Status of the AI Regulations

As noted above, as yet there are no specific statutes or regulations in Australia that directly regulate AI. Neither the Consultation, the Interim Response, nor the Proposals Paper provide any indicative timeline for when specific AI regulation might be expected.

Other laws affecting AI

There are various laws that do not seek to regulate AI, but that may affect the development or use of AI in Australia. A non-exhaustive list of these laws include:

• The Online Safety Act 2021,⁶ which includes mechanisms to address online safety issues, extending to AI generated material
• The Australian Consumer Law, which was applied to algorithmic decision making in a Federal Court case which ordered Trivago to pay $44.7 million in penalties for misleading consumers about room rates in the recommendations made by its algorithm⁷
• The Privacy Act 1988⁸
• The Corporations Act 2001⁹
• Intellectual property laws may affect several aspects of AI development and use
• Anti-discrimination laws, for example, where an individual is a victim of a discriminatory outcome resulting from an AI-driven process

In the Interim Response, the Australian Government acknowledged that existing laws will likely need to be strengthened to address harms posed by AI. To that end, on September 12, 2024, the Australian Government introduced the 'Communications Legislation Amendment (Combatting Misinformation and Disinformation) Bill 2024' to provide the Australian Communications and Media Authority (ACMA) with regulatory powers to combat online misinformation and disinformation, extending to content on digital platforms that are generated by AI.

Definition of “AI”

No definition of AI has been formally adopted by any statutes or regulations in Australia. In the Consultation, the Commonwealth Department adopted the following definitions:¹⁰

• "AI" means "an engineered system that generates predictive outputs such as content, forecasts, recommendations or decisions for a given set of human-defined objectives or parameters without explicit programming. AI systems are designed to operate with varying levels of automation"
• "Machine learning" means "the patterns derived from training data using machine learning algorithms, which can be applied to new data for prediction or decision-making purposes"
• "Generative AI" means "models [that] generate novel content such as text, images, audio and code in response to prompts"

The definitions of AI, machine learning and algorithm are stated to be based on the International Organization for Standardization's definitions.¹¹

The Voluntary AI Safety Standard provides a framework definition for safe and responsible AI:

• "Safe and responsible AI" means "AI should be designed, developed, deployed and used in a way that is safe. Its use should be human-centered, trustworthy and responsible. AI systems should be developed and used in a way that provides benefits while minimizing the risk of negative impact to people, groups, and wider society."

In the Proposals Paper, the Australian Government is seeking public consultation on whether to implement a principles-based approach or a list-based approach (as adopted in the EU and Canada) to define "high-risk AI".

Territorial scope

As noted above, there are no specific statutes or regulations in Australia that directly regulate AI. Accordingly, there is little to no guidance on any specific territorial scope at this stage.

Sectoral scope

As noted above, there are no specific statutes or regulations in Australia that directly regulate AI. Accordingly, there is little to no guidance on any specific sectoral scope at this stage. To date, the focus of the Consultation, Interim Response and Proposals Paper has not been sector-specific, and it is expected that any AI-specific regulations will apply across all sectors of the Australian economy.

Compliance roles

As noted above, there are no specific statutes or regulations in Australia that directly regulate AI.

However, AI developers and users should note that the proposed mandatory AI guardrails impose compliance requirements on Australian organizations. These requirements include: (i) establishing internal governance protocols to ensure compliance with the guardrails; (ii) maintaining records to enable third parties to assess compliance; and (iii) undertaking conformity assessments in order to certify compliance with the guardrails.

Core issues that the AI Regulations seek to address

While voluntary, the AI Ethics Principles are designed to ensure AI is "safe, secure and reliable" by: (i) achieving safer, more reliable and fairer outcomes for all Australians; (ii) reducing the risk of negative impact on those affected by AI applications; and (iii) assisting businesses and governments to practice the highest ethical standards when designing, developing and implementing AI. By implementing the AI Ethics Principles, as well as the Voluntary AI Safety Standard which seeks to address similar issues, businesses can begin to develop the practices needed for future AI regulatory environments.

The proposed mandatory guardrails set clear regulatory expectations from the Australian Government on the safe and responsible use of AI. They focus on providing Australian businesses with: (i) greater regulatory certainty over the AI landscape; (ii) mechanisms to mitigate risks and harms associated with AI; and (iii) public trust in the development and deployment of AI in Australia in high-risk settings.

Risk categorization

As noted above, there are no specific statutes or regulations in Australia that directly regulate AI.

In the Interim Response, the Australian Government indicated that it would adopt a risk-based framework to AI regulation, meaning the regulatory requirements will be commensurate to the level of risk posed by the specific use, deployment or development of AI where, for example, higher risk AI applications will likely include uses that may result in negative impacts for people that are difficult or impossible to reverse.

This risk-based framework is further reflected in the Proposals Paper, which outlines a risk-based approach for new mandatory AI guardrails enforced in Australia. In implementing mandatory AI guardrails, the Australian Government will consider: (i) the levels of risk and key attributes of identified risks; and (ii) the balance of ex ante (preventative) and ex post (remedial) regulatory measures to successfully mitigate against identified risks.

