Australia's National AI Plan: big ambitions, light on detail
The Government's National AI Plan sets three goals: capture opportunities, spread the benefits, and keep people safe. It's a strong statement of intent, but the Plan gives little on how success will be measured or when milestones will land.
For people in government, IT, and development, that gap matters. Without markers, funding, and deadlines, delivery gets slow and risk grows. Here's what's real, what's missing, and what to do next.
The plan at a glance
- Capturing opportunities: infrastructure, local capability, global partnerships and investment.
- Spreading the benefits: workforce uplift and education so people can use AI well.
- Keeping Australians safe: legal, regulatory, and ethical settings, plus an AI Safety Institute.
All sensible. The problem: no clear KPIs, timeframes, or accountability lines. That uncertainty will push due diligence, legal, and procurement costs onto project teams.
Capturing opportunities: the reality check
Infrastructure depends on electricity, water, and approvals
Data centres are central to AI. They need reliable electricity, cooling, and land that clears planning, environmental, and network hurdles. Australia has momentum in renewables, but approvals, grid constraints, and skilled labour shortages can slow builds.
The Government is developing national data centre principles covering sustainability and approvals. Good start, but it won't remove the hard constraints project owners face today.
- Action for program leads:
- Run electricity and water feasibility early, with realistic timelines and contingencies.
- Bake sustainability metrics (PUE, WUE) into design decisions and vendor SLAs.
- Pre-brief planning and environmental regulators; treat approvals like a critical path workstream.
- Model grid and network upgrades as part of total cost, not an afterthought.
Foreign investment is welcome, with caveats
Foreign capital is essential, but the Foreign Investment Review Board (FIRB), the Hosting Certification Framework (Home Affairs), and potential ACCC merger scrutiny introduce uncertainty. Large AI infrastructure and compute assets will face national security and critical infrastructure checks.
- Action for sponsors and legal teams:
- Map FIRB triggers and national security issues early; consider phased transactions and clean-team protocols. FIRB
- Assess Hosting Certification requirements before you lock in architecture or site selection.
- Plan for extended timelines and staged financing tied to regulatory milestones.
Australia as an Indo-Pacific AI hub
Australia has stability, clear legal protections, and proximity to growth markets. To actually become the region's AI hub, we need common ground with neighbours on safety thresholds, IP in training data, and cross-border data flows.
- Action for cross-border teams:
- Standardise data transfer controls and vendor terms across jurisdictions (classification, residency, access logs, redress).
- Put IP licensing for training data on contract, not assumptions. Create a dataset register with provenance and usage rights.
- Track regional policy signals and align commercial models to the strictest market you serve.
Keeping Australians safe: regulation by evolution
No broad AI Act is coming soon. Instead, the Government will adjust existing laws and publish guidance. Expect changes to the Privacy Act, the Australian Consumer Law, and possibly Online Safety settings. Guidance will keep flowing to steer responsible AI practices.
- What this means for delivery:
- Build compliance into design now. Retrofits later will be pricier and messier.
- Assume safety and transparency requirements will harden over time, not loosen.
Data and IP grey zones
There's ongoing work on how copyright applies to training data in Australia through consultations with the Copyright and Artificial Intelligence Reference Group. Until there's clarity, organisations carry real legal risk around training inputs and generated outputs.
- Action for product and legal:
- Inventory all training sources; record provenance, licences, and restrictions.
- Use opt-in, licensed, or internally generated datasets for high-exposure models.
- Add warranties, indemnities, and audit rights to supplier contracts covering data, models, and fine-tuning.
Privacy reform: plan for retrofit
The Plan calls a clear Privacy Act "foundational" to trust in AI. Tranche one landed in 2024. Tranche two timing is unclear, and it will likely require retrofits across systems and processes. The OAIC has issued guidance under the current regime, but that bar will move.
- Action for privacy and risk:
- Run a gap assessment now against expected Privacy Act directions (default transparency, stronger rights, higher penalties). Attorney-General's Privacy Act Review
- Stand up DPIAs for all material AI use cases; document necessity, proportionality, and human oversight.
- Adopt OAIC guidance as your baseline while you wait for the next tranche. OAIC AI guidance
What to do in the next 90 days
- Governance
- Create an AI register of all pilots and deployments; rate each use case by impact, data sensitivity, and safety risk.
- Define risk tiers and approval gates; require human-in-the-loop for high-risk decisions.
- Legal and procurement
- Update contract templates: data rights, training restrictions, explainability, audit, model drift reporting, and off-ramp clauses.
- Pre-brief FIRB/Home Affairs if you plan new data centres or critical compute.
- Security and privacy
- Implement data classification and filtering before model ingestion; block sensitive fields by default.
- Introduce red-team testing for safety and prompt injection; log and review incidents.
- Infrastructure
- Baseline electricity and water needs; validate grid connection timelines; lock interim capacity with colocation where needed.
- Add sustainability targets (PUE/WUE) to Board reporting.
- People
- Run targeted upskilling for product owners, data teams, and procurement on safe AI delivery and vendor risk. If you need curated options, see AI courses by job.
Metrics to track now
- Infrastructure: PUE, WUE, capacity utilisation, outage minutes.
- Model performance: accuracy for the task, drift, false positive/negative rates by segment.
- Safety: jailbreak success rate, harmful content rate, time to remediate incidents.
- Privacy: cross-border disclosures, DPIAs completed, access requests closed on time.
- Commercial: cost per inference, unit economics by use case, vendor concentration risk.
Watchlist for 2026
- National data centre principles (siting, sustainability, and approvals).
- Privacy Act tranche two and OAIC enforcement priorities.
- AI Safety Institute guidance and test protocols for high-risk systems.
- ACCC merger rules that may affect large AI infrastructure deals.
- Cross-border data arrangements across the Indo-Pacific and how they affect residency and access terms.
Bottom line
The National AI Plan sets the tone, but delivery will hinge on clear rules, approvals that move, and talent that can build safely. Don't wait for perfect guidance. Lock in governance, sort data rights, pressure-test infrastructure, and skill up your teams now. If policy lands in 2026, you'll be ready to move instead of pausing to retrofit.
Your membership also unlocks:
