Most Australian businesses that have been using AI have been doing so instinctively.
A new tool is adopted because it saves time, a platform is integrated because a competitor is using it, an automated process takes over a manual process because the efficiency case is obvious. And along the way, no one asks who is held accountable if the AI gets it wrong, how the data it processes is treated or whether the people impacted by its decisions were consulted.
The Australian Government’s Voluntary AI Safety Standard addresses this.
What the Standard Actually Is
Published in September 2024 by the National Artificial Intelligence Centre and updated in December 2025, the Voluntary AI Safety Standard provides practical guidance to Australian organisations on how to safely and responsibly use and innovate with AI. The standard consists of 10 voluntary guardrails applying across the AI supply chain.
Voluntary guardrails in this context means that they do not create new legal obligations today, but the first nine guardrails have been aligned with proposed mandatory guardrails for high-risk AI settings.
As acknowledged by the government, businesses that comply with the Voluntary AI Safety Standard will also comply with international laws, a matter of practical relevance to any organisation with global clients, supply chains or ambitions.
The 10 Guardrails: What They Mean for Your Operations
Critically, the guardrails are not abstract principles. Each one sets out a specific governance action for organisations to take.
Guardrail 1: Accountability Processes
Set the required accountability processes to guide your organisation’s safe and responsible use of AI. Leaders cannot delegate or outsource accountability for the safe and responsible use of AI systems. If something goes wrong with an AI-assisted decision, accountability lies with the organisation that deployed the tool.
Guardrail 2: Risk and Impact Assessments
Before deploying an AI system, assess the risks it introduces and the possible impacts it has on the people it affects. Risk assessment under the standard is an ongoing obligation during the AI system’s lifecycle.
Guardrail 3: Data and Security Governance
AI systems are only as good as the data that is fed into them. This guardrail covers how personal information is collected, stored and used within AI systems and how security risks associated with AI data flows are identified and controlled.
Guardrail 4: Testing, Evaluation, Monitoring and Reporting
Before an AI system goes live, test it. After it goes live, test it again. The standard requires ongoing monitoring of AI system performance, user feedback and operational impacts.
Guardrail 5: Transparency and Explainability
People affected by the decisions of AI systems have a right to know they are being significantly impacted by AI and to understand at a meaningful level how decisions are being made. One of the most practically significant guardrails for businesses using AI in customer or HR contexts.
Guardrail 6: Human Oversight and Control
Enable human control or intervention in an AI system to achieve meaningful oversight across the lifecycle. The standard is clear that meaningful human oversight is not a dashboard someone looks at occasionally. It is a capacity to intervene when the system behaves in an unanticipated manner.
Guardrail 7: Processes for Regular Review
As AI systems learn, the data they process evolves and environments they operate in change, the systems themselves can evolve. Guardrail 7 requires structured review processes to ensure AI systems continue to perform as intended and emerging risks are identified.
Guardrail 8: Contestability
When an AI system makes a decision that significantly affects an individual, that individual should have a meaningful way of challenging it. For businesses using AI in hiring, credit assessment, customer service triage or performance management, this guardrail has direct operational implications.
Guardrail 9: Avoid Harms
Identify, assess and take steps to avoid harmful outcomes from AI systems, including harms that may not be immediately obvious, such as bias in outputs, privacy impacts and downstream effects on third parties. This guardrail directly connects to existing obligations under Australian Consumer Law and the Privacy Act and Australian Privacy Principles.
Guardrail 10: Stakeholder Engagement
Engage with internal and external stakeholders to understand potential impacts and harms, with a focus on safety, diversity, inclusion and fairness. The standard is clear that this should occur before deployment, not after problems arise.
Why Voluntary Does Not Mean Optional
There is a risk that businesses see this as a voluntary standard and put it on the shelf for later. This would be a misjudgement.
The consultation on mandatory guardrails for AI in high-risk settings closed in late 2024. The Government’s response has signalled that mandatory requirements are coming. The Responsible AI Index 2024 found that while most Australian businesses believe they are developing and deploying AI responsibly, fewer than a third had the necessary governance and system-level practices in place.
That divergence between how Australian businesses perceive their compliance and how regulators assess their compliance will become critical as mandatory requirements come into force.
Beyond future regulation, there are immediate legal reasons to take the guardrails seriously. Existing Australian laws already cover how AI operates in practice. The Privacy Act and Australian Privacy Principles address how AI systems handle personal information. Australian Consumer Law addresses AI-generated representations. Work health and safety laws address AI systems that manage work allocation or monitor performance. The Cyber Security Act 2024 applies when AI systems are involved in notifiable incidents.
The guardrails do not exist outside these laws. They exist alongside them, providing a governance framework to demonstrate that businesses are complying with existing obligations, as well as future ones.
What Governance Actually Looks Like in Practice
The standard is not asking businesses to stop using AI. It is asking them to use it with the same structured governance they apply to any other material business risk.
This means someone in the organisation owns AI risk formally, not informally. It means AI systems are assessed pre-deployment and monitored post-deployment. It means affected workers and customers have a pathway to raise concerns and expect a response. It means leadership reviews AI performance as a standing governance obligation.
At Anitech, we help Australian businesses develop the governance frameworks that enable responsible AI adoption. That means connecting the guardrails to existing risk management processes, assigning clear accountability, documenting the controls in place and ensuring leadership has the visibility to oversee AI use.
If your business has been using AI without a structured governance approach, the standard provides a practical starting point. And given where mandatory requirements are headed, starting now is considerably easier than catching up later.
Visit Anitech.
Recent Comments