global cyber risk environment.
ASIC says that while cyber risk has always existed, misuse of frontier AI models such as Anthropic’s Claude Mythos could expose cyber security vulnerabilities at an unprecedented speed, scale, and sophistication.
Directors’ duties
With respect to directors’ duties, in a recent speech, the Honourable Andrew Bell AC, Chief Justice of the Supreme Court of New South Wales, contrasted a company’s use of AI in its business operations, on the one hand, and the knowledge and use of Gen AI by the company’s directors in the discharge of their duties.
He even considered the concept of AI bots taking on the role of directors, or shadow directors.
ACCC
The ACCC has announced that the Digital Platform Regulators Forum, consisting of the Australian Competition and Consumer Commission (ACCC), the Australian Communications and Media Authority (ACMA), the eSafety Commissioner (eSafety) and the Office of the Australian Information Commissioner, has signed a Memorandum of Understanding to strengthen coordination in their regulation of digital platforms.
The agreement formalises how members will share information and work together on cross-cutting issues, including scams, privacy, online safety and competition concerns.
ACCC has issued its own transparency statement disclosing how it uses AI.
AI Ethics Principles
In 2025, the Commonwealth published 8 AI Ethics Principles covering:
• human, societal and environmental wellbeing;
• human rights, diversity, and the autonomy of individuals;
• fairness to individuals, communities or groups;
• privacy protection and security;
• reliability and safety;
• transparency and explainability;
• contestability; and
• accountability.
These are voluntary guidelines and have not changed the law.
But Boards should review their AI governance against these principles and the statements from the regulators.
If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.
Author: David Jacobson
Principal, Bright Corporate Law
Email:
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.
