Generative AI and the Law in Australia: Risks, Rules and Best Practice
Abstract — Generative AI and the law Australia intersect without a dedicated AI statute. There is no Australian AI Act and no licensing regime. What governs business use is existing law applied to new facts: copyright under the Copyright Act 1968 (Cth), privacy under the Privacy Act 1988 (Cth), misleading conduct under the Australian Consumer Law, defamation under the uniform defamation Acts, and contract. Policy direction comes from the National AI Plan and the National AI Centre's voluntary guidance. This guide covers the five real risks and how to manage them.
The Australian Government's National AI Plan has driven most of the current search interest in generative AI legal risk. Almost all the content answering it is global or focuses narrowly on United States copyright litigation. Generative AI and the law Australia specifically is a different picture, with different risks, and a regulatory posture that has so far favoured applying what already exists.
Direct answer. Generative AI is lawful to use in Australian business. It is regulated by general law rather than by a dedicated AI regime, and the practical obligations fall on you as the deployer, not on the model.
Is Generative AI Regulated in Australia?
No dedicated statute. Australia has not enacted an AI Act. There is no licensing regime for AI systems and no sector-specific legal AI regulator.
General law applies fully. Copyright, privacy, consumer protection, defamation, discrimination, contract, negligence and professional conduct obligations all operate normally. Nothing about them pauses because output was generated.
Policy direction is set nationally. The National AI Plan sets the Australian Government's approach, and the National AI Centre's Guidance for AI Adoption provides a voluntary framework for organisations deploying AI responsibly. Neither creates binding legal obligations, and both are increasingly referenced in procurement, which gives them practical force.
Existing regulators have engaged. The Office of the Australian Information Commissioner has published guidance on privacy and AI for developers and deployers. The ACCC's remit covers misleading representations however they are generated. ASIC's expectations of directors and licensees apply to AI-assisted decisions.
Courts have set their own rules. Several Australian courts have issued practice notes on generative AI, with the Supreme Court of New South Wales restricting its use in affidavits and expert reports.
Sector rules still bite. Financial services, health, employment screening and government decision-making each carry their own obligations that constrain AI use well beyond anything AI-specific.
5 Legal Risks of Using Generative AI in Business
Intellectual property. Two distinct problems. Inputs: reproducing a substantial part of a copyright work when feeding material into a system may engage the Copyright Act 1968 (Cth), and Australia has no general fair use defence, only specific fair dealing exceptions, which are narrower than the United States position that most international commentary assumes. Outputs: Australian copyright law protects works with a human author, so purely machine-generated output may not attract copyright at all, meaning you may not own what you paid to produce and cannot stop others using it. For anything commercially important, keep evidence of the human authorship involved.
Privacy. Personal information put into a generative AI system is a collection, use and potentially a disclosure under the Privacy Act 1988 (Cth). Cross border disclosure engages Australian Privacy Principle 8, which can leave you accountable for an overseas recipient's handling. Outputs asserting things about identifiable people are themselves personal information. The Notifiable Data Breaches scheme applies if things go wrong. Privacy reform has been legislating in stages, including a statutory tort for serious invasion of privacy, so treat the position as moving.
Misleading or deceptive conduct. The Australian Consumer Law, in Schedule 2 to the Competition and Consumer Act 2010 (Cth), prohibits misleading or deceptive conduct in trade or commerce. AI-generated marketing copy containing an inaccurate claim is your conduct, not the model's. So are AI-generated reviews, AI-embellished capability statements, and overstated claims about your own AI ("fully automated", "100 per cent accurate"). The ACCC has been explicit that AI washing is treated like any other misleading claim.
Defamation. Australia's uniform defamation Acts apply to AI-generated material that identifies a person and lowers their reputation. Publishing such output, internally in some circumstances and certainly externally, exposes the publisher. Australia's defamation law is more claimant-friendly than the United States position, and the serious harm threshold has not removed the risk.
Contract and confidentiality. Pasting a counterparty's confidential information into a third party tool may breach a confidentiality clause. Many contracts now contain express AI terms. Customers' outside supplier guidelines increasingly restrict AI use, and breaching one is a contractual breach whatever the quality of the output. Employment contracts and workplace policies raise the same issue internally.
A sixth, cutting across all of them: accuracy. Output that is wrong causes harm through whichever of the above doors fits the facts.
Where imported guidance misleads Australian businesses
Most generative AI legal commentary reaching Australian readers was written for the United States, and four of its assumptions do not hold here.
Fair use does not exist in Australia. United States commentary leans heavily on fair use to justify training and input practices. Australia has fair dealing exceptions instead, which are closed categories covering purposes such as research or study, criticism or review, parody or satire, reporting news, and professional legal advice. If your use does not fall within a listed purpose, there is no general reasonableness test to fall back on. This is the single most important difference and the one most often missed.
Privacy is not the GDPR. Australia has the Privacy Act 1988 (Cth) and the Australian Privacy Principles. There is no general right to explanation of automated decisions, no data protection officer requirement, and no GDPR-style consent architecture. Applying European templates produces compliance work you do not need while missing APP 8, which is the provision that actually bites.
Defamation exposure is higher, not lower. Australia's uniform defamation Acts are considerably more claimant-friendly than United States law, which has no equivalent of the constitutional protections American commentary assumes. AI output about identifiable people carries more risk here, not less.
