Australia · 10 December 2026

If your AI uses people's data,
you will need to prove it.

From 10 December 2026 you must say, in your privacy policy, which tools use personal information and which decisions about people they make or feed. That needs a record: what you run, who owns it, what it touches.

Most organisations don't have that record. We run compliance workshops to build it.

Talk to us What a workshop covers
10 December 2026

The disclosure rules start. This is passed law — not a proposal, and not the 2027 standards bill.

Not the AI project someone scoped. The vendor features that came on by default. The prompts with customer details. The screening tool HR trialled last year. You need a record of what you already run. A workshop builds it.

Workshops

What a workshop is

A compliance workshop — not a strategy session. You upload what you already have. You leave with an inventory, owners, and a gap list.

Walk out with

  • An AI inventory, started — including tools nobody bought as an AI project
  • A named owner for every system
  • Your existing documents in one place
  • A gap list: what is missing, who is fixing it, by when
  • An export your lawyer can use for the December 2026 privacy-policy work

Walk out without

  • No badge, and nothing “certified”
  • No rewritten privacy policy
  • No claim that you are compliant

The workshop builds the record. Sign-off stays with your lawyer. That is the point.

The dates

The dated map

Europe already fines. Australia is a patchwork. This is what is law, announced, or voluntary. Dates checked against primary sources on 3 September 2026.

Sep 2024

Voluntary AI Safety Standard (10 guardrails)

Voluntary · Anyone a board, customer or tender already asks

10 Dec 2024

Privacy Amendment Act 2024 — ADM text added to APP 1

Passed; delayed commencement · APP entities

May–Sep 2026

OAIC issues paper and APP 1 guidance

Guidance around a statute · APP entities writing privacy policies

15 Jul 2026

Office of AI stood up; Australian Standards for AI announced

Announced; Office effective that day · First subjects: large data centres; training on Australian creative works

20 Jul 2026

AI consumer-safety priorities

Policy · Consumer-facing automated systems

Aug 2026

National Cabinet on the standards approach

Process · States and territories on infrastructure approvals

20 Aug 2026

Joint Select Committee on Artificial Intelligence appointed

Inquiry; report due 30 Nov 2026 · Anyone with a view on copyright, sovereignty, deepfakes, consumer law

10 Dec 2026

APP 1 automated-decision disclosures commence

Binding law · APP entities using in-scope ADM

Early 2027

Aim: enabling legislation for Australian Standards for AI

Announced target; no exposure draft · Coverage, regulator and penalties unsettled

Map first published by Cipher Projects on 31 August 2026. Primary sources are linked at the bottom of this page.

How we sort it

Four questions sort any AI use case

Including the ones nobody bought as AI. Every item on the list gets these in the workshop.

Law now

Does it process personal information?

Privacy Act. Prompts, logs, and vendor opt-ins all count. The OAIC enforces this today.

Starts 10 December 2026

Does it decide things about people — or help decide?

Your privacy policy will need to say what personal information is used, and what kinds of decisions the system makes or feeds.

APRA entities only

Is the organisation APRA-regulated?

CPS 230 and CPS 234 apply. If you are not APRA-regulated, skip this.

Law now

Does it affect customers, staff, applicants, or vulnerable people?

Privacy, employment, and consumer law already apply. The ACCC fined Trivago $44.7m over a misleading recommendation engine. No AI Act was needed.

Still voluntary

The 10 guardrails

Still the checklist a board, tender, or insurer will ask for. Not the law. Not the product.

  1. Accountability and governance
  2. Risk management
  3. Data governance and protection
  4. Testing and monitoring
  5. Human oversight
  6. Transparency and disclosure
  7. Challenge and appeal processes
  8. Supply-chain transparency
  9. Record-keeping and audit readiness
  10. Stakeholder engagement and fairness

The room

Who should be in the room

Two people minimum. Three is ideal. More than that and the day turns into a meeting.

A sponsor with authority

Someone who can say yes to the list and the owners, without a committee.

One operator

The person who can show logins, software spend, and the vendor list. They find the AI nobody calls AI.

Legal as a user, not an observer

Your lawyer reads the export and owns the privacy-policy wording. They do not need to sit through the upload.

Workshops

Compliance workshops

Prefer email? [email protected] or grab a time directly.

Talk to us Grab a time

The fine print, up front

Clear Direction AI is a Cipher Projects practice. Not a law firm. Not a compliance assessor. Nothing on this page is legal advice. Check official sources before you act. Sign-off on your privacy policy stays with your lawyer.

We do not claim Australia has an AI Act. It does not. We do not claim a workshop makes you compliant. No single session does.

Primary sources: Privacy and Other Legislation Amendment Act 2024 (Cth) · OAIC APP 1 guidelines · OAIC ADM issues paper · AI in Australia's interests (PM&C) · Joint Select Committee on AI · Norton Rose Fulbright, August 2026

Last verified against primary sources: 3 September 2026.