Australian AI Reform – How to address the new AI guardrails

Co-authored by Michael Park, Partner and Roy Leigh, Solicitor

Home
Knowledge
Australian AI Reform – How to address the new AI guardrails

Australian AI Reform – How to address the new AI guardrails

Co-authored by Michael Park, Partner and Roy Leigh, Solicitor

{FA6330B0-EB35-4C78-9730-05ED8ACF7963}

September 16, 2024

Key points

On 5 September 2024, the Australian Government released a number of ‘guardrails’ as part of its measures to regulate AI in Australia.
There are 10 voluntary guardrails (which form part of the Voluntary AI Safety Standard) that apply to all Australian organisations. These apply now.
The 10 mandatory guardrails, applicable to AI in high-risk settings, have been released by the Australian Government in draft form and are subject to further consultation.
The guardrails provide rules on what organisations should do to ensure transparency and accountability throughout the AI supply chain.

Background

In June 2023, the Australian Government issued a discussion paper entitled ‘Safe and responsible AI in Australia’, which sought advice from the community on the steps that Australia could take to mitigate the potential risks of AI.

Earlier this year, the Government released its interim response outlining proposed next steps for reform, focusing on the following key areas:

preventing harms from occurring through testing, transparency and accountability;
clarifying and strengthening laws to safeguard citizens;
working internationally to support the safe development and deployment of AI; and
maximising the benefits of AI.

As part of the initiatives proposed for addressing point 1 above, the Government committed to developing an AI Safety Standard and implementing risk-based guardrails for the industry. Both the voluntary guardrails (published as part of the Voluntary AI Safety Standard) and the mandatory guardrails (published as a proposals paper for introducing mandatory guardrails for AI in high-risk settings) have come about as a result.

Do the guardrails apply to me?

The voluntary guardrails apply to “all Australian organisations” and “all organisations throughout the AI supply chain”. It is unclear whether “Australian organisations” refers to entities registered in Australia only or all entities that do business in Australia. Nonetheless, since they are voluntary, the precise scope of the voluntary guardrail’s applicability is not majorly significant.

The mandatory guardrails will only apply to “developers” or “deployers” of “high-risk” AI systems, not end users of AI systems. The Government has proposed definitions for these terms:

“Developer” means organisations or individuals who design, build, train, adapt or combine AI models and applications.
“Deployer” means any individual or organisation that supplies or uses an AI system to provide a product or service.
The Government has proposed two possible ways of defining “high risk”. One way involves assessing risk based on the use/application of the AI system. The other way involves assessing risk based on the inherent capabilities of the AI system (e.g. advanced, highly-capable GPAI models). This is subject to further review.

It is unclear whether the mandatory guardrails will apply to Australian entities or overseas entities as well.

When do the guardrails apply?

The voluntary guardrails apply now. The mandatory guardrails are subject to a further round of consultation and will likely not be in force until at least 2025.

The guardrails explained


Voluntary guardrail	Mandatory guardrail	Differences	What should I do?
Establish, implement, and publish an accountability process including governance, internal capability and a strategy for regulatory compliance.	Establish, implement and publish an accountability process including governance, internal capability and a strategy for regulatory compliance.	No difference.	Have policies in place to allow your organisation to comply with applicable laws relating to AI. Have a data and risk management plan in relation to use of AI by your staff. Give clear roles and responsibilities to your staff around responsible use of AI.
Establish and implement a risk management process to identify and mitigate risks.	Establish and implement a risk management process to identify and mitigate risks.	No difference.	Implement and document a process for identifying and dealing with the risks of using AI in your organisation.
Protect AI systems, and implement data governance measures to manage data quality and provenance.	Protect AI systems, and implement data governance measures to manage data quality and provenance.	No difference.	Ensure all data used and generated by the AI system is securely stored and managed.
Test AI models and systems to evaluate model performance and monitor the system once deployed.	Test AI models and systems to evaluate model performance and monitor the system once deployed.	No difference.	Test your AI systems to ensure they operate as expected and achieve clearly defined acceptance criteria.
Enable human control or intervention in an AI system to achieve meaningful human oversight.	Enable human control or intervention in an AI system to achieve meaningful human oversight.	No difference.	Ensure sufficiently qualified persons are able to access and interpret information regarding the AI system’s outputs.
Inform end-users regarding AI-enabled decisions, interactions with AI and AI-generated content.	Inform end-users regarding AI-enabled decisions, interactions with AI and AI-generated content.	No difference.	Inform people when AI is making a decision relating to them. Inform people when they are interacting with an AI system. Apply best efforts to ensure AI-generated outputs can be clearly identified as such.
Establish processes for people impacted by AI systems to challenge use or outcomes.	Establish processes for people impacted by AI systems to challenge use or outcomes.	No difference.	Have in place a complaint handling process (with sufficient human oversight) for people who want to challenge an outcome/ use of an AI system.
Be transparent with other organisations across the AI supply chain about data, models and systems to help them effectively address risks.	Be transparent with other organisations across the AI supply chain about data, models and systems to help them effectively address risks.	No difference.	Provide all relevant information to deployers of the AI system about their risks, defects (if any), and how to interpret the AI system’s outputs.
Keep and maintain records to allow third parties to assess compliance with guardrails.	Keep and maintain records to allow third parties to assess compliance with guardrails.	No difference.	Keep a record of: the design specifications of the AI system; • the datasets used in developing and testing the AI system; • the capabilities of the AI system; • human oversight measures implemented; and • the risk management processes implemented.
Engage your stakeholders and evaluate their needs and circumstances, with a focus on safety, diversity, inclusion and fairness.	Undertake conformity assessments to demonstrate and certify compliance with the guardrails.	Difference: there is no requirement for organisations adopting the voluntary standards to demonstrate compliance with the guardrails.	If your organisation is adopting the voluntary guardrails, you should engage with stakeholders over the life of the AI system. If your organisation is dealing with high-risk AI, you need to document your compliance with the nine guardrails above.

What’s next?

Organisations can adopt the 10 voluntary guardrails now.

The Government is seeking submissions on the mandatory guardrails by 4 October 2024, which may be uploaded here.

We then await the Government’s consideration of the submissions received on the proposed mandatory guardrails. In particular, the proposals paper raises three options for implementing the mandatory guardrails:

A domain specific approach – adopting the guardrails within existing regulatory frameworks as needed.
A framework approach – introducing new framework legislation to adapt existing regulatory frameworks across the economy.
A whole of economy approach – introducing a new cross-economy AI-specific Act (e.g. an Australian AI Act).

However, as noted in our article earlier this year (Dentons - The current state of play for the regulation of AI in Australia in 2024), time is running out for the Australian Government to finish consultations on, draft and pass any AI-related legislation prior to the upcoming Australian Federal election next year.