AI Regulation in Australia for Accountants

AI regulation in Australia currently relies on existing laws and professional obligations, with voluntary guidance alongside them. Your practice’s responsibilities apply whenever staff use AI for client work.

For an accounting practice, the immediate questions are what information reaches the AI provider and who checks its output. A proposed AI law does not suspend the rules that already govern either decision.

Is There an AI Law in Australia?

Australia has no single, economy-wide AI Act governing an accounting practice’s ordinary AI use. Existing laws already apply to AI, including the Privacy Act 1988 and the Australian Consumer Law.

The National AI Centre’s explanation of AI and Australian law identifies legal risks from misleading outputs, misuse of information and poor security. Professional codes add obligations for the practitioner using the tool.

For example, an AI-written email can contain a false statement about a service. Using AI does not remove the Australian Consumer Law’s prohibition on misleading conduct. A privacy breach can also occur when information enters a tool, before anyone uses its answer.

Different rules apply to different activities. Copyright can affect material used as an input. Employment and anti-discrimination laws can apply when AI helps assess job applicants. The absence of a general AI Act does not create an exemption from those laws.

Australia’s AI Ethics Principles and Voluntary Standards

The ethics principles and voluntary standards help organisations decide how to use AI responsibly. They do not replace legislation or a practitioner’s professional obligations.

The Eight AI Ethics Principles

The government’s AI Ethics Principles cover eight areas. They address human wellbeing and rights as well as the way organisations operate AI systems.

Principle	What It Asks an Organisation to Consider
Human, societal and environmental wellbeing	Whether AI benefits people and the environment
Human-centred values	Respect for human rights and individual autonomy
Fairness	Unfair discrimination or exclusion
Privacy protection and security	Protection of personal information and data
Reliability and safety	Whether the system works for its intended purpose
Transparency and explainability	Whether people understand when AI affects them
Contestability	How people can challenge an AI outcome
Accountability	Who is responsible and how people oversee the system

For your practice, accountability means assigning someone to approve an AI use and respond when it goes wrong. Contestability means a client can reach a person about an AI-assisted decision affecting them.

From Ten Guardrails to Six Practices

The Voluntary AI Safety Standard sets out ten guardrails for organisations developing or using AI. Its published standard expressly creates no new legal obligations.

The National AI Centre’s newer Guidance for AI Adoption develops the standard and ethics principles into six practices. These address accountability, impacts, risk management, information sharing, testing and human oversight.

Its implementation guidance distinguishes organisation-wide responsibilities from checks for each use. One AI provider can support several tasks with different risks. Drafting a generic reminder differs from assessing a client’s tax position using their financial records.

Use that distinction when approving tools. Record the permitted task, information staff can enter and the person responsible for reviewing the result. Approval for a low-risk writing task does not automatically approve client-data uploads.

These resources form part of Australia’s safe and responsible AI work. They help a practice organise its decisions while existing regulators continue to enforce the laws within their responsibilities.

Proposed AI Regulation

The earlier proposal for mandatory guardrails in high-risk AI settings is not proceeding at this time. The Department of Industry’s consultation update states that explicitly. It says the consultation informed the National AI Plan.

Under the National AI Plan, existing Australian laws remain the regulatory foundation. The plan also describes an AI Safety Institute to test emerging capabilities and advise government and regulators about risks.

Separate proposals announced in 2026 concern large data centres and AI training in Australia. The Office of AI coordinates work to design and legislate national standards, including mandatory requirements for large AI data centres.

The government’s AI infrastructure consultation proposes requirements for resource use and community impacts. It also proposes conditions for frontier AI training. These proposals concern infrastructure and training, so they do not establish a general permission system for your practice’s everyday AI use.

Copyright remains a separate policy issue. The Attorney-General’s Department’s Copyright and Artificial Intelligence Reference Group considers licensing and rights in AI-generated material. Its work also covers enforcement of copyright in AI outputs.

When reading AI regulation news, distinguish an announcement or consultation from a law that has commenced. For your practice, a new requirement matters when its scope includes your activity and its commencement provisions apply.

What Applies to Your Practice Today

Your practice must meet the obligations that apply to its services and information handling now. The TPB Code, privacy rules and APES 110 have different scopes, so assess each separately.

TPB Code Obligations

Registered tax and BAS agents remain responsible for services performed with AI. The Tax Practitioners Board’s AI guidance statement applies existing Code obligations, including competence and reasonable care.

Before relying on an AI answer, assess whether it fits the client’s facts and the relevant tax law. Staff need enough knowledge to recognise an error. The practice must provide appropriate supervision when staff use AI in tax agent services.

Confidentiality applies to information about a client’s affairs. Obtain the client’s permission before disclosing it to a third party unless a legal duty requires disclosure. Entering information into an AI tool can be such a disclosure, depending on its configuration and use.

Explain the proposed disclosure when obtaining permission, including who receives the information and where it is stored. Keep the permission and review evidence with the relevant work. The separate TPB AI guidance explains those expectations in more detail.

Privacy Act and TFN Handling

Where the Privacy Act covers your practice’s activity, the Australian Privacy Principles govern personal information used with AI. Assess the purpose of collection and the permitted use or disclosure before entering information.

Privacy Act coverage needs its own assessment. The OAIC’s small-business guidance explains that some small businesses have exemptions, while others are covered. Separate TFN rules can apply even where the Australian Privacy Principles do not.

For a small practice undertaking AML/CTF reporting activities, OAIC guidance for reporting entities distinguishes those activities from other business work. Coverage for the reporting activity does not automatically settle coverage for every service.

Client permission under the TPB Code does not settle every privacy requirement. Review the OAIC AI guidance for the privacy regulator’s expectations when using commercially available AI products.

APES 110 Professional Duties

For members subject to APES 110, professional competence and due care apply when using technology. Confidentiality also covers how the member uses and discloses client information.

The Accounting Professional and Ethical Standards Board’s technology-related revisions address these duties. Understanding an AI tool’s limits is part of deciding whether its output is appropriate for the work.

Apply the Rules to One Task

Consider this hypothetical task: a staff member wants AI to draft tax advice from a client’s financial records. First establish whether the proposed information disclosure is permitted. Then assign a competent reviewer to check the advice against the records and tax law.

Keep the approval, relevant client permission and review record with the job. If the provider changes its data-use terms or the practice adds a new task, reassess that use before staff continue. That gives your principal evidence of how the practice meets its existing duties.