Key points

• There is currently no generally applicable law regulating the use of AI in Australia, although a voluntary set of AI Ethics Principles has existed since 2019.
• In the last 12 months, there have been a range of consultations, reform proposals and other steps taken by various Australian government bodies that suggest the Australian government looks set to take a narrower approach to regulating the use of AI by focusing first on high-risk use cases. Nevertheless, it is possible that the more prescriptive approach taken by the European Union will influence the development of AI in Australia from a practical perspective.
• There are steps that your organisation can take now to begin preparing for any future reforms, including undertaking an audit of the use of AI within your organisation (including paying particular attention to AI use cases involving personal information, automated decision making or serious financial or legal consequences for individuals) and developing and implementing an AI governance framework. 

As at April 2024, there is currently no generally applicable law regulating the use of artificial intelligence (AI) in Australia. However, a voluntary framework consisting of eight AI Ethics Principles has existed at a federal level since 2019. In addition, the New South Wales state government has issued a range of AI-related guidance, including an AI Assurance Framework for NSW government agencies seeking to design, build and use AI-enabled products and solutions. 

Recent developments in Australia

Since we last provided an update on the Australian government’s consultations relating to safe and responsible AI in June 2023, there has been a number of further developments in Australia relating to this fast-moving area:

• in July 2023, the Report of the Royal Commission into the Robodebt Scheme was tabled in Federal Parliament. Relevantly, Chapter 17 of this report considered automated decision making in the context of the operation of the Robodebt Scheme. The report made two recommendations relating to the regulation of the use of automated decision-making by government and the creation of a body with the power to monitor and audit automated decision-making. In November 2023, the Australian government’s response to the Robodebt report indicated that it accepted the recommendations made relating to automated decision making. Subsequently, there has been an increased level of scrutiny by the Australian Senate of various legislative reforms relating to the use of automated decision making, including in relation to the licensing of financial advisors and in migration and biosecurity law decision making;
• in September 2023, the Australian government released its response to the Privacy Act Review Report. Chapter 19 of the report related to automated decision-making and the government’s response indicates that it agrees with all three of the recommendations made in this report relating to the use of personal information in the context of automated decision making, which were:
  • a requirement for privacy policies to set out the types of personal information that will be used in substantially automated decisions which have a legal or similarly significant effect on an individual’s rights;
  • the inclusion of high-level indicators of the types of automated decisions with a legal or similarly significant effect on an individual’s rights in the Privacy Act (to be supplemented by guidance from the Office of the Australian Information Commissioner); and
  • the introduction of a right for individuals to request meaningful information about how substantially automated decisions with legal or similarly significant effect are made; 
• in January 2024, the Australian government published an interim response relating to its safe and responsible AI consultation. Broadly speaking, the government indicated that it will use a risk-based framework to support the safe use of AI and to prevent harm occurring from the use of AI. This will include:
  • considering and consulting on new mandatory guardrails for organisations developing and deploying AI systems in high-risk settings;
  • the development of a practical, voluntary, best-practice toolkit to help entities ensure that AI systems being developed or deployed are safe and secure;
  • considering the merits of voluntary labelling and watermarking of AI-generated material in high-risk settings; and
  • considering further opportunities to strengthen existing laws to address risks and harms from the use of AI;
• in February 2024, following the government’s interim response, the federal Minister for Industry and Science established an artificial intelligence expert group to advise the government on a range of AI-related issues;
• also in February 2024, the Productivity Commission weighed in on the topic of AI regulation with the release of three research papers on:
  • AI uptake, productivity and the role of government;
  • the challenges of regulating AI; and
  • how AI raises the stakes for data policy;
• in March 2024, a Senate Select Committee on Adopting Artificial Intelligence was established to inquire into and report on the opportunities and impacts arising out of the uptake of AI technologies in Australia. Written submissions can be made by 10 May 2024, with the committee intending to report to the Parliament on or before 19 September 2024; and
• in April 2024, the Office of the Victorian Information Commissioner (the privacy regulator for Victorian government bodies) released a Public Statement on the use of personal information with ChatGPT by Victorian government bodies. This statement indicated that Victorian government bodies must ensure staff and contracted service providers do not use personal information with ChatGPT due to the privacy risks involved and stated that the use of personal information with ChatGPT should be treated as an information security incident that must be notified to OVIC.

