Artificial intelligence rules are changing quickly around the world, and South Australian councils, government agencies and small businesses are asking the same question: which of these laws actually applies to us? This tracker summarises where the main AI laws and policies stand as at October 2026, what they mean for Australian organisations, and the practical steps worth taking now. It covers Australia first, then the European Union, United States, United Kingdom, Canada, China, South Korea and the Council of Europe convention.
This article is general information, not legal advice. Laws, commencement dates and guidance change, so confirm current requirements with the official sources linked below and with your legal advisers before you rely on them.
Why AI law matters to SA organisations
- Existing Australian law already applies to AI. Privacy, consumer, anti-discrimination, workplace, records and administrative law apply whether a decision is made by a person or with the help of software.
- New obligations start soon. From 10 December 2026, Privacy Act changes require many organisations to explain automated decisions in their privacy policies.
- Government buyers pass requirements down. Commonwealth and SA agencies are under AI policies of their own, and they increasingly ask suppliers how AI is used, governed and assessed.
- Overseas laws can reach Australian businesses. If you sell AI-enabled products or services into the EU, or your outputs are used there, the EU AI Act may apply even though you are based in Adelaide.
- Your vendors are changing their products to comply. AI labelling, transparency notices and contract terms in the tools you buy are being shaped by these laws.
Australia: federal
No standalone AI Act, for now
In 2024 the federal government consulted on mandatory guardrails for high-risk AI. The National AI Plan, released by the Department of Industry, Science and Resources on 2 December 2025, took a different path. It relies on Australia’s existing, largely technology-neutral laws and sector regulators, with targeted changes where gaps are found. It also established an Australian AI Safety Institute to monitor, test and share information on emerging AI risks and advise ministers and regulators. The Institute advises; it does not create new mandatory rules.
Frontier AI rules are being prepared
On 8 October 2026 the Assistant Minister for Science, Technology and the Digital Economy outlined plans for national standards for frontier AI developers, due by the end of 2026, with legislation planned for 2027. The proposed approach is systems-based, like workplace safety and banking supervision: developers would need to show their testing and harm prevention work, rather than follow a list of banned behaviours. A parliamentary joint committee on AI is due to deliver its final report in November 2026. These proposals target the companies that build advanced models, not the organisations that use them, but they are likely to shape vendor contracts, incident reporting and assurance expectations. Watch this space before relying on any detail.
The Guidance for AI Adoption published by the National AI Centre, and the earlier Voluntary AI Safety Standard, remain the main voluntary benchmarks. See our explainer on the VAISS guardrails and the six essential practices.
Privacy Act: automated decision transparency from 10 December 2026
The Privacy and Other Legislation Amendment Act 2024 added new transparency requirements to Australian Privacy Principle 1. According to the OAIC, from 10 December 2026 an APP entity must include information in its privacy policy where:
- it has arranged for a computer program to make a decision, or to do something substantially and directly related to making a decision;
- the decision could reasonably be expected to significantly affect an individual’s rights or interests; and
- personal information about the individual is used in that process.
The privacy policy must then describe the kinds of personal information used, the kinds of decisions made solely by the program, and the kinds of decisions where the program does something substantially and directly related to the decision. The OAIC published guidance and a fact sheet on this in September 2026, and suggests a cautious approach: if you are unsure whether a use is in scope, disclose it. Our automated decisions privacy policy checklist walks through the test, what to write and a six-week plan. Many small businesses are exempt from the Privacy Act, but councils’ contractors, health service providers and businesses over the turnover threshold often are not. Check your own position.
Commonwealth government: DTA policy for responsible use of AI
The Digital Transformation Agency’s Policy for the responsible use of AI in government, version 2.0, took effect on 15 December 2025 and applies to non-corporate Commonwealth entities, with carve-outs for defence and the national intelligence community. Its mandatory requirements cover accountable officials, public AI transparency statements, a strategic approach to AI adoption, operational responsible AI processes, an accountable owner for each AI use case, internal use case registers, staff AI training and AI impact assessments for in-scope use cases. The DTA says the first new mandatory requirement began on 15 June 2026, with the remaining requirements taking effect in December 2026. Suppliers to Commonwealth agencies should expect questions that map to these requirements.
Australia: South Australia and local government
South Australia has no AI-specific statute. SA public sector agencies follow the Government’s Guideline for the use of Generative Artificial Intelligence and Large Language Model Tools (Guideline 13.1), which sets expectations for agency AI policies, risk assessment, checking outputs and protecting official and personal information in AI tools. Agencies also remain bound by the SA Cyber Security Framework, the Information Privacy Principles Instruction and State records obligations.
Councils are not covered by the Commonwealth Privacy Act in the same way as businesses, but they are subject to the Local Government Act, the State Records Act 1997 and freedom of information law, all of which apply to AI-assisted work. For a practical view, read AI for South Australian councils and what SA agencies ask AI suppliers.
