Australia State AI Laws Overview

Overview

Across Australia, state and territory governments have constructed structured administrative and regulatory frameworks to govern the development, procurement, and deployment of artificial intelligence (AI), with a primary concentration on public sector governance and automated decision-making systems. While direct statutory bans or comprehensive commercial AI acts remain rare at the sub-national level, Australian states aggressively leverage executive directives, policy frameworks, public record mandates, and mandatory risk assessments to ensure responsible AI usage within government operations and state-funded entities.

New South Wales (NSW) established an early sub-national benchmark by releasing its mandatory Artificial Intelligence Assessment Framework (AIAF) and enforcing compliance via mandatory circulars. Other Australian jurisdictions—including Victoria, Queensland, Western Australia, the Australian Capital Territory (ACT), Tasmania, and the Northern Territory—have similarly enacted binding policies and operational guidelines. These frameworks target high-risk automated decision-making, generative AI safety, administrative recordkeeping, data sovereignty, and ethical alignment across public sector agencies.

Together, these state-level instruments create a robust policy baseline. By relying on administrative leverage and public procurement requirements, Australian state governments enforce ethical safeguards, algorithmic transparency, and risk mitigation in public administration without waiting for comprehensive statutory federal reforms.

Regulatory Approach

The dominant regulatory approach across Australian states is administrative governance and risk-based assurance rather than standalone, direct legislative codification. State jurisdictions govern AI primarily through cabinet approvals, treasury and customer service circulars, public record mandates, and department-level policies. This administrative strategy allows jurisdictions to adapt swiftly to technological shifts—such as generative AI models—while enforcing rigorous standards around public trust, administrative fairness, and public resource management.

Significant variation exists in how individual jurisdictions execute these principles. Jurisdictions such as NSW and Queensland employ formal, tiered risk assessment methodologies—including the NSW AIAF and Queensland’s Foundational Artificial Intelligence Risk Assessment (FAIRA)—which require comprehensive risk scoring and mitigation planning before AI systems are purchased or implemented. Conversely, states like Victoria combine central administrative guidance with specialized oversight, focusing heavily on record retention mandates via Public Record Office Victoria (PROV) and data protection compliance under state privacy commissioners.

Smaller jurisdictions and territories, including the Northern Territory, Tasmania, Western Australia, and the ACT, rely on centralized principles-based frameworks. These focus on practical guardrails, ethical alignment with national principles, human-in-the-loop oversight, and safe generative AI integration across civil service operations.

Key State Legislation

Key state regulations and governing policy instruments across Australian jurisdictions include:

• New South Wales: DCS-2024-04 Circular and the mandatory NSW AI Assessment Framework (AIAF), establishing binding risk assessment, ethical standards, and departmental reporting across all NSW public sector agencies.
• Queensland: Queensland Government Enterprise Architecture (QGEA) Artificial Intelligence Governance Policy and the Foundational Artificial Intelligence Risk Assessment (FAIRA) guideline, providing binding risk classification, governance controls, and assessment tools for state entities.
• Victoria: Administrative Guideline for the Safe and Responsible Use of Generative AI in the Victorian Public Sector and the PROV Artificial Intelligence Technologies and Recordkeeping Policy, setting strict generative AI controls and legal record preservation standards.
• Western Australia: Western Australia AI Policy Framework, directing Western Australian government agencies on ethical principles, governance requirements, and mandatory compliance timelines.
• Australian Capital Territory: ACT Government Artificial Intelligence Policy, defining ethical guidelines, human oversight requirements, and risk management obligations for ACT territory agencies.
• Northern Territory: Northern Territory AI Assurance Framework, establishing structural governance, ethical standards, and risk categorization across NT government departments.
• Tasmania: Guidance for the Use of Artificial Intelligence in Tasmanian Government, issued by the Tasmanian Government Secretaries Board to manage responsible technology adoption across public authorities.

Enforcement Bodies

Enforcement and compliance oversight across Australian states is distributed among central customer service departments, chief digital officers, public sector commissions, and statutory integrity bodies. In New South Wales, oversight is led by the Department of Customer Service in coordination with the NSW AI Advisory Committee and the Information and Privacy Commission. In Queensland, governance is managed under the Queensland Government Enterprise Architecture (QGEA) framework administered by the Department of Customer Services, Open Data and Small Business.

