How Australia's AI rules hang together.

Note the carve-out: the DTA policy does not bind the Defence portfolio itself, but it still reaches you through contract terms and the Commonwealth AI model procurement clauses. SOCI applies directly to defence industry assets. Privacy Act ADM rules bite on HR, security screening and pre-qualification decisions from 10 Dec 2026.

Caught only if you cross the asset threshold (e.g. ≥30 MW generation) — but electricity, gas, liquid fuel, energy market operator and water are all in the nine enhanced CIRMP classes from 10 Jun 2026. Expect prescriptive controls on credential compromise and lateral movement, phased over 12–24 months, plus AI in OT documented as a material risk. Privacy Act still applies to hardship and workforce decisions.

No direct AI legislation applies to you — the pressure comes through procurement. Commonwealth buyers must use the AI model procurement clauses and complete an AI impact assessment, so tenders increasingly ask what AI you use, who owns it, and how it is assured. State requirements vary by jurisdiction. If you handle personal data in estimating, HR or site access, the 10 Dec 2026 ADM disclosure applies to you directly.

Privacy Act ADM rules apply to fitness-for-work, fatigue monitoring and HR decisions from 10 Dec 2026. SOCI applies where you hold a defined CI asset. Separately, ransomware payments must be reported within 72 hours under the Cyber Security Act 2024 — in force since 30 May 2025 and often missed.