Consumer law is stricter on claims. The Australian Consumer Law prohibition on misleading or deceptive conduct has no intention requirement. An AI-generated claim that is simply wrong can contravene it, and the ACCC has been explicit about overstated AI capability claims.
Best Practice Checklist for Safe Use
Write a one page AI policy. What tools are approved, what may be entered into them, what must be verified, and who is responsible. One page that people read beats twenty that they do not.
Classify your data before you start. Public, internal, confidential, personal, sensitive. Set a default rule for each. This single step prevents most privacy and confidentiality incidents.
Resolve vendor terms in writing. Storage location, training use, retention, deletion, subprocessors, breach notification and exit. Check whether terms differ between free and paid tiers.
Verify everything externally facing. Marketing claims, advice, anything filed, anything about an identifiable person. Verification is the control that addresses risks three, four and five simultaneously.
Keep a human decision-maker. Named, accountable, and with the ability to override. This is the core of the National AI Centre's framework and of every regulator's expectation.
Record human authorship for anything you need to own. Given the uncertainty about copyright in machine-generated output, evidence of the human contribution is what protects a commercially important asset.
Check your contracts. Both directions: what your customers require of you, and what you require of your suppliers.
Train the people using it. Most incidents come from an individual pasting something they should not have, under time pressure.
Review every six months. The law and the tools are both moving.
Keep a record of what you decided and why. If a regulator or a client asks how you assessed a tool, a short written assessment is the difference between a governance position and an improvisation. It also makes the six month review a ten minute job rather than a fresh start.
Where to concentrate the effort. If you do only three of these, do the data classification, the vendor terms and the verification rule. Between them they address privacy, confidentiality, contract and misleading conduct risk simultaneously, and they cost a few hours rather than a project. The remaining items reduce residual risk and improve your position if something goes wrong, which is worth doing and is not where the exposure actually sits.
What's Changing in 2026 and 2027
Privacy reform continues in stages. The reform package, including a statutory tort for serious invasion of privacy, has been proceeding in tranches with more foreshadowed. Anyone processing personal information through AI should track this actively rather than relying on a settled summary.
Court practice guidance will consolidate. Individual courts have issued their own notes at different times with different requirements. Practitioners appearing across courts currently track several standards, and some convergence is likely.
Voluntary frameworks are hardening through procurement. The National AI Centre's guidance is not binding, and it is increasingly referenced in tenders and outside counsel guidelines, which gives it contractual force in practice even without legislation.
Regulator enforcement is likely to lead legislation. The ACCC on misleading AI claims, the OAIC on privacy, and ASIC on governance can all act under existing powers, and enforcement under existing law tends to arrive before new statutes.
Sector-specific rules will move first. Financial services, health, employment screening and automated government decision-making are the areas where targeted obligations are most likely, rather than a general AI Act.
What is unlikely to change is the underlying allocation of responsibility. Australian regulators and courts have consistently placed accountability on the human deploying the system.
Ask.Legal's Approach to This Risk Landscape
Ask.Legal aims to help identify where generative AI use touches the risks this guide sets out, by answering questions against Australian legislation and case law with citations attached, and flagging when a use case sits closer to privacy, consumer law or IP exposure. It is not a substitute for the written policy and vendor-terms work this guide recommends. See Ask.Legal's approach or ask a question free. For the primary sources behind the risks above, see the Copyright Act 1968 (Cth), the Privacy Act 1988 (Cth), and the OAIC's guidance on privacy and AI.
Frequently Asked Questions
Is generative AI regulated in Australia? Not by a dedicated statute. Copyright, privacy, consumer, defamation and contract law apply, with the National AI Plan and National AI Centre guidance setting voluntary direction.
Do I own what generative AI produces? Uncertain. Australian copyright protects works with a human author, so purely machine-generated output may not be protected. Record the human contribution.
Can AI output be defamatory? Yes. Australia's uniform defamation Acts apply to material identifying a person and lowering their reputation, and the publisher is exposed.
Can I put customer data into an AI tool? Only after checking the Privacy Act 1988 (Cth) position, particularly cross border disclosure under APP 8, and any contractual confidentiality obligations.
What is the National AI Plan? The Australian Government's policy framework for AI, sitting alongside the National AI Centre's voluntary Guidance for AI Adoption. Neither is binding legislation.
Key Takeaways
Australia regulates generative AI through general law, not a dedicated AI Act, and responsibility sits with the deployer.
The five business risks are intellectual property, privacy, misleading conduct, defamation and contract.
Australia has no general fair use defence and may not protect purely machine-generated output, which is where imported United States guidance misleads most.
A one page policy, data classification, written vendor terms and mandatory verification address most of the exposure.
Sources
Copyright Act 1968 (Cth); Privacy Act 1988 (Cth) and the Australian Privacy Principles; Competition and Consumer Act 2010 (Cth), Schedule 2 (Australian Consumer Law); the uniform Defamation Acts of the states and territories
Australian Government National AI Plan; National AI Centre / Department of Industry, Science and Resources, Guidance for AI Adoption
Office of the Australian Information Commissioner, guidance on privacy and artificial intelligence; ACCC guidance on misleading claims
Supreme Court of New South Wales practice note on generative artificial intelligence
Get an AI-powered legal risk check for your generative AI use with Ask.Legal
This article is general information about the law of Australia as at 2026, not legal advice. For advice on your circumstances, consult a qualified Australian legal practitioner.