Fortnightly Bulletin · AU-first regulatory & governance watch
Issue: 4 August 2026
My take
I’m hugely encouraged to see this step. For a year the honest line has been “there’s no AI law coming, so comply with what already applies” — and a government standing up an Office of AI and committing to legislated standards is a genuine change of posture, in the right direction. But don’t let the announcement pull your eye off the deadlines already on the table. The one that binds you is 10 December: the OAIC’s automated decision-making transparency obligation. It was there before the PM stood up, and no announcement moves it. So take the encouragement, then do the boring, load-bearing thing — find out where your organisation is already making automated decisions about people, and who owns each one. This week is a promise; December is a date.
— Gethryn Ghavalas, AI Strategy & Governance, Agile Insights
My take
For a year, the Australian picture has been steady: no new AI-specific law, just the tightening of obligations you already have — privacy, work health and safety, government policy. This fortnight that changed. On 15 July the Prime Minister announced that Australia will legislate a set of “Australian Standards for AI” and stood up an Office of AI inside the Department of Prime Minister and Cabinet, effective immediately, with the approach going to National Cabinet in August and legislation flagged for early next year. The headline is data centres — power, water, land, copyright — but the direction of travel is what matters: Australia has moved from “manage AI with the laws we already have” to “write new ones.” It did so in the same fortnight the EU moved the other way, its Digital Omnibus deferring the AI Act’s standalone high-risk obligations out to December 2027. Two of the world’s reference regulators, moving in opposite directions in a single fortnight. Underneath both sits the same question, and it hasn’t moved: where is AI making decisions in your organisation, and who owns it? With the OAIC’s automated-decision-making transparency obligation now under five months out, that’s the question worth answering first.
01
AU-first
A genuine change of posture this fortnight — but the obligation that actually binds you is still the December one.
Australia to legislate “Australian Standards for AI” — Office of AI stood up in PM&C (15 July). The PM announced at the University of Sydney that the Government will introduce legislated Australian Standards for AI, building on the Data Centre Expectations, with a new Office of AI in the Department of Prime Minister and Cabinet to drive it. Near-term substance is concentrated on large data centres — obligations to underwrite their own power, pay full connection costs, curtail on demand, be water-efficient, and not compete with housing for land — plus strengthened copyright giving artists control over use of their work in AI training. The framework goes to National Cabinet in August; legislation is flagged for early 2027. → This is the first move toward dedicated AI law in Australia. The data-centre detail won’t touch most organisations directly, but the machinery — a standing Office of AI and a legislated standards regime — will. Treat it as “watch, don’t act yet”; the detail lands at National Cabinet in August.
OAIC ADM transparency — under five months out, guidance still pending. The obligation commences 10 December 2026; the consultation closed 15 June and formal guidance is still expected September, leaving roughly a quarter between final wording and commencement. It applies to APP entities — Commonwealth agencies and private-sector organisations over $3m turnover — and the expected reading reaches decision-support tools, not only fully automated outcomes. → The date is fixed and the runway is short. If you rely on automated decision-making and you’re waiting for the September guidance before starting, you’re cutting it fine — the inventory work doesn’t depend on the final wording.
EU Digital Omnibus — high-risk obligations deferred (the contrast). The EU gave the Digital Omnibus on AI its final green light on 29 June, and on Official Journal publication this month it pushes the AI Act’s standalone high-risk obligations (Annex III) out to 2 December 2027, with product-embedded high-risk systems (Annex I) to 2 August 2028, and application no longer tied to the arrival of harmonised standards; it also adds a new prohibition on AI used to generate child sexual abuse material and non-consensual intimate imagery. → If you have EU exposure, this is more runway, not less obligation — only the clock moved. Don’t let “the EU delayed it” become a reason to down tools.
– What this signals: read it for the direction, not the data-centre specifics. If you deferred AI-governance work on the basis that Australia wasn’t going to regulate, that reasoning no longer holds. Nothing commences yet, and the sensible steps are unchanged — build your AI and automated-decision-making register, meet the December obligations — but “there’s no AI law coming” has stopped being a reason to wait.
02
Australia announcing a bespoke regime is the headline, but it changes nothing operational this fortnight — the register is still the control that carries the load under every regime.
