You have decided to build AI into your product or your operations. You have probably read that privacy law, consumer law, intellectual property, employment law and sector-specific licences all need attention. But the list treats every business the same — and they are not. A solo developer fine-tuning a model on public datasets faces a different legal exposure to a startup running an AI triage tool for a medical clinic. Getting clear on which considerations actually apply to your situation is the first practical step.
The real question is not "what laws exist for AI businesses in Australia?" It is "which of those laws are live issues for my business, right now, given my size, my sector, my data and my use case?" The answer depends on five factors examined below. Most businesses will find two or three areas of genuine exposure and a few they can defer — which is a far more useful starting point than a comprehensive checklist treated as uniformly urgent.
Factor 1: How much personal information you process
Privacy is the most commonly triggered consideration for AI businesses, but the threshold question is whether the Privacy Act 1988 (Cth) actually applies to you.
The Act's 13 Australian Privacy Principles (APPs) apply to "APP entities." In the private sector, the small business exemption means that if your annual turnover is $3 million or less, you are generally not an APP entity — unless you fall into an exception category. Small businesses that are still covered despite being under the threshold include private sector health service providers, entities that trade in personal information, and credit reporting-related businesses, among others.
What this means in practice:
- Under $3 million, no carve-out: Privacy Act obligations do not automatically apply. That said, collecting sensitive data (health information, biometrics, financial details) from users raises serious trust and reputational risks even without a statutory duty. Building good privacy practice early is sensible risk management regardless.
- Over $3 million, or within an exception: The APPs are live obligations. You need a compliant privacy policy that accurately describes what you collect, why, how long you retain it, and how you respond to access requests. Cross-border disclosures to overseas processors require due diligence.
- Eligible data breaches: APP entities are subject to the Notifiable Data Breaches scheme. A breach that is likely to result in serious harm to individuals must be assessed within 30 days and notified to affected individuals and the Office of the Australian Information Commissioner (OAIC) if the assessment confirms an eligible breach.
The Privacy and Other Legislation Amendment Act 2024 (Cth), which received Royal Assent on 10 December 2024, introduced new enforcement tiers and a statutory tort for serious invasions of privacy. It also includes provisions relating to automated decisions, which come with a two-year implementation period expiring December 2026. Even businesses not currently caught by the Act should watch this space.
Factor 2: What your AI claims to do
Regardless of your size or sector, s 18 of Sch 2 of the Competition and Consumer Act 2010 (Cth) (the Australian Consumer Law) prohibits conduct in trade or commerce that is misleading or deceptive, or likely to mislead or deceive. This applies to all businesses trading in Australia, with no turnover threshold.
For AI products, the exposure runs in two directions:
- Performance claims: If you market your model's accuracy, capabilities or outputs in terms that overstate what it reliably delivers, you are exposed. "AI-powered" is not necessarily misleading, but specific accuracy claims that your system cannot consistently meet — particularly in decision-support contexts — carry real risk.
- Nature of the output: Where your AI generates content that users are likely to treat as professional advice (legal, medical, financial), and your terms do not clearly distinguish information from advice, you may find yourself on the wrong side of this provision.
The practical questions to answer: Do your marketing materials make capability claims you can substantiate? Do your terms and in-product disclosures make the nature and limitations of outputs clear? If you upgraded your model recently, are your claims still accurate?
Factor 3: Whether your sector triggers a licence or registration
There is no blanket "AI licence" in Australia. Whether you need a specific licence depends entirely on what your AI does and in which regulated sector.
| Sector | Trigger | Relevant requirement |
|---|---|---|
| Financial services | AI that provides financial product advice or distributes financial products | Australian Financial Services Licence (AFSL) under the Corporations Act 2001 (Cth), or authorised representative arrangement; digital AI advice covered by ASIC RG 255 |
| Health / medical | AI used in clinical diagnosis, treatment recommendation or patient management | Assessment as software as a medical device by the Therapeutic Goods Administration (TGA) may be required |
| Workplace monitoring | AI that records calls, captures images or monitors staff | Compliance with state-based surveillance and listening device laws, which vary across jurisdictions; transparency notices required in most states |
The key test is function, not label. A tool that an operator describes as a "decision support" product may still trigger the AFSL regime if it crosses into personal advice as defined under the Corporations Act 2001 (Cth). If your tool sits near a regulated boundary, get a clear answer before launch rather than after.
Assessing your licence exposure
Businesses well clear of the regulated sectors — for example, an AI tool for internal document drafting, marketing copy or data classification — will usually have no licence exposure. Businesses whose tools touch health information, lending decisions, investment recommendations or staff surveillance should treat the licence question as a prerequisite, not an afterthought.
Factor 4: Who owns the IP your AI creates and uses
Intellectual property questions arise on both sides of the AI development stack: the IP your business creates, and the IP your business uses or relies on.