In Victoria, public sector compliance is overseen by the Department of Government Services alongside statutory authorities including Public Record Office Victoria (PROV) and the Office of the Victorian Information Commissioner (OVIC). In Western Australia, South Australia, Tasmania, the ACT, and the Northern Territory, enforcement relies on administrative governance boards, public sector commissions, and cabinet secretary committees charged with maintaining cross-departmental compliance.

Penalties & Enforcement

Because state AI frameworks operate largely through administrative circulars, executive policies, and governance directives, direct enforcement relies primarily on public sector compliance mechanisms, executive discipline, and procurement disqualification. Failure to comply with mandated AI frameworks can result in procurement cancellation, mandatory remediation, internal departmental sanctions, and public criticism through State Auditor-General audit reports.

However, where automated or AI-assisted systems breach existing state statutory regimes—such as state privacy statutes, public record management laws, anti-discrimination legislation, or health records acts—statutory penalties apply directly. For instance, illegal processing or unauthorized storage of personal information via an unapproved generative AI tool in Victoria or NSW triggers statutory regulatory action and potential financial or injunctive remedies under state privacy legislation.

Sector Focus Areas

Australian state AI regulations focus intensely on high-risk public sector activities and administrative decision-making. Public procurement and digital infrastructure modernization represent major areas of intervention; state rules mandate detailed risk assessments and architectural approval before government funds can be committed to AI solutions. Automated decision-making (ADM) in core administrative functions—such as social welfare allocation, public housing, land planning, and public sector employment—is closely scrutinized to guarantee procedural fairness and administrative review rights.

Other vital focus areas include public recordkeeping, healthcare, and state education systems. State recordkeeping authorities enforce strict retention requirements for AI-generated decisions and model prompts to prevent accountability gaps. Concurrently, state health and education authorities maintain specialized guidelines prohibiting the unvetted input of confidential patient details, medical diagnostic data, or student records into external commercial AI platforms.

National/Federal Alignment

State AI regulatory policies across Australia align closely with national initiatives, specifically Australia’s AI Ethics Principles and the Voluntary AI Safety Standard published by the federal Department of Industry, Science and Resources (DISR). While federal authorities concentrate on broader economy-wide guardrails, federal privacy act reform, and national voluntary safety standards, state frameworks act as operational governance rules within sub-national public jurisdictions.

State frameworks routinely adopt international risk management standards (such as ISO/IEC 42001 and NIST frameworks) and mirror national guidance. This multi-tiered structure establishes a cohesive regulatory ecosystem: federal bodies define strategic national principles and overarching statutory standards, while state and territory governments implement enforceable assurance processes within local public authorities.

Notable Provisions

A notable feature of state AI regulation in Australia is the mandatory implementation of structured Algorithmic Impact Assessments (AIAs) prior to system deployment. Under the NSW AIAF, public agencies must complete detailed risk scorecards evaluating potential bias, human rights impacts, and data protection concerns, maintaining an internal audit trail to ensure ongoing system accountability.

Another landmark provision is Victoria’s Public Record Office policy (PROV), which explicitly categorizes artificial intelligence outputs, user prompts, training datasets, and automated decision logs used in government actions as permanent public records. This provision prevents state agencies from relying on ephemeral, non-auditable generative AI tools for policy formulation or formal administrative decision-making, setting a precedent for public sector transparency.

Future Developments

Future state-level AI regulation in Australia is expected to transition progressively from administrative guidelines to codified statutory amendments. As the Australian Federal Government advances mandatory guardrails for high-risk AI applications, state parliaments are reviewing existing state privacy, anti-discrimination, work health and safety, and administrative law statutes to close legislative gaps concerning algorithmic bias and automated harm.

Anticipated developments include coordinated updates across state parliaments regarding electoral integrity standards—such as restrictions on AI-generated deepfakes during state elections—and standardized cross-border procurement rules established through the Data and Digital Ministers' Meeting (DDMM). State governments are also updating governance rules to manage autonomous AI agent workflows and edge-computing applications in public transport and critical infrastructure.