The register survives the regime change. Whatever the Australian Standards for AI eventually legislate, they will need the same foundation every existing obligation already needs: an inventory of where AI and automated decision-making are used, with a named owner for each, kept current. The Commonwealth’s 15 June government-policy requirement demanded exactly that; the OAIC’s December obligation demands it; a legislated standards regime will demand it too.
The cancellation number is the one to watch, not adoption. Over 40% of agentic AI projects will be cancelled by 2027 on unclear value, cost and weak controls — and secondary reporting of Gartner and IDC data puts the failure rate starker still, with around 89% of agentic pilots never reaching production (secondary — treat as directional).
– What this signals: if you have already built that register, none of this fortnight’s news costs you — it is regime-agnostic and carries forward. The organisations exposed by the shift are the ones who treated “Australia isn’t passing an AI law” as permission to do nothing.
– What this signals: the question that separates the survivors is not “are you using agents?” but “can you show the value, the controls and the owner for each one?” Most pilots aren’t killed by the technology — they’re killed by the absence of exactly the governance the regulators are now asking for anyway.
03
The model releases didn’t pause for the policy news. Capability keeps climbing; the “which model” question stays as open as ever.
GPT-5.6 hits general availability (9 July); Gemini 3.5 Pro cleared for a July launch. OpenAI opened the GPT-5.6 family to general availability on 9 July, ending the two-week gated preview that ran behind a US-government safety review, with GPT-5.6 Sol as the reasoning flagship. Google’s Gemini 3.5 Pro is cleared to ship this month. Claude Fable 5 — restored 1 July after its 18-day export-control suspension — tops the raw benchmark tables, with Claude Opus 4.8 still leading the enterprise intelligence index.
– What this signals: frontier releases now routinely pass through a government gate before they reach you — the two-week GPT-5.6 preview sat behind a US-government safety review, echoing last fortnight’s Fable 5 suspension. The durable position for your organisation is unchanged: a model-agnostic governance layer, a named owner for each model in use, and a tested fallback for every critical workflow. Leaderboard positions are churn; the ability of someone else to switch a model off under you is structural.
04
The strategy picture is stable; this fortnight’s policy shift mostly changes the timeline pressure, not the plan.
The scaling gap and the cancellation rate are the same problem from two ends: most organisations are past experimentation but stuck short of enterprise scale, and the barrier is consistently governance, cost and proof of value — not capability. A roughly 31% “at least one agent in production” figure sits against the reality that most pilots never scale — the difference is operating-model discipline.
The structural response is maturing: dedicated AI-governance ownership, agent-level controls, and a lifecycle view of agents rather than one-off model approvals. Australia standing up a national Office of AI is the same instinct at country scale — someone owns it, and it is a standing function, not a one-off policy.
The throughline this fortnight should reassure you and press you in equal measure: the ground moved, and the control did not. Australia announcing a legislated AI-standards regime and a standing Office of AI is the biggest shift in posture we have seen — but it commences nothing yet, and it rests on exactly the foundation that already mattered: knowing where AI and automated decision-making happen in your organisation, and who owns each one. If you have done that register work, this news costs you nothing — it carries under the obligations you already have, the December ADM date, and whatever the Australian Standards for AI eventually legislate. If you have not, the “we’ll wait until Australia regulates” position ended on 15 July.
The nearer pressure is the timeline. Between the OAIC’s guidance (expected September) and its 10 December commencement sits about a quarter — and the inventory work does not depend on the final wording. Waiting for September means compressing a whole compliance programme into ten weeks over Christmas. Start the register now against the trigger test as it stands; the September detail refines the edges, it will not change the core task. If you run automated triage, eligibility or prioritisation — as many not-for-profit and service organisations do — assume you are in scope by 10 December and work back from there.
And treat model dependency as a real risk, not a footnote. A frontier model can now be switched off under you by a government two jurisdictions away — it happened this quarter. For every critical workflow, name the model owner, keep a tested fallback, and prove the switch works before you need it.
Wherever you are on the December clock, the Agile Insights AI Strategy & Governance practice can meet you there:
Where AI actually creates value for your organisation, and how you organise around it — the operating model, ownership and roadmap, not a tool wish-list.
We find where AI and automated decision-making touch decisions about people, name an owner for each, and map it to the OAIC trigger test, ready for 10 December.
Agent-level controls, model ownership and tested fallbacks — so you can show the value, the controls and the owner for every AI system, not just point at a policy.
