Laws/Regulations directly regulating AI (the “AI Regulations”)

Australia has not yet enacted any specific statutes or regulations that directly regulate AI. To date, Australia's response to AI has been voluntary and includes the AI Ethics Principles published in 2019 (the "AI Ethics Principles")¹ (see item 10 below). The AI Ethics Principles comprise eight voluntary principles for the responsible design, development and implementation of AI, which are consistent with the OECD's Principles on AI.

In June 2023, the Commonwealth Department of Industry, Science and Resources (the "Department") commenced a consultation into "Safe and Responsible AI in Australia" (the "Consultation")² which focussed on developing governance mechanisms to ensure the safe and responsible development and use of AI and identifying potential gaps in Australia's current regulatory frameworks.

On 17 January 2024, the Australian Government published its interim response to the Consultation (the "Interim Response").³ The Interim Response identified that current regulatory frameworks may not sufficiently prevent harms arising from the use of AI systems in legitimate but high-risk contexts. Accordingly, it appears that major reform could be expected in the medium term, where a risk-based framework will likely be adopted with an initial focus on appropriate mandatory safeguards and how best to implement them.

Following the Interim Response, the Australian Government announced the establishment of a new Artificial Intelligence Expert Group to assist the Department in developing regulations on transparency, testing and accountability, including options for mandatory AI guardrails in high-risk settings.

Status of the AI Regulations

As noted above, as yet there are no specific statutes or regulations in Australia that directly regulate AI. Neither the Consultation nor the Interim Response provide any indicative timeline for when specific AI regulation might be expected.

Other laws affecting AI

There are various laws that do not seek to regulate AI, but that may affect the development or use of AI in Australia. A non-exhaustive list of these laws include:

• The Online Safety Act 2021,⁴ which includes mechanisms to address online safety issues, extending to AI generated material
• The Australian Consumer Law, which was applied to algorithmic decision making in a Federal Court case which ordered Trivago to pay $44.7 million in penalties for misleading consumers about room rates in the recommendations made by its algorithm⁵
• The Privacy Act 1988⁶
• The Corporations Act 2001⁷
• Intellectual property laws may affect several aspects of AI development and use
• Anti-discrimination laws, for example, where an individual is a victim of a discriminatory outcome resulting from an AI-driven process

In the Interim Response, the Australian Government acknowledged that existing laws will likely need to be strengthened to address harms posed by AI. To that end, the Australian Government is currently developing new laws that will provide the Australian Communications and Media Authority ("ACMA") with regulatory powers to combat online misinformation and disinformation, extending to content on digital platforms that are generated by AI.

Definition of “AI”

No definition of AI has been formally adopted by any statutes or regulations in Australia. In the Consultation, the Commonwealth Department adopted the following definitions:⁸

• "AI" means "an engineered system that generates predictive outputs such as content, forecasts, recommendations or decisions for a given set of human-defined objectives or parameters without explicit programming. AI systems are designed to operate with varying levels of automation"
• "Machine learning" means "the patterns derived from training data using machine learning algorithms, which can be applied to new data for prediction or decision-making purposes"
• "Generative AI" means "models [that] generate novel content such as text, images, audio and code in response to prompts"

The definitions of AI, machine learning and algorithm are stated to be based on the International Organization for Standardization's definitions.⁹

Territorial scope

As noted above, there are no specific statutes or regulations in Australia that directly regulate AI. Accordingly, there is little to no guidance on any specific territorial scope at this stage.

Sectoral scope

As noted above, there are no specific statutes or regulations in Australia that directly regulate AI. Accordingly, there is little to no guidance on any specific sectoral scope at this stage. To date, the focus of the Consultation and Interim Response has not been sector-specific and it is expected that any AI-specific regulations will apply across all sectors of the Australian economy.

Compliance roles

As noted above, there are no specific statutes or regulations in Australia that directly regulate AI. While the Interim Response identified that there is a need to consider specific obligations on the development and deployment of certain models, including that models developed overseas could be built into applications in Australia, there is currently little to no guidance on specific or unique obligations to be imposed on developers, users, operators and/or deployers of AI systems.

Core issues that the AI Regulations seek to address

While voluntary, the AI Ethics Principles are designed to ensure AI is "safe, secure and reliable" by: (i) achieving safer, more reliable and fairer outcomes for all Australians; (ii) reducing the risk of negative impact on those affected by AI applications; and (iii) assisting businesses and governments to practice the highest ethical standards when designing, developing and implementing AI.

Risk categorization

As noted above, there are no specific statutes or regulations in Australia that directly regulate AI.
In the Interim Response, the Australian Government indicated that it would adopt a risk-based framework to AI regulation, meaning the regulatory requirements will be commensurate to the level of risk posed by the specific use, deployment or development of AI where, for example, higher risk AI applications will likely include uses that may result in negative impacts for people that are difficult or impossible to reverse. However, no specified risk categories have been further discussed or developed at this stage.

Key compliance requirements

As noted above, there are no specific statutes or regulations in Australia that directly regulate AI. The voluntary AI Ethics Principles identify the following broad principles for ensuring safe, secure and reliable AI:

• Human, societal and environmental wellbeing: AI systems should benefit individuals, society and the environment
• Human-centered values: AI systems should respect human rights, diversity, and the autonomy of individuals
• Fairness: AI systems should be inclusive and accessible, and should not involve or result in unfair discrimination against individuals, communities or groups
• Privacy protection and security: AI systems should respect and uphold privacy rights and data protection, and ensure the security of data
• Reliability and safety: AI systems should reliably operate in accordance with their intended purpose
• Transparency and explainability: There should be transparency and responsible disclosure so people can understand when they are being significantly impacted by AI, and can find out when an AI system is engaging with them
• Contestability: When an AI system significantly impacts a person, community, group or environment, there should be a timely process to allow people to challenge the use or outcomes of the AI system
• Accountability: People responsible for the different phases of the AI system lifecycle should be identifiable and accountable for the outcomes of the AI systems, and human oversight of AI systems should be enabled

Regulators

There is currently no AI specific regulator in Australia.

However, it is expected that sector-specific regulators such as the Australian Competition and Consumer Commission, the ACMA, the Office of the Australian Information Commissioner and the e-Safety Commissioner will be involved in the Australian Government's approach to the regulation of AI in Australia. As noted above, we can expect that the ACMA will be given certain regulatory powers to combat online misinformation on digital platforms that are generated by AI.

Enforcement powers and penalties

As noted above, there are no specific statutes or regulations in Australia that directly regulate AI. The use, deployment or development of AI may be subject to enforcement and penalties if it breaches other, non-AI specific statutes and regulations.

1 The AI Ethics Principles (2019) is available here.
2 The Consultation paper is available here.
3 The Interim Response is available here.
4 The Online Safety Act 2021 (Cth) is available here.
5 See Australian Competition and Consumer Commission v Trivago N.V. [2020] FCA 16 here.
6 The Privacy Act 1988 (Cth) is available here.
7 The Corporations Act 2001 (Cth) is available here.
8 See the Consultation at page 5.
9 See ISO/IEC 22989: Artificial intelligence concepts and terminology here.