What your business creates:
Copyright in works created by employees under a contract of service vests in the employer under s 35(6) of the Copyright Act 1968 (Cth). Works created by independent contractors, however, remain with the contractor by default — the business does not automatically own them. Without a written IP assignment clause in your contractor agreements, code, model weights and documentation developed by contractors may belong to them, not you.
For AI-generated outputs themselves, the Copyright Act 1968 (Cth) does not currently recognise AI as an author, and there is no provision that clearly attributes ownership of AI-generated works to the business deploying the tool. Guidance from IP Australia and academic commentary has flagged this gap, but reform has not yet closed it. Treat AI-generated outputs as potentially unprotected and consider whether human creative input is sufficient to ground a copyright claim in the circumstances.
What your business uses:
- Training data: If your model was trained on third-party datasets, scraped content or licensed data, confirm that your use for training, fine-tuning and commercial distribution is within the terms under which you obtained that data. Terms of service for many data sources explicitly prohibit scraping or AI training uses.
- Open-source model components: Open-source licences vary significantly. Some (MIT, Apache 2.0) are permissive; others (GPL variants) impose copyleft conditions that can affect how you can distribute a model built on them.
- Third-party APIs and foundation models: Your right to use outputs commercially, fine-tune, and sub-license is governed by the API provider's terms. Check these explicitly — and re-check them after any provider update.
The practical profile: if you are buying a third-party AI API and using it as a feature in your product, your IP exposure is mainly in your own code and brand. If you are training or fine-tuning proprietary models, data rights and model weight ownership become central.
Factor 5: The risk profile of your use case
This factor cuts across the others and determines how heavily you weight governance, human oversight and contractual safeguards.
Consider what goes wrong if your model makes an error. An AI that mislabels a product image costs you a support ticket. An AI that miscalculates a medication dosage or produces a legally incorrect answer that a user acts on has potentially catastrophic consequences. The degree of downstream harm shapes how urgently you need:
- Human-in-the-loop requirements: For high-stakes use cases, contractual and product-level requirements for human review are both good practice and a key liability-management mechanism.
- Liability caps and exclusions in your customer terms: Contracts that do not cap your liability for consequential loss, or that leave your obligations unspecified when a model update changes behaviour, leave you exposed.
- Professional disclaimers: If your output touches legal, medical, financial or safety-critical domains, clear in-product language distinguishing information from advice is not optional.
- Logging and audit trails: Decision logging supports incident investigation, regulatory enquiries and customer disputes. It is most valuable in higher-risk use cases but increasingly expected across the board.
The Department of Industry, Science and Resources published its Guidance for AI Adoption in October 2025 (an update of the earlier Voluntary AI Safety Standard, released August 2024), setting out six essential practices for responsible AI governance. The guidance is voluntary but reflects what regulators and enterprise customers increasingly expect — and provides a useful benchmark for calibrating your governance posture.
Where Artificer Legal can help
Mapping legal exposure to your specific situation requires working through these five factors with someone who understands both the legal framework and how AI businesses actually operate. At Artificer Legal, we help Australian AI businesses:
- Assess whether the Privacy Act applies to your current structure and data handling, and what changes would trigger obligations if your business grows
- Review product claims and terms of service for ACL compliance before launch
- Identify whether your use case crosses a regulated threshold in financial services, health or workplace monitoring
- Audit IP ownership across your staff, contractor and vendor arrangements and fix gaps with targeted agreements
- Draft or review customer terms that accurately allocate liability for AI outputs, including human-in-the-loop obligations and model change provisions
Getting clarity on the two or three areas of genuine live exposure — rather than trying to solve every potential issue at once — is usually the most efficient path. We can help you identify where to start.
Making the call
The factor that usually resolves the most uncertainty is your sector. If your AI is firmly outside regulated verticals — health, financial services, workplace surveillance — your immediate legal obligations reduce to the ACL (universal), privacy if you are above the turnover threshold or handle sensitive data, and IP (always relevant but often solvable with a clause). That is a manageable starting list.
The factor people most often misjudge is IP ownership over contractor-built code and model components, and the resulting assumption that what their business paid for is what their business owns. It is often not, without an explicit written assignment.
Here is a summary of the considerations mapped to the five factors:
- Privacy: Applies to APP entities (generally over $3 million turnover or within exception categories); Notifiable Data Breaches scheme requires assessment within 30 days of a suspected eligible breach; new statutory tort and automated decision provisions from the 2024 reforms apply to all covered entities
- Australian Consumer Law: Applies to all businesses regardless of size; AI performance claims and output disclosures are the primary exposure points
- Sector licence: Only triggered if your use case crosses into financial product advice, health device territory or workplace surveillance — confirm before launch
- IP: Contractor copyright and data rights are the most common live issues; AI-generated output ownership remains legally unsettled in Australia
- Use-case risk profile: Determines the intensity of governance, contractual safeguards and human oversight your product needs — not an on/off question but a spectrum