Australia's Six Essential AI Practices: Voluntary Now, Likely Binding Later

Australia published its Guidance for AI Adoption in October 2025, structured around six essential practices. It is voluntary — for now — but the direction of travel is unusually well signposted.

Binding legislation for high-risk settings has been recommended. Separately, Privacy Act reform is adding transparency duties around automated decisions, and that part is not optional.

What applies today

• Six essential practices covering the core of responsible AI adoption, applying across develop, deploy and use.
• Privacy Act reform introducing automated decision transparency.
• The Privacy Act already applying to personal data in AI systems.

The part with actual teeth

It is easy to read "voluntary guidance" and stop. That would be a mistake, because the privacy limb is a different animal.

Automated-decision transparency becoming a Privacy Act obligation means it stops being best practice and becomes a legal requirement enforced by a regulator with an established track record. If AI influences decisions about individuals in your business, your privacy notice needs to say so.

The voluntary guidance is where Australia is asking nicely. The Privacy Act reform is where it is not.

What SMEs should do

• Adopt the six practices. They align closely with NIST and the emerging international consensus, so the effort transfers to other markets rather than being Australia-specific.
• Update your privacy notices now to disclose automated decision-making. This is the concrete, near-term legal exposure.
• Prepare for high-risk guardrails. If you operate in an area likely to be designated high-risk — hiring, credit, essential services — build the controls before they are mandated.
• Keep an AI register. Every regime that has moved from voluntary to binding has started by asking organisations what systems they run.

What automated-decision disclosure actually requires

The wording will matter, but the shape is predictable from comparable regimes: if automated processing plays a significant part in a decision about someone, your privacy notice should say so, in terms a normal person understands.

That means auditing where AI touches decisions — application screening, pricing, eligibility, prioritisation, fraud flags — and then writing a plain sentence for each. "We use automated tools to help assess applications; a member of our team reviews the outcome before any decision is finalised" does more work than a paragraph of legal boilerplate.

The audit is the effort. The disclosure itself is usually a few lines.

Reading the trajectory

Australia sits with Japan and Singapore in the soft-law group, but with a clearer legislative signal than either. The recommendation for binding high-risk guardrails is on the record.

For an SME the sensible posture is to treat the six practices as a pre-compliance exercise. Adopting them while they are voluntary is considerably cheaper than retrofitting them under deadline once they are not — and the privacy obligations are arriving regardless.