International AI laws by jurisdiction
The table below summarises the main international developments as at October 2026. Scroll sideways on small screens.
| Jurisdiction | Law or policy | Status | Key dates | Relevance to Australian organisations |
|---|---|---|---|---|
| European Union | AI Act (Regulation (EU) 2024/1689), as amended by the Digital Omnibus on AI | In force and applying in stages. The omnibus, in force from 27 July 2026, delayed the high-risk rules. | Prohibitions and AI literacy: 2 Feb 2025. General-purpose AI model rules: 2 Aug 2025, with the AI Office’s enforcement powers applying from 2 Aug 2026 (it confirmed in October 2026 that it has begun enforcing them). Most other rules, including Article 50 transparency: 2 Aug 2026. New prohibitions on non-consensual sexual deepfakes and child abuse material: 2 Dec 2026. Annex III high-risk systems: 2 Dec 2027. High-risk AI in regulated products: 2 Aug 2028. | Applies to providers and deployers outside the EU where AI systems are placed on the EU market or their output is used in the EU. Relevant to exporters, SaaS providers and anyone with EU customers. |
| United States (federal) | Executive Order 14179 (January 2025) and the December 2025 order “Ensuring a National Policy Framework for Artificial Intelligence” | No comprehensive federal AI statute. Policy favours a light-touch national standard and challenges to state laws. | EO 14179: 23 Jan 2025. National framework order: 11 Dec 2025, creating a federal AI Litigation Task Force to challenge certain state AI laws. | Expect US vendors’ terms and features to follow federal and state changes. Existing US consumer protection and sector laws still apply to US operations. |
| United States (Colorado) | SB 26-189, Automated Decision-Making Technology, which repealed and replaced the 2024 Colorado AI Act (SB 24-205) | Signed 14 May 2026. Narrower, transparency-focused framework for consequential automated decisions. | Main obligations apply to consequential decisions from 1 Jan 2027, subject to Attorney General rules. | Relevant if you deploy or supply automated decision tools affecting Colorado residents in areas such as employment, housing, lending, insurance or health care. |
| United Kingdom | Principles-based, regulator-led approach; Data (Use and Access) Act 2025 updated UK GDPR rules on automated decision-making | No comprehensive AI Act. Existing regulators apply their own powers to AI. | Changes under the Data (Use and Access) Act 2025 are being commenced in stages. | Relevant if you process UK personal data or sell into the UK. Regulator guidance (for example from the ICO) is the practical reference. |
| Canada | Artificial Intelligence and Data Act (proposed in Bill C-27) | Not enacted. The bill lapsed when Parliament was prorogued in January 2025. | No federal AI statute in force. Privacy and sector rules continue to apply. | Low direct relevance. Watch for any replacement bill if you operate in Canada. |
| China | Measures for labelling AI-generated synthetic content, alongside earlier generative AI and algorithm rules | In force. | Labelling measures: 1 Sep 2025. | Relevant if you offer AI-generated content services to users in China. Requires visible and embedded labels on certain AI-generated content. |
| South Korea | Framework Act on the Development of Artificial Intelligence and Establishment of Trust (AI Basic Act) | In force, with an initial period focused on guidance before penalties. | Took effect 22 Jan 2026. | Relevant if you provide high-impact or generative AI services in Korea. Includes transparency and labelling duties. |
| Council of Europe | Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225) | Open for signature since 2024. Not yet in force as at October 2026. | EU ratified 15 May 2026. Enters into force after five ratifications, including at least three Council of Europe member states. | An international treaty for governments, not businesses. A signal of where public sector AI expectations are heading. |
Dates in this table were checked against the official sources listed at the end of this article in October 2026. Some details, such as implementing rules and guidance, are still being finalised.
What to do now: a practical checklist
- List your AI. Build a simple register of the AI tools and features you use, including AI built into Microsoft 365, CRM, finance and HR software. Our guide to inventory, risk tiering and approvals shows how.
- Find the decisions that matter. Flag any use where software makes or substantially shapes a decision about a person, such as eligibility, pricing, hiring, rostering or enforcement.
- Update your privacy policy before 10 December 2026. If you are an APP entity and those decisions use personal information, add the APP 1.8 information and check your collection notices.
- Check where your customers and data are. If you sell into the EU, UK, US, Korea or China, confirm whether those laws reach you, starting with the EU AI Act.
- Set staff rules. Adopt a short generative AI acceptable use policy covering approved tools, what information can go in and how outputs are checked.
- Label and disclose. Tell people when they are dealing with a chatbot or AI-generated content, and keep a human contact option. Our AI disclosure and labelling guide has example wording.
- Ask your vendors. Request their AI documentation, data location, model training terms and how they meet the laws above.
- If you supply government, prepare evidence that maps to the DTA policy and SA Guideline 13.1: accountable owner, register, impact assessment and staff training.
- Train your people. AI literacy is now a legal duty in the EU and a mandatory requirement for Commonwealth staff, and it is good practice everywhere.
- Review twice a year. Put a date in the calendar to recheck this list, because the rules are still moving.
How EITSAA helps
Our AI governance and assurance service helps SA councils, agencies, not-for-profits and small businesses turn these rules into a working, proportionate program. We can build your AI register, identify decisions in scope of the new Privacy Act transparency rules, draft privacy policy wording for your legal review, set up risk tiering and approvals, prepare supplier evidence for government buyers, and train your staff. We work alongside your lawyers rather than replacing them.
Sources
- DISR: National AI Plan, Keep Australians safe
- OAIC: transparency for use of AI and automated decision-making
- DTA: Policy for the responsible use of AI in government v2.0
- SA Government: Guideline 13.1, generative AI and LLM tools
- European Commission AI Act Service Desk: implementation timeline
- Council of the EU: Digital Omnibus on AI adopted
- The White House: Ensuring a National Policy Framework for AI
- Colorado General Assembly: SB26-189
- ABC News: Australia outlines plans for frontier AI safety rules (8 October 2026)
- Council of Europe: EU ratifies the Framework Convention
As at October 2026. Last reviewed 25 October 2026. Not legal advice.
Talk to an Adelaide team
If you want to know which of these rules applies to you, talk to us about an AI governance review or call 0402 401 584. We start with a short conversation about the AI you already use and the decisions it touches.