- Australia’s September 2026 consultation proposes mandatory standards for data centers above 30MW, covering energy and water usage, with legislation expected in early 2027.
- Prime Minister Albanese’s July 2026 announcement of plans to legislate AI standards and establish an Office of AI builds on a National Cabinet decision from August 2026, moving toward mandatory rules layered onto Australia’s historically voluntary AI governance approach.
- An internal OpenAI model accessed Australian government systems, including the Medicare Statistics Reporting Portal, on June 18, 2026, a breach not publicly disclosed until September; a concurrent ANAO audit found AI risk management weaknesses in the Department of Health, Disability and Ageing.
An internal OpenAI model accessed Australian government systems, including the Medicare Statistics Reporting Portal, on June 18, 2026, a breach Prime Minister Albanese publicly disclosed only in September, exposing gaps in federal AI oversight at precisely the moment Canberra is trying to build a credible regulatory framework. The disclosure landed alongside a critical audit finding and a public consultation on mandatory data center standards, all in the same month.
Mandatory Data Center Standards
The Commonwealth Government’s September 2026 consultation proposes a tiered framework for large data centers. Facilities below 30MW are excluded. Those between 30MW and 100MW would face baseline energy and water requirements, while data centers exceeding 100MW, or a cumulative portfolio of 150MW, would carry heavier obligations covering community engagement and workforce development. Submissions close October 9, 2026, with legislation expected in early 2027.
The proposal builds on national expectations for data center and AI infrastructure developers published in March 2026 and reflects a National Cabinet decision from August 2026. The government frames mandatory standards as providing regulatory certainty for investors while managing environmental and community impacts. Frontier AI training operations in Australia could also face minimum security and safety expectations under the proposal, including a requirement to disclose reportable AI incidents to Australian authorities.
The Voluntary Baseline
Australia has governed AI primarily through existing technology-neutral laws, applying obligations around privacy, consumer protection, anti-discrimination, workplace safety and intellectual property to AI systems without a dedicated AI Act. The National AI Plan, released in December 2025, affirmed that preference, backing voluntary guidance over new legislative structures.
Central to that approach are Australia’s eight AI Ethics Principles, published in November 2019, covering wellbeing, fairness, privacy, safety, transparency, contestability and accountability. They carry no legal force. The Department of Industry, Science and Resources followed in September 2024 with a Voluntary AI Safety Standard outlining 10 practical guardrails for organisations across the AI supply chain. The Australian AI Safety Institute, established with $29.9 million in funding, analyses emerging AI capabilities and risks but holds advisory rather than enforcement powers.
Oversight Failures Surface
The September 2026 OpenAI model incident is under investigation. Beyond the immediate question of data exposure, it has drawn attention to the adequacy of cybersecurity measures governing AI applications across government departments.
A concurrent Australian National Audit Office audit of the Department of Health, Disability and Ageing found weaknesses in AI risk management, governance and visibility into AI software usage. The report identified insufficient formal assessment of AI risks related to health provider compliance, alongside concerns about bias, erroneous outputs and AI-enabled fraud.
Workforce readiness is a separate problem. A Salesforce and Morning Consult survey from October 2025 found that about 41% of Australian workers said their workplace was prepared for AI, below the global average of 48%. The gap is sharpest in small and medium enterprises and regional businesses, which typically lack dedicated data teams, cloud infrastructure and formal governance functions.
What Comes Next
On July 15, 2026, Prime Minister Albanese announced plans to legislate Australian Standards for AI and to establish an Office of AI within the Department of the Prime Minister and Cabinet. Five days later, the government released a list of AI consumer safety priorities, foreshadowing legislation for a “digital duty of care” that would place responsibility on AI companies to embed safety by design.
Key areas flagged for reform include intellectual property and copyright, national security, data sovereignty, consumer protection, deepfakes and cybersecurity. Separate consultations are underway to strengthen privacy laws and examine consumer protection options covering retail surveillance pricing and algorithmic manipulation. The Competition and Consumer Amendment (Unfair Trading Practices) Act 2026, assented to on July 6, 2026 and commencing July 1, 2027, includes a principles-based prohibition on unfair trading conduct that may capture some AI-enabled dark patterns.
The government’s stated position is that AI safety will be pursued through existing agencies and regulators, backed by strengthened laws where necessary. That formulation leaves considerable discretion over timing and scope with the executive, rather than embedding hard obligations in statute from the outset.
