What Australia’s National AI Plan and Office of AI mean for your organisation

On 15 July 2026, Prime Mininster Anthony Albanese delivered a landmark speech on AI Policy, laying out a framework for AI in Australia. The headline was the announcement of Australia’s Office of AI, which brings Australia’s AI policymakers under a single office within the Department of Prime Minister and Cabinet. The Office of AI is the delivery arm for Australia’s national AI plan: a single national framework, coordinated by the Office, to govern how AI is built, powered and adopted in Australia’s interests. 

 Alongside the announcement, the Prime Minister committed to develop new Australian Standards for AI and stronger protections for Australian creative work used in AI training. 

 For Australian organisations looking for guidance on what government (and therefore, its regulators) expect from AI, this is a significant step forward – and worth paying attention to. Here’s what you should take from what was said, and how you should prepare for what’s set to come next.

What is Australia’s Office of AI? 

 The Office of AI is a coordinating body that acts as a centralised, single source of truth for AI-related policy. The Office of AI’s remit spans nine policy domains: energy, copyright, productivity, employment, education, online safety, defence, national security and data centres. Each of these layers represents a critical aspect of AI. In bringing them together under the Office of AI, the government aims to streamline what had previously been a fragmented, agency-by-agency response to AI regulation in Australia. 

 Crucially, the Office of AI is not a regulator and has no legislated power yet. However, the intention is that the Office of AI will eventually help design and coordinate the national AI framework Australia has been promised. 

Which policy domains matter for regulated organisations?  

 The nine AI policy domains don’t carry equal weight. So, mapping them against your existing obligations is the easiest way to see what’s coming. For APRA-regulated organisations, including banks, insurers and superannuation funds, the data centre, energy and national security domains all fall under CPS 230 (operational resilience) and CPS 234 (information security). Since AI is fast becoming indispensable to how organisations operate, AI vendors will increasingly be classified as material service providers under CPS 230’s materiality test. Where the arrangement touches the data itself, it’s an information asset under CPS 234. Either way, it’s regulated. 

For critical infrastructure operators, the data centre and energy domains extend obligations that already exist under the SOCI Act. The copyright domain applies to every organisation that procures AI tools commercially, through the training data liability considerations. More on that later in the article. Employment, education and online safety are directional only, but signal where your workforce and acceptable-use policies will need to be ready.  

 What are the Australian Standards for AI?  

The Australian Standards for AI are what the government intends to legislate to ensure AI works in Australia’s interests. The government says the standards will make Australia the first country to bring the economic, social, national security and environmental dimensions of AI within a single framework. National Cabinet will consider the approach in August 2026, with legislation expected in Parliament in early 2027. There is no confirmed commencement date beyond that, so nothing announced is binding yet. Concrete detail exists for data centres, while the other domains are, at this stage, direction without specifics. 

Data centre standards: the foundation of AI capability 

Amid the Prime Minister’s address came some clarity on what to expect from data centres. Amid a global backlash to large-scale, AI-driven data centre development that’s hit Australian shores, data centre standards got a special mention in the AI address. 

 Specifically, new Australian Standards for AI will require large-scale data centre operators to become net-generators of power, putting back as much energy into the grid as they draw. That comes alongside further requirements on grid connection, energy efficiency and water use. Providers must pay their full share of grid connection costs so those costs are not passed to household consumers, and must be as energy and water efficient as possible, including through demand flexibility. 

 This follows on from the Australian Government’s Data Centre Expectations, released in March 2026. The Data Centre Expectations are currently voluntary, but the Australian Government has since declared its intention to legislate them. 

 For organisations running workloads in colocation or hybrid environments, the action item that comes out of these obligations is to determine whether your provider meets them. If they currently don’t, the cost of getting compliant will likely flow through to your contract. It’s worth having that conversation with your provider now so you know what to expect.  

What the standards leave open – for now  

The creation of the Office of AI is a step in the right direction. That is, it gives your organisation a sense of who its AI deployments will need to answer to. But nothing’s set in stone yet. Who controls the data AI gets trained on?

The Prime Minister said “not everything produced in Australia is up for grabs”. That’s a clear commitment to protecting the ownership and control writers, musicians, artists and journalists hold over their work. But it’s not an enforcement guideline.

For organisations, this presents a critical consideration: understanding where the AI tools you use source their training data. If a vendor’s training data wasn’t properly licensed, the business using that tool commercially could carry exposure too, not just the AI company that built it. Nobody, including the government, has said definitively who would (or wouldn’t) be liable. Until it’s clarified, treat the source of vendor data as your own risk.  

The framework leaves more key questions unanswered: Will there be incentives for early compliance, minimum standards that apply across the board, or formal requirements with teeth behind them? Each of those implies a very different relationship between government and industry, and the announcement didn’t say which one it’s aiming for. 

AI provenance vs sovereignty vs data residency: what the announcement covers 

Three terms will shape how the framework lands, and they are often conflated. Each answers a different question, and each carries its own vendor assessment questions you can put to any AI provider today. 

