A Federal Inquiry Just Asked What Is Stopping You Adopting AI

For most of this year, Australian AI policy has been a series of announcements with no dates on them. That changed in August. There are now three separate processes running, each with a published calendar, and one of them is asking a question aimed squarely at small and medium business.

Update, 28 September 2026. The federal process now has a live example in front of it. On 24 September the Prime Minister disclosed that an OpenAI agent gained unauthorised access to a Services Australia portal in June, referred the incident to the Joint Select Committee on Artificial Intelligence, and said insights from it will inform the government’s AI standards legislation. A review led by his department will also consider law enforcement and legislative responses.

Assistant Minister Andrew Charlton told the ABC the government wants to introduce AI safety standards legislation by the end of this year and pass it in early 2027, and that incident reporting “needs to be timely”. No bill has been published, so treat that timing as an intention rather than a date.

On 29 September the ABC reported, citing an unnamed source, that the government wants the legislation to require AI incidents to be notified to ASD as well as the affected organisation; what that would mean for your incident process. The direction is clear enough to act on now: an incident process that can recognise an AI-related event and report it quickly to the right party is what ISO/IEC 42001 already asks you to evidence.

Update, 9 October 2026. The government has now said what kind of regulation it has in mind. In a speech on 8 October, Assistant Minister Andrew Charlton said frontier AI will be regulated through a systems-based approach, the model already used for work health and safety, critical infrastructure security, prudential supervision of banks and parts of aviation. Companies would have to run “a rigorous process for finding, testing, reporting on and managing the risks of their systems”, and would be held accountable for whether that process works.

The question, he said, is not only whether something went wrong, but whether “there is a serious system in place to detect risks and prevent incidents occurring”. Voluntary codes were ruled out for the most serious frontier risks, and detailed prescriptive rules were rejected as too slow for the pace of the technology. The speech is aimed at the developers of frontier models, not businesses that use AI, and it gives no dates. The ABC reported that the national AI standards are due by the end of this year, with the rules to be legislated in 2027.

That test will sound familiar to anyone who has been through a certification audit. It is the question a management system audit asks: not whether a policy exists, but whether the process runs and catches what it should. Nothing in the speech puts a new duty on a business that only uses AI. Obligations placed on developers do tend to flow down through contracts and supplier questionnaires, though, and the evidence an ISO/IEC 42001 auditor asks for is the same evidence a “serious system” test would look for: risk assessment (6.1), operational controls (clause 8), monitoring (9.1), internal audit (9.2) and corrective action (clause 10).

The dates that now exist

What the federal inquiry is asking

The Joint Select Committee on Artificial Intelligence was appointed on 20 August 2026 by resolution of both the House of Representatives and the Senate. It has fourteen terms of reference.

Most of the coverage led on deepfakes, national security and consumer protection. That is not what the terms of reference lead on. Read in order, the inquiry opens on opportunity: lifting Australia’s resilience, productivity growth, economic competitiveness and living standards; spreading the benefits across the suburbs and regions; driving research, new industries and exports in agriculture, resources, health and medical research, advanced manufacturing, financial services and defence industry; building sovereign AI capability; and the potential of narrow, domain-specific models trained on Australian data.

Risk appears, and it is serious. Fraud and scams, deepfakes, and the safety of children and vulnerable Australians sit at item (k). National security, foreign interference, and the resilience of supply chains and critical infrastructure sit at (l). Item (m) names the Australian AI Safety Institute and asks whether regulators and the security community can identify and respond to emerging risks.

But the balance matters if you are deciding whether to engage. This is predominantly an adoption and competitiveness inquiry with a risk annexe, not a crackdown. Going in expecting to defend yourself would be reading it wrong.

One term of reference names your business

Item (d) asks the committee to inquire into and report on:

the rate and extent of AI adoption across the Australian economy, and the barriers to adoption, faced by small and medium businesses and family businesses

That was an open invitation, and the formal submission period closed on 14 September 2026. The question still matters: if cost, skills, uncertainty about liability, insurance, client contracts or plain confusion about what is permitted has slowed you down, that is exactly what the committee will report on to Parliament by 30 November.

