AI Regulation in Australia: What Brokers Must Know

Is AI Regulated in Australia?

Yes, Australian laws regulate activities involving AI even without a general AI Act. The National AI Centre’s guide to Australian law explains how existing protections apply to AI-related harms.

For a mortgage brokerage, four areas need attention.

Area	How it applies to AI use
Privacy	The Privacy Act 1988 governs personal information handled by covered businesses. Putting information into AI, or generating personal information through AI, can trigger those duties.
Consumer protection	AI-generated marketing or explanations can mislead clients. The Australian Consumer Law applies generally, with similar protections for financial products and services under the ASIC Act 2001.
Credit law	The National Consumer Credit Protection Act 2009 governs regulated credit assistance. AI support doesn’t transfer your assessment or recommendation obligations to the software.
Anti-discrimination	Existing discrimination laws can apply where AI use unlawfully excludes people or treats them differently because of a protected attribute.

The Australian Consumer Law overview explains the financial-services distinction. Calling every broker obligation an Australian Consumer Law requirement would miss the role of the Australian Securities and Investments Commission (ASIC).

AI ethics and law overlap, but they have different status. An ethical principle guides a decision. An applicable law creates an obligation that a regulator or court can enforce.

The Voluntary AI Safety Standard

The Voluntary AI Safety Standard is a 2024 framework with 10 guardrails, and it creates no new legal duties by itself. The government’s guardrail guidance covers the following actions.

1. Assign accountability and build the capability to govern AI.
2. Assess and manage risks throughout use.
3. Secure systems and govern data quality and origins.
4. Test performance before deployment and monitor it afterwards.
5. Keep people able to control or intervene in systems.
6. Tell users about AI decisions, interactions and generated content.
7. Give affected people a way to challenge AI use or outcomes.
8. Share risk information across the AI supply chain.
9. Keep records that let others assess compliance.
10. Involve affected people and assess fairness, inclusion and safety.

In 2025, the government evolved this framework into six essential practices. The Guidance for AI Adoption groups the work around accountability, impacts, risk management, information sharing, testing and human control.

For a brokerage adopting AI, use that newer guidance to organise the work. Assess each use separately: drafting a general newsletter and processing a client’s financial information create different risks.

AI labelling and disclosure fit within transparency work. The voluntary guardrails aren’t a universal legal requirement to label every AI-assisted sentence, although privacy and misleading-conduct duties can require disclosure in particular circumstances.

Australia’s AI Ethics Principles

Australia’s eight AI Ethics Principles are voluntary principles introduced in 2019. The government’s ethics framework addresses the following concerns.

Principle	What it asks organisations to consider
Wellbeing	Whether AI benefits people and society, including environmental effects.
Human values	Whether its use respects human rights and people’s choices.
Fairness	Whether people can access the system without unfair discrimination.
Privacy and security	Whether personal information and data remain protected.
Reliability and safety	Whether the system works safely for its intended purpose.
Transparency	Whether people can understand AI’s involvement and its effects.
Contestability	Whether affected people can challenge an AI-related outcome promptly.
Accountability	Whether responsible people can be identified and provide human oversight.

The 2025 adoption guidance builds on these principles as well as the earlier guardrails. For brokers, fairness means examining how a tool treats different clients, while contestability means providing a person who can review a disputed outcome.

Adopting an ethics statement doesn’t establish compliance with credit or privacy law. The statement needs practical controls that address the brokerage’s actual AI uses.

The Australian AI Safety Institute

The Australian AI Safety Institute tests emerging AI capabilities and supports regulators with technical evidence about risks and harms. It sits within the Department of Industry, Science and Resources.

The government announced the institute in 2025. A ministerial launch speech in 2026 confirmed it was operating and testing frontier models during its first month of operations.

Its published role covers model testing, support for regulatory responses and international work on safe AI development. Frontier models are advanced models whose capabilities can create emerging risks beyond a single business use.

The institute supplies expertise to existing regulators. It isn’t itself a regulator, and its establishment doesn’t replace ASIC’s role in consumer credit or the privacy regulator’s role.

What Applies to Mortgage Brokers

Mortgage brokers retain their best interests duty, responsible lending obligations and applicable privacy duties when AI assists their work. A useful AI output can support your process, but you remain responsible for the recommendation you give the client.

Best Interests Duty

The best interests duty requires a client-specific recommendation. ASIC’s Regulatory Guide 273 explains the need to understand the consumer and record the reasoning behind the products recommended.

Keep the evidence you used to reach the recommendation. If AI helps compare lender policies, record the relevant policy evidence and your reasons for accepting or rejecting the suggested options.

Responsible Lending

Responsible lending involves reasonable enquiries about the consumer’s circumstances and requirements, with reasonable steps to verify their financial situation. The resulting assessment addresses whether the proposed credit is unsuitable.

ASIC’s Regulatory Guide 209 explains those obligations. An AI-generated affordability estimate doesn’t remove the need for the relevant enquiries and verification.

Consider a hypothetical file where AI has treated overtime as base salary. Comparing the output with the client’s payslips exposes the error before it affects the assessment.

Privacy and Disclosure

The Office of the Australian Information Commissioner (OAIC) says privacy duties extend to personal information entered into AI and personal information generated by it. Its guidance on commercially available AI products covers due diligence and transparent handling practices.

Before using a tool with client information, establish what it stores and who can access it. Assess any overseas handling and the provider’s use of information for training.

The OAIC recommends against entering personal information, especially sensitive information, into publicly available generative AI tools as a matter of best practice. Consent to handle information must cover the relevant purpose where consent is required.

Give clients an accurate explanation of how you handle their information. Describing a service as secure doesn’t establish a lawful basis to upload a client’s documents.

Changes Coming Next

Separate enacted changes awaiting commencement from voluntary guidance and policy proposals. An announcement about AI laws doesn’t make its proposed requirements binding on brokers.

Development	Status and effect
Mandatory high-risk guardrails proposal, 2024	The government consulted on possible mandatory guardrails. The proposals paper itself creates no duties.
National AI Plan, 2025	The plan keeps existing laws and regulators central to AI oversight, alongside targeted changes. It doesn’t enact the earlier guardrails as a general law.
Automated-decision transparency reforms, enacted in 2024	Additional privacy-policy duties are scheduled to commence later in 2026. Covered businesses must apply the new requirements once they commence and the statutory conditions are met.
National AI infrastructure standards proposal, 2026	The consultation concerns large data centres and frontier AI training. These proposed standards don’t establish a general permission requirement for brokers using AI software.

The 2024 guardrails announcement describes a proposal. The National AI Plan explains the government’s subsequent approach, while the 2026 infrastructure consultation sets out the newer proposal’s scope.

For brokerages, the automated-decision change has a direct preparation task. The OAIC’s APP 1 guidance gives the commencement and scope.

The change covers certain decisions using personal information that could significantly affect a person’s rights or interests. It also covers computer processing substantially and directly related to making those decisions, so retaining a human approver doesn’t automatically exclude a workflow.

Map the personal information used in those workflows and the kinds of decisions they support. Have your compliance owner assess the statutory conditions and prepare the required privacy-policy information before commencement.