Here’s what each term means, and the questions to ask to ensure your AI solutions meet them. Provenance is about where AI training data came from and whether it was properly licensed. This is the copyright question the Prime Minister addressed directly. Ask your vendors: what data was this tool trained on? Can you evidence that it was licensed or lawfully obtained? Who carries liability if it turns out it was not? If the answers are vague, price that uncertainty into the contract. 

Sovereignty is about whether AI capability itself, including models, infrastructure and decision-making, is built and controlled domestically. Ask: who owns the company providing this service, and which country’s laws govern it? Where is the model hosted, and who operates it? Can overseas authorities compel access to the environment? We unpack the three layers of this test in our guide to sovereign AI in Australia. 

Residency is about where data physically sits and which jurisdiction’s laws apply to it. Ask: where is my data stored, and separately, where is it processed? Can both be contractually guaranteed? Onshore storage alone isn’t enough, for reasons our guide to data sovereignty in Australia sets out in detail. You need all three lenses when assessing AI vendors and your AI risk. The announcement addresses provenance and sovereignty directly. Residency is not meaningfully addressed yet, which means your contractual protections are what govern it for now.

What do the AI standards mean for security and cyber resilience? 

For the framework to actually deliver on AI success and safety, it needs clear security standards at its core. Right now, its emphasis is weighted toward defence and copyright protection. Both reasonable priorities on their own, but building the cyber resilience and governance capable of supporting such diverse priorities at once is a genuinely complex, long-term undertaking. This isn’t something that gets solved in a single legislative cycle. 

 ”The opportunity presented by the national AI framework is significant. So is the responsibility to ensure AI is adopted in a way that is secure, transparent and trusted. Industry, including our own team, can play an important role in bringing that shared vision to life, provided we shape it together.” 

Fred Thiele, CISO, Interactive

Despite the uncertainty, the announcement should make your next move clear. Regardless of what future legislation or compliance requirements mandate, your organisation will be well-served to build its AI governance structures around durable principles: data transparency, security and environmental accountability.

How should organisations prepare for AI legislation? 

 Here’s what you can do now to prepare for whatever regulations will come down the line. Whether or not the legislation explicitly touches these, they’re still best practice for responsible AI adoption and capability. So, none of that work will go to waste.  

Vendor due diligence on data sources.  

Make “what data was your tool trained on?” a critical procurement question. Ask AI vendors how their training data was sourced, whether licensing or opt-out mechanisms exist and who holds liability if that data turns out to be unlicensed. 

 An AI register and approvals workflow.  

Build internal visibility into what AI tools are in use, what data they touch and who signed off – before there’s a legislated reason to need one. In any case, a register will keep your AI deployments honest – which is best practice regardless.  

Data centre and infrastructure decisions.  

If you’re building an AI data centre or selecting a data centre partner, make sure it’s somewhere that meets the expected net-generator power, energy and water efficiency standards from day one. Not only is this the most fleshed out AI requirement, it’s also the socially responsible thing to do, and is much easier than retrofitting later.  

Get these considerations right, and you’ve built the muscle that will help ensure your AI deployments don’t introduce unnecessary risk

How do governance and guardrails enable AI adoption? 

Regulatory uncertainty tends to pull organisations toward caution, and caution tends to slow AI adoption internally. We hear versions of the result constantly in the conversations we have with Australian organisations. Leadership is enthusiastic about the idea of AI, but the moment governance becomes a live question, everyone hesitates, waiting for someone else to make the first move.  

To move past that, you need to understand governance and adoption aren’t in conflict. Done properly, governance is what gives people the confidence to use AI tools well. Build clear internal guardrails early, then empower your people to use AI within them. That’s how you build real, sustainable AI capability that will stand up to any regulatory scrutiny that may come.  

Bringing our national AI vision to life 

The government has set the standard. But it can’t build sustainable data centres, define practical AI guardrails or maintain sovereign security on its own.That’s where technology partners come in. Genuine industry consultation will be the piece of the puzzle that determines this framework’s success. A national framework is only as useful as the practical, actionable guidance it gives organisations. And turning high-level policy into working governance, secure deployments and day-to-day operational reality is exactly what technology partners are built for.  

“The real test will be turning the framework into practical guidance that organisations can implement, while ensuring Australia remains competitive as global investment in AI capability continues to accelerate.” 

• Alex Coates, CEO, Interactive 

Where to next?  

The Australian Government has set the direction for AI. The framework’s detail is unwritten, but its principles are not: transparency over training data, sovereign control of critical capability, and infrastructure that carries its own energy costs. Organisations that build their AI governance around those principles now will meet whatever form the legislation takes with the least rework, and they will not be waiting on Canberra to start. 

If you’re still waiting for black-and-white legislative clarity, you’ll fall behind, and be forced to scramble to meet the regulations when there’s a tight deadline in front of you.   

 We’re looking forward to working collaboratively with government, partners and customers to help solidify Australia’s national AI posture. 

 If you’re ready to build, scale or test your AI strategy against the policy’s guardrails, we can help. Contact us or find out more about our Data and AI solutions