In addition, specific risk categories were identified in the Proposals Paper:

Category 1: This category relates to known or foreseeable uses of an AI system and risk is measured based on the context in which the AI system will be applied.

Category 2: This category applies to advanced AI systems with unforeseeable applications and emergent risks. Risk is assessed based on the AI system's potential use – or misuse – for purposes that may cause widescale harm. By the time these risks become foreseeable, it may be too late to apply effective preventative measures.

Key compliance requirements

As noted above, there are no specific statutes or regulations in Australia that directly regulate AI. The voluntary AI Ethics Principles identify the following broad principles for ensuring safe, secure and reliable AI:

• Human, societal and environmental wellbeing: AI systems should benefit individuals, society and the environment
• Human-centered values: AI systems should respect human rights, diversity, and the autonomy of individuals
• Fairness: AI systems should be inclusive and accessible, and should not involve or result in unfair discrimination against individuals, communities or groups
• Privacy protection and security: AI systems should respect and uphold privacy rights and data protection, and ensure the security of data
• Reliability and safety: AI systems should reliably operate in accordance with their intended purpose
• Transparency and explainability: There should be transparency and responsible disclosure so people can understand when they are being significantly impacted by AI, and can find out when an AI system is engaging with them
• Contestability: When an AI system significantly impacts a person, community, group or environment, there should be a timely process to allow people to challenge the use or outcomes of the AI system
• Accountability: People responsible for the different phases of the AI system lifecycle should be identifiable and accountable for the outcomes of the AI systems, and human oversight of AI systems should be enabled

The Voluntary AI Safety Standard identifies the following principles for ensuring safe, secure and reliable AI:

• Accountability: Establish, implement and publish an accountability process that outlines governance polices and regulatory compliance strategies
• Risk Management: Establish and implement risk management processes to identify and mitigate risks that are known or foreseeable
• Data Governance: Protect AI systems by implementing data governance, privacy and cybersecurity measures to manage security vulnerabilities such as data quality and data access
• Model Testing: Test AI models and evaluate performance before placing high-risk AI systems on the market, as well as continuously monitor the system once deployed
• Human Oversight: Enable human control and intervention across AI systems to achieve meaningful human oversight
• User Information: Inform end-users on how AI is being used, particularly around AI-enabled decisions, AI interactions and AI-generated content
• Complaints Mechanism: Establish processes for people negatively impacted by high-risk AI systems to contest AI-enabled decisions or make complaints about their experience
• Transparency: Be transparent with other organizations across the AI supply chain by sharing information about data, models, and systems to effectively mitigate risks
• Record Keeping: Keep and maintain records, including technical documentation, to allow third parties to assess compliance with guardrails
• Engage stakeholders: Engage stakeholders and evaluate their needs and circumstances, with a focus on safety, diversity, inclusion and fairness

The Proposals Paper suggests transitioning from the current voluntary AI guardrails, as outlined in the Voluntary AI Safety Standard, to mandatory guardrails. Consequently, organizations developing or deploying high-risk AI systems would be required to adhere to the first nine voluntary guardrails listed above.

The tenth proposed mandatory guardrail (Conformity Assessments) differs from the tenth voluntary guiderail, which emphasizes ongoing stakeholder engagement to evaluate stakeholders' needs and circumstances based on safety, diversity, inclusion and fairness.

The Proposal Paper and its mandatory guardrails have been developed based on AI regulations enforced in Canada and Europe, specifically the Artificial Intelligence and Data Act in Canada and the EU AI Act in Europe.

Regulators

There is currently no AI specific regulator in Australia.

However, it is expected that sector-specific regulators such as the Australian Competition and Consumer Commission, the ACMA, the Office of the Australian Information Commissioner and the e-Safety Commissioner will be involved in the Australian Government's approach to the regulation of AI in Australia. As noted above, we can expect that the ACMA will be given certain regulatory powers to combat online misinformation on digital platforms that are generated by AI.

Enforcement powers and penalties

As noted above, there are no specific statutes or regulations in Australia that directly regulate AI. The use, deployment or development of AI may be subject to enforcement and penalties if it breaches other, non-AI specific statutes and regulations.

_{1 The AI Ethics Principles (2019) is available here.
2 The Voluntary AI Safety Standard is available here.
3 The Consultation paper is available here.
4 The Interim Response is available here.
5 The Proposals paper is available here.
6 The Online Safety Act 2021 (Cth) is available here.
7 See Australian Competition and Consumer Commission v Trivago N.V. [2020] FCA 16 here.
8 The Privacy Act 1988 (Cth) is available here.
9 The Corporations Act 2001 (Cth) is available here.
10 See the Consultation at page 5.
11 See ISO/IEC 22989: Artificial intelligence concepts and terminology here.}

_{White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.}

_{This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.}

_{© 2024 White & Case LLP}