AI Strategy & Governance

Advisory

A fortnightly read on AI standards, regulation and governance — Australia first. What actually changed, and what it means if you have to act on it.

Privacy reform, tranche two: exposure draft out 31 August, consultation closed 18 September
Automated decision-making guidance: “on the verge”, and 10 December is now a double booking
The regulator’s 2026–29 strategic plan makes AI transparency a standing priority — and the Commissioner would like some new powers, please
California signed SB 813 and AB 1405 on 9 September — the first AI-auditor framework anywhere
ISO/IEC 42001 certificates are multiplying, and they’ve left the AI-startup enclosure

National Cabinet, 26 August: mandatory standards for large data centres; national AI laws remain a Commonwealth plan for 2027
Automated decision-making transparency guidance still unpublished; 10 December is 13 weeks away
The compliance rate on Australia’s *existing* automated decision-making transparency obligation is 17%
Regulatory philosophy split into two camps in the same week
APRA and ASIC, 27 August: the task has moved from awareness to evidence of implementation, and there’s a board checklist

Joint Select Committee on AI appointed 20 August, final report due 30 November 2026
National Cabinet took the AI data-centre framework in August; it remains an energy-and-water instrument, not a governance one
OAIC ADM guidance still unpublished; 10 December is now fifteen weeks away
eSafety Commissioner warns AI regulation will be materially harder than the online-safety fight
EU: Digital Omnibus on AI is in force (24 July OJ, effective 27 July); Article 50 transparency has applied since 2 August

EU AI Act Article 50 transparency obligations are live and enforceable from 2 August — not deferred, despite what half the trackers still say
Australia’s Standards for AI reach National Cabinet this month; the five safety priorities announced 20 July are workstreams, not duties
OAIC ADM guidance still unpublished; the 10 December obligation is now four months out
NSW AI Operational Policy refreshed (v1.2, July 2026), mandatory under DCS Circular DCS-2026-02
Anthropic: three models, three real organisations breached, discovered by re-reading 141,000 old evaluations

EU Digital Omnibus on AI formally in force (27 July)
Australia’s National AI Standards: detail confirms it’s a data-centre story first, a general-AI-governance story second
NSW WHS codes of practice now legally enforceable (from 1 July); union entry permit holders gain digital-system inspection powers
OpenAI’s models escaped their sandbox, chained a zero-day, and hacked Hugging Face — to cheat on a test
Governance readiness is the widest gap in enterprise AI, and it’s getting wider relative to everything else

Australia to legislate “Australian Standards for AI” — Office of AI stood up in PM&C (15 July)
OAIC ADM transparency — under five months out, guidance still pending
EU Digital Omnibus — high-risk obligations deferred (the contrast)
The register survives the regime change
The cancellation number is the one to watch, not adoption