Quick verdict
Australian boards keep one date in the diary: early 2027, when the government aims to bring enabling legislation for Australian Standards for AI to Parliament. That target is real. It is not the next statutory date for most APP entities that already use computer programs on personal information.
The date with a commencement section is 10 December 2026. On that day, APP 1 subclauses 1.7, 1.8 and 1.9 start. They require specific privacy-policy text for in-scope automated decisions. The instrument is the Privacy and Other Legislation Amendment Act 2024 (Cth). It is enacted. It is not a proposal.
Australia does not have a dedicated AI Act. Waiting for one before you list what you already run leaves the December duty to a November scramble.
Best for: directors, CIOs and counsel who have been briefed on “the 2027 AI standards” and need to know what already has a date. Honest limit: this is not legal advice. Coverage, regulator and penalties for 2027 standards are unsettled. We help Australian companies build the evidence record. We do not certify you.
Last updated: 4 September 2026. Dated chronology lives on the 2026–2027 map (published 31 August 2026). This page is the calendar argument that map was written to support.
Which date should an Australian board actually diary?
Diary 10 December 2026 if the organisation is an APP entity and uses, or may use, a computer program with personal information to make or feed a decision that could reasonably be expected to significantly affect an individual’s rights or interests. Diary early 2027 as a watch item: announced legislative target, no exposure draft as of 31 August 2026, first published subjects looking like large data centres and Australian creative works rather than a general high-risk AI chapter.
Three layers boards keep mixing
| Layer | What it is | Status | Who it hits |
|---|---|---|---|
| Law that already applies | Privacy Act / APPs, ACL, employment and anti-discrimination, WHS, APRA CPS 230/234 if regulated | Binding now | Depends on the statute. Not “when the AI Act lands.” |
| 10 December 2026 | APP 1 automated-decision privacy-policy disclosures | Enacted; delayed commencement | APP entities using in-scope ADM. Small-business exemptions under the Privacy Act still matter. |
| Early 2027 aim | Enabling legislation for Australian Standards for AI | Announced target; no exposure draft | Unknown beyond first published subjects. Not the December duty. |
Full dated table, including the Voluntary AI Safety Standard, the Office of AI, and the Joint Select Committee: Australia AI regulation 2026–2027.
Why 2027 keeps winning the diary
July 2026 was loud. The Prime Minister announced an Office of AI in PM&C from 15 July and a path to legislate Australian Standards for AI. Firm notes and board packs treated that as “Australia’s AI Act is coming.” It is a national coordination move. “Standards” in that speech means requirements the government intends to make mandatory. It is not, on the published text, an EU-style general high-risk chapter. There is no Annex III list. There is no universal AI incident-reporting duty for every deployer. There is no named private-sector AI Act enforcer yet.
The December duty was already sitting in the Privacy Act amendments, waiting out a two-year commencement. It did not get a press conference in July. So it loses the diary to the newer headline.
What actually starts on 10 December 2026?
Where the trigger is met, the privacy policy must describe the kinds of personal information used in those programs, the kinds of decisions made solely by those programs, and the kinds of decisions where a program does a thing substantially and directly related to making the decision. The OAIC’s APP 1 guidelines set the statutory paraphrase. Making a decision includes refusing or failing to make one. The duty applies whether the outcome is beneficial or adverse.
The trigger is not “any AI anywhere.” It is an APP entity that has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision that could reasonably be expected to significantly affect the rights or interests of an individual, where personal information about that individual is used in the operation of the program.
OAIC footnote on the same page: the amendments apply to decisions made from that date, regardless of when the arrangement for the program was made, and regardless of when the personal information was used, acquired or created. Existing Copilot seats, vendor “AI insights” toggles, and last year’s screening tool still count if they are in use on a decision after 10 December.
This is a transparency duty in the privacy policy. It is not a ban. It is not a right to an explanation of the model. It is not “prove it in court.” The three-limb test and what to write: Automated decision-making privacy rules.
Why the committee report cannot save December
Parliament appointed a Joint Select Committee on Artificial Intelligence on 20 August 2026. Submissions close 14 September 2026. The report is due 30 November 2026.
That is ten days before APP 1.7–1.9 commence. A committee does not legislate. It can still move the 2027 bill. It cannot move 10 December. Unique insight from the board papers we see: teams that “wait for the inquiry to clarify AI law” are waiting past the date that already has a commencement section. The report will be quoted in a second-reading speech next year. The privacy-policy paragraph is due first.
What is already law while 2027 is unfinished
The Privacy Act already covers personal information in prompts, logs, retrieved documents and vendor training opt-ins. The Australian Consumer Law already caught a recommender that misled people about “best deals” (Trivago, $44.7 million on an ACCC case). Employment and anti-discrimination law already cover a hiring model that screens people out. APRA-regulated entities already treat material third-party technology under CPS 230 and CPS 234.
The Voluntary AI Safety Standard (September 2024) remains the checklist boards, tenders and insurers ask for. It creates no new duty. It is still the shape of a competent “show us your AI governance” request. Implementation: VAISS guide.
What a board paper should say this quarter
- We are already using AI, including vendor features we did not procure as “AI projects.”
- Existing law applies. The next statutory date for most APP entities is 10 December 2026.
- The 2027 standards are real and incomplete. First wave looks like infrastructure and copyright, not a copy of the EU AI Act.
- Our control is an inventory with owners, data, vendors and a living evidence record, not a promise to comply when an Act lands.
- Legal sign-off stays with counsel. Certification stays with an assessor if we later want ISO 42001.
Boards that only asked “are we ready for the AI Act?” in 2025 now have to be told the Act they imagined does not exist, and the privacy-policy date does. That conversation is shorter when the inventory is already on the table.
FAQ
Does this apply to every Australian business using AI? No. The December duty sits on APP entities, and only where the automated-decision trigger is met. Many small businesses are exempt from the Privacy Act; some are not (health, credit, trading in personal information, or a contract that deems you an APP entity). Ask counsel. Inventory is still useful when a customer questionnaire arrives.
Is there a Q1 2027 commencement date for a general AI Act? No published commencement section for a general private-sector AI Act exists as of 4 September 2026. Treat early 2027 as a legislative target.
Should we pause AI projects until 2027? No. Pause only the uses you cannot name, own, or put personal information into safely. Build the record as you ship.
What should we have before counsel writes the December paragraph? An inventory, named owners, what personal information each system touches, a gap list, and an export counsel can read. How that pack is built: What counsel needs before 10 December.
Not legal advice. Regulatory mapping is general. Verify against official sources before you act. Sign-off on privacy policy and ADM disclosures stays with your counsel. We do not claim Australia has an AI Act. We do not claim a workshop makes you compliant.
Related: 2026–2027 map · 10 December 2026 ADM rule · Prove it · What counsel needs · Clear Direction AI workshops