Australia has no AI-specific law that governs agents. Existing regulators apply existing rules: APRA through prudential standards such as CPS 230 on operational risk, ASIC through conduct and licensing obligations, and the OAIC through the Privacy Act 1988. The government's voluntary AI safety standard sets out good practice that supervisors increasingly expect regulated firms to follow.
What do the rules require, in plain words?
Four sources shape what an Australian firm must do when it deploys an agent.
APRA's prudential standards. CPS 230 requires APRA-regulated entities, including banks, insurers and superannuation trustees, to manage operational risk, identify critical operations, set tolerance levels for disruption, maintain business continuity plans and manage material service providers. APRA's information security expectations sit alongside it.
ASIC's conduct regime. Financial services and credit licensees must meet their general obligations to provide services fairly and efficiently, avoid misleading or deceptive conduct, meet design and distribution obligations for products, and, for credit, meet responsible lending duties. ASIC has examined how licensees govern their use of AI and has warned that governance often lags adoption.
The Privacy Act 1988. The privacy principles limit collection to what is reasonably necessary, require notice, restrict use and disclosure to the primary purpose or a related purpose the person would reasonably expect, and require data quality, security, access and correction. The OAIC regulates and has issued guidance on privacy and AI products.
The voluntary AI safety standard. A set of guardrails covering accountability, risk management, data governance, testing, human oversight, transparency, the ability to contest outcomes, supply chain transparency and record keeping. It is voluntary, but it is the clearest statement of what the government considers responsible practice.
Who does it apply to?
APRA standards apply to APRA-regulated entities. ASIC's regime applies to licensees and to anyone making representations about financial products. The Privacy Act applies to most private organisations above a turnover threshold, and to all credit reporting bodies and health service providers regardless of size. The safety standard applies to anyone who chooses to adopt it.
What does this mean when the system is an agent that acts?
Three points are specific to how Australian rules reach agents.
An agent can be part of a critical operation. If an agent handles claims intake, payment exceptions or customer authentication, it is inside a critical operation under CPS 230. Its failure modes must be within the tolerance levels you set, and the platform supplying it is likely a material service provider, with the due diligence, contract terms and notifications that brings.
Agent conversations are conduct. What an agent tells a retail customer about a product is a representation by the licensee. Misleading statements are the licensee's, not the software's. Under design and distribution obligations, an agent that steers customers to products outside the target market is a distribution failure.
Secondary purposes are tightly drawn. The Privacy Act allows use for a related secondary purpose only if the person would reasonably expect it. An agent that reuses claims data to drive marketing is unlikely to pass.
For how operations teams in insurance apply this day to day, see AI agents for operations leaders in insurance in Australia; the payments compliance view is in AI agents for compliance teams in payments in Australia.
How do you meet the rules?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| CPS 230: critical operations and tolerances | Agents mapped to critical operations; fall-back to people when an agent is withdrawn | Operations map; tested fall-back plans |
| CPS 230: material service providers | Agent platform assessed and contracted as a material provider where it supports a critical operation | Due diligence file; contract; register entry |
| Information security | Agent identity, scoped access and logging included in security controls | Access maps; logs; testing results |
| ASIC: fair, non-misleading conduct | Agent answers about products checked against approved content; conduct tested before release | Test results; approved content library |
| ASIC: design and distribution | Agent cannot recommend or sell outside a product's target market | Scope rules; refused actions |
| Privacy: purpose and notice | Each agent capability tied to a primary or reasonably expected purpose; notice updated | Capability register; notice versions |
| Privacy: data quality and security | Agent reads current records from source; no uncontrolled copies | Architecture records |
| Safety standard: oversight and contestability | Named person can intervene; customers can challenge outcomes | Hold records; challenge log |
What will APRA, ASIC or the OAIC ask?
- Which critical operations depend on agents, and what happens if the agent is switched off?
- Is the agent platform on your material service provider register?
- How do you know what the agent tells customers is accurate and within your product's target market?
- Who is accountable for each agent, and how is the board informed?
- What personal information does each agent use, and for which purpose?
- Have you assessed your agents against the voluntary safety standard, and where do you fall short?
What do these rules not cover?
There is no requirement to register or license an agent. There is no AI-specific ban list of the kind found in the EU AI Act. Reforms to privacy law and proposals for mandatory guardrails for high-risk AI have been debated; check where they stand before relying on the position described here. Australian firms serving customers abroad must also meet those markets' rules; compare how AI agents are regulated in Singapore. For the full requirement-to-control map, see AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Is the voluntary AI safety standard likely to be enforced?
Not as a standard in itself. But supervisors can use it as a benchmark of reasonable practice when assessing whether governance under existing rules is adequate. Adopting it gives you a structure that maps to what APRA and ASIC already ask.
Does CPS 230 apply to a small pilot agent?
It applies to operational risk across the entity. A pilot that does not support a critical operation has lighter implications, but it should still sit inside your risk framework. The moment it supports a critical operation, the full requirements apply.
Can an agent give personal financial advice in Australia?
Personal advice is regulated and must meet licensing and conduct duties. An agent giving it does so on the licensee's behalf, and the licensee carries the obligations. Most firms keep agents to factual information and general guidance, with advice held for a qualified person.