Item (i) runs alongside it, asking about the adequacy of Australia’s existing laws and regulatory frameworks as they apply to AI and whether there are any gaps that warrant reform. Those two together are the whole argument: what is stopping you, and is the law part of the reason.

Submissions do not need to be long or written by a lawyer. A short, specific account of what your business tried, what stopped it and what would have helped is more useful to a committee than a polished document saying nothing.

The South Australian royal commission

Separately, on 10 August 2026 South Australia announced Australia’s first royal commission into artificial intelligence. It commenced on 1 October 2026, chaired by former Federal Court judge Dr Iain Ross AO with Kate Pounder and Dr Christopher Manning as commissioners, and must report no later than 1 July 2027. Its terms of reference are published on the Royal Commission’s website.

It is expected to hear evidence and receive submissions from a broad cross-section of the community, including business, industry bodies, unions, technology developers, academics and creative industries. The terms of reference cover AI’s role in productivity, innovation and competitiveness, the balance between social benefits and risks, policy and regulatory settings, jobs and the labour market, education, using AI to simplify regulation for business, and public services including health. Data centres are expressly out of scope, as are national security, cybersecurity, financial stability, critical infrastructure and intellectual property, which are left to the Commonwealth.

A royal commission is a heavier instrument than a parliamentary committee, and it runs longer. If you operate in South Australia, that is a second forum and a second timetable.

What to do while the law does not exist yet

Here is the part that gets misread in both directions. Some businesses will freeze until there is a statute to comply with. Others will decide nothing has changed. Both are wrong, for the same reason.

You cannot build a compliance response to a law that has not been drafted. You can build the management system that any version of it will land on.

All three processes are circling the same underlying questions, and they are the questions an auditor already asks:

• What AI is in use across the business, including the tools nobody formally approved?
• Who owns each one, and who decided it was acceptable?
• What decisions does it make, or influence, about people?
• What happens when it is wrong, and who notices?
• How would you evidence any of the above to somebody who asked, without a month’s notice?

Be clear about why those questions are worth answering, because it is not that a regulator is coming. On what has been agreed so far, none of these three processes has created a new duty that applies to a business simply because it uses AI, and the December 2025 National AI Plan decided not to proceed with mandatory guardrails for high-risk AI at this time. That is narrower than it sounds: privacy, consumer, anti-discrimination, copyright and work health and safety law all continue to apply to what your AI does, and a new statutory duty is one recommendation away.

The questions are worth answering because your customers, insurers, investors and tender panels are already asking them. ISO 42001 remains the only certifiable AI management system standard on the shelf, which is why an inventory and a governance structure is a no-regrets move whatever the three processes recommend, and it would still be worth doing if all three reported tomorrow that nothing needs to change. If you already hold ISO 27001, most of the management system backbone is already built, which is how the two fit together.

What an auditor would ask for now

If I were assessing your AI governance tomorrow, well before any of this is law, this is the thread I would pull. It works as a self-test.

1. The inventory. Every AI tool in use, including the ones people signed up for on a corporate card. Most businesses have no list at all, which is the shadow AI problem.
2. The owner. A named person per tool, not a department.
3. The decision record. Who assessed it, against what, and when.
4. The data question. What goes into it, whether that includes personal information, and what the vendor does with it.
5. The failure case. One real example of the tool being wrong, and what happened next.
6. The review. Whether any of this reached management review, and whether anything changed.

Points 1 and 5 are where nearly everyone stops. A policy that says AI use must be approved, with no list of what was approved and no instance of anything being rejected, is a document rather than a control.

AI regulation in Australia: frequently asked questions

Is AI regulated in Australia yet?

There is no single AI Act, and no obligation is triggered simply because you use an AI tool. That does not make AI use unregulated: privacy, consumer, anti-discrimination, work health and safety, copyright and sector regulation already apply according to what you are doing. The federal inquiry is examining whether those frameworks are adequate. On the Commonwealth legislation expected early in 2027, be careful with the reporting.