The EU AI Act – will Australia follow suit?

In March 2024, the EU approved the final version of the Artificial Intelligence Act (AI Act), which provides a comprehensive legal framework for AI systems. It classifies AI applications based on risk levels and imposes specific obligations for each category of either unacceptable, high, limited or minimal risk. For example, high-risk AI systems are required to undergo conformity assessments and certain uses (such as biometric mass surveillance) are prohibited. For more information on the EU’s AI Act, here are the 10 key things you need to know now.

By approving the AI Act, the EU has arguably set a global high watermark for AI regulation. In a similar manner to the effect that the EU’s General Data Protection Regulation had on the development of privacy laws around the world, one possibility is that the EU’s AI Act may lead to a degree of harmonisation by acting as a de facto standard for the regulation of AI. For businesses with a global presence, it may be simpler to adhere to and adopt these more stringent regulations in the EU across all of the regions in which these businesses operate, including in Australia. Similarly, the developers of AI systems may not wish to unduly limit the markets in which they can offer their AI solutions, with the result that AI systems that are developed would be designed to meet the onerous standards imposed by the EU’s AI Act.

It remains to be seen how this could affect the Australian government’s lighter touch approach to AI regulation in Australia and which approach will be followed by other countries. More information on AI regulatory developments around the world can be found on the Dentons Global AI Hub.

Distinguishing between AI and automated decision making

To date, a number of the more substantive regulatory reform proposals in Australia have focused on automated decision making and do not specifically relate to AI. It is important to note that these two concepts are not necessarily the same, although there can be some overlap. While there is no commonly accepted definition of AI in Australia, the Australian government’s Safe and Responsible Use of AI Discussion Paper illustrates the distinction as follows:

• “Artificial intelligence (AI) refers to an engineered system that generates predictive outputs such as content, forecasts, recommendations or decisions for a given set of human-defined objectives or parameters without explicit programming. AI systems are designed to operate with varying levels of automation.”
• “Automated Decision Making (ADM) refers to the application of automated systems in any part of the decision-making process. … Automated systems range from traditional non-technological rules-based systems to specialised technological systems which use automated tools to predict and deliberate.”

Accordingly, an AI system can be used for automated decision making, but not all AI systems would involve or consist of automated decision making. However, regulatory reforms relating to automated decision making would necessarily result in a level of regulation of any AI systems being used as part of automated decision making.

Where to from here?

It appears for now that the Australian approach to the regulation of AI will initially be limited to addressing uses of AI in still-to-be-defined ‘high risk’ areas. As proposed reforms to the Privacy Act continue to progress in parallel, there is likely to be an indirect secondary impact on the regulation of AI if amendments to the Privacy Act relating to the use of personal information in automated decision making (which the government has already indicated it agrees to) are included in any upcoming privacy legislative reforms.

With a federal election due in the not-too-distant future (and likely to occur by no later than May 2025, given the required timing for a Senate election), time is quickly running out for the Australian government to finish consultations on, draft and pass any AI-related legislation prior to the end of the current Parliament.

How can organisations prepare?

While we wait for more details of any proposed regulatory reforms, there are some important steps that organisations can take now to prepare for any future legislative amendments:

1. Investigate and document any existing uses of AI and automated decision making in your organisation. This may include undertaking an AI audit across your business units and supply chain to understand how and where AI systems are being used. The results of this audit should be documented and kept up to date (including as new uses of AI are implemented across your organisation).
2. Pay particular attention to uses of AI that involve the handling of personal information about customers, employees and other stakeholders or which have significant legal or financial consequences for individuals. It is possible that these AI use cases will be caught by upcoming reforms to the Privacy Act relating to automated decision making or by more targeted reforms relating to high risk AI use cases.
3. Consider establishing internal governance frameworks for evaluating potential uses of AI, such as an AI governance committee that must be consulted on, or even approve, any new AI use cases. The AI governance committee should be charged with ensuring your organisation’s use of AI is fair, transparent, explainable, free from bias or discrimination and reflects your organisation’s values and community and stakeholder expectations.