AI Framework

Voluntary AI Safety Standard: What Replaced It in 2025

7 September 2026

The Voluntary AI Safety Standard (September 2024) was replaced in October 2025 by the National AI Centre's Guidance for AI Adoption, which condenses the original 10 guardrails into 6 practices called AI6. The old standard still isn't law. What changes on 10 December 2026 is real: a Privacy Act disclosure requirement.

The Voluntary AI Safety Standard launched in September 2024. It was replaced thirteen months later, in October 2025, and most businesses that read about it the first time around never heard about the update.

If you searched "voluntary ai safety standard" because you came across it somewhere and wanted to know whether it still applies: it doesn't, not as originally published. It was replaced by the Guidance for AI Adoption. Here's what actually changed, and what didn't.

What was the Voluntary AI Safety Standard, actually?

The Voluntary AI Safety Standard was 10 non-binding guardrails published by the Department of Industry in September 2024, covering things like accountability, risk management and human oversight - advisory only, with no penalty for skipping it. Then-Minister Ed Husic described it at launch as giving businesses "a set of actions... they can take to help them identify risks and how to respond to them in a practical sense."

Nobody was fined for ignoring it, because there was nothing to enforce. It existed to translate obligations businesses already had - under the Privacy Act, sector regulation - into a practical checklist, not to create new law.

So what replaced it?

In October 2025 the National AI Centre published the Guidance for AI Adoption, condensing the original 10 guardrails into 6 practices known as AI6: Accountability, Impact Assessment, Risk Management, Transparency & Information Sharing, Testing & Monitoring, and Human Oversight. Four of the old guardrails - informing users, letting them challenge a decision, supply-chain transparency and record-keeping - all folded into one practice: Transparency & Information Sharing.

It comes in two formats. Guidance for AI Adoption: Foundations is written for a general business reader. Guidance for AI Adoption: Implementation Practices is aligned to ISO/IEC 42001:2023, written for whoever in the business owns compliance.

Still voluntary. Still not law. What changed is the shape of the guidance, not its legal weight.

How the 10 guardrails became 6 practices

Four of the old guardrails folded into "Transparency & Information Sharing" - that's the practice that absorbed the most ground.

Is the AI Safety Institute the same thing?

No. The Australian AI Safety Institute is a $29.9 million federally funded body, announced in November 2025, that tests and evaluates AI models. It doesn't produce guidance for businesses to follow - that's a separate function. The National AI Centre, which owns AI6, takes the Institute's technical findings and turns them into the practical guidance businesses actually use.

Two different organisations, two different jobs. If you're a business owner, AI6 is the one relevant to you; the Institute's work sits upstream of it.

What actually has teeth: 10 December 2026

From 10 December 2026, the Privacy Act's APP 1.7 requires businesses to disclose automated decisions that could significantly affect someone's rights or interests - what data was used and what kind of decisions the AI made. This is the one date in this story with a real legal consequence attached - not the guidance, not the guardrails, an actual Privacy Act amendment.

To be precise about what it does and doesn't require: it's a disclosure obligation, not a right for someone to challenge a decision or demand a human review it. The requirement is disclosure - saying what's being done. It doesn't extend to justifying the decision, offering an opt-out, or explaining the logic behind it.

The OAIC's consultation on compliance guidance closed in June 2026. The deadline is fixed. The final guidance on meeting it still hasn't been published. Worth knowing both facts, not just the first one.

There's a third development: mandatory standards are coming

On 15 July 2026, the Prime Minister announced "Australian Standards for AI," a new Office of AI inside the Department of the Prime Minister and Cabinet, and legislation flagged for early 2027. The first mandatory standards target large-scale data centres - energy, water, grid stability - not AI governance across all businesses. The AI6 governance guidance remains voluntary for now.

The pattern matters, though: voluntary standard (2024), consolidated voluntary guidance (2025), a new Office of AI and the first mandatory standards announced (2026), legislation due (2027). The direction of travel is towards regulation, not away from it. Most content on this topic was written before this announcement and doesn't account for it.

Two sources disagree on how many SMEs actually use AI

The ABS and the National AI Centre report very different adoption numbers, and the honest approach is naming both rather than choosing the more flattering one. The ABS's Business Characteristics Survey puts overall business AI adoption at 12% (11% for small/micro businesses). The National AI Centre's own SME tracker puts it at 43-45%.

The gap comes down to definition. The ABS is measuring a stricter, more deliberate form of AI use. The NAIC's tracker is closer to self-reported "have you used anything AI-shaped," which likely captures everyday tool use like ChatGPT that a business owner wouldn't necessarily label as "adopting AI."

Separately, MYOB found AI-adopting SMEs growing 2.8 times faster than non-adopters - and 46% of SMEs reporting no plans to use AI at all in the next 12 months. Both can be true at once; they're describing different segments of the same population.

If you want the version specific to your own industry and turnover rather than the general guidance, AI Framework maps it against the Commonwealth and state instruments that apply to your business in one pass.

FAQ

Is the Voluntary AI Safety Standard still in effect? No. It was replaced in October 2025 by the Guidance for AI Adoption. Neither one is legally binding - the change is in structure and detail, not legal weight.

Do I have to comply with an AI Act in Australia? There's no standalone AI Act yet. What exists is voluntary guidance (AI6) plus your existing obligations under laws like the Privacy Act, which already apply regardless of what any AI guidance says.

What does the AI Safety Institute actually do? It tests and evaluates AI models at a technical level - it's not a business compliance framework. The National AI Centre turns its findings into the practical guidance (AI6) that businesses actually use.

What do I need to do before 10 December 2026? Check whether your business uses personal information in any automated decision-making, and if so, update your privacy policy to disclose what data is used and what kind of decisions result. The OAIC's consultation closed in June 2026 but the final compliance guidance hasn't been published yet.

Is the Guidance for AI Adoption mandatory? No - still voluntary, same as its predecessor. Mandatory "Australian Standards for AI" were announced in July 2026 with legislation flagged for 2027, so that status is expected to change.

For a broader view of how Australian privacy law applies to AI, see Data privacy regulations in Australia.

Reading the guidance is step one. Knowing which laws actually apply to your specific business, industry and AI use case is step two - get your free preview covers the first two AI6 practices at no cost.

This post is general information, not legal advice.

Current as at September 2026.

← Back to Insights