National Cabinet agreed on 26 August 2026 to a nationally consistent framework setting minimum requirements for large data centres, covering energy, water and land use. The communique also says the legislation will include conditions associated with delivering AI training, and those conditions have not been defined, so it may reach organisations that train or develop AI. On what has been published, it does not impose AI governance obligations on a business that uses AI.

Should we wait for the law before doing anything?

There is no law to wait for, and that is the point rather than a reason to relax. Nobody can tell you what the inquiry will recommend in November, so do not build an AI inventory because a regulator is coming. Build it because customers, insurers, investors and tender panels are already asking how you govern AI, because those questions cannot be answered retrospectively, and because if obligations do arrive you will be starting from a list rather than from nothing.

Can a small business make a submission?

Yes, and item (d) of the terms of reference specifically asks about barriers faced by small, medium and family businesses. The formal submission period closed on 14 September 2026, and the committee reports by 30 November 2026. If you have evidence you think it should hear, the committee page on aph.gov.au lists the secretariat’s contact details.

Does ISO 42001 certification make us compliant?

No standard makes you compliant with a law, and nobody should sell it that way. What ISO 42001 gives you is the governance structure and the evidence trail that a customer, an insurer or a future regulatory regime would ask you to produce: an inventory, assigned ownership, risk assessment, controls and a record of them operating.

What does ISO 42001 cost and how long does it take?

In our experience, three to six months for most small to medium Australian businesses. Cost varies more than the older standards because the practice is newer, and it drops substantially if you already hold ISO 27001. See our ISO 42001 certification cost guide for current ranges.

Where Streamline fits

Streamline is run by a practising ISO Lead Auditor, so you get the view from the other side of the audit table rather than a forecast of what the law might say.

Most organisations we speak to about AI have a capable person who has been told to get across AI governance and does not know where to start. That is what ISO mentoring is for: we coach your own people through building the ISO 42001 management system, the knowledge stays with you, and the cost stays down. We also run independent gap analysis audits if you want to know where you stand first, and provide the independent internal audit required under clause 9.2.

Start with the inventory. If you cannot produce a list of the AI tools in use across your business this week, that is the finding, and it is worth a conversation.

Sources

• Parliament of Australia, Joint Select Committee on Artificial Intelligence committee page, including the resolution of appointment of 20 August 2026, the terms of reference, the submissions closing date of 14 September 2026 and the reporting date of 30 November 2026.
• Royal Commission into Artificial Intelligence (South Australia) website, for the 1 October 2026 commencement, the commissioners, the published terms of reference including the data centre exclusion, and the reporting date of no later than 1 July 2027. Announcement by the South Australian Department of the Premier and Cabinet, 10 and 11 August 2026.
• Prime Minister of Australia, “AI in Australia’s interests”, 15 July 2026, foreshadowing national standards for large data centres covering power supply, grid connection costs, demand reduction, water efficiency and siting, and establishing the Office of AI within the Department of the Prime Minister and Cabinet.
• National Cabinet communique, 26 August 2026, agreeing a nationally consistent framework of minimum requirements for large data centres covering energy, water and land use, with Commonwealth legislation intended in early 2027 “including conditions associated with delivering AI training”.
• National AI Plan, December 2025, and the mandatory guardrails consultation, for the decision not to proceed at this time with mandatory guardrails for high-risk AI and to rely on existing law.
• ISO/IEC 42001, artificial intelligence management systems.
• The Hon Dr Andrew Charlton MP, Speech at the Sydney Trust and Safety Festival, 8 October 2026.
• ABC News, Australia outlines plans to make AI companies prove their safety systems work, Clare Armstrong, 8 October 2026.

Dates in this article were confirmed against the Parliament of Australia committee page and the National Cabinet communique of 26 August 2026 and the Royal Commission’s website, and are current as at 9 October 2026. Timetables move, so check the primary source before relying on a date. This article is general information from an auditing and management system perspective and is not legal advice.