AI in marketing, what Australia's standards-led approach means for your team
No standalone AI Act. Standards-led, not legislation-led. But the automated decision-making disclosure obligation is binding from December 2026, and the ACL already applies to misleading AI outputs.
Australia has opted for a standards-led approach to AI regulation rather than an EU-style risk-based framework. The National AI Plan, published in December 2025, confirmed the government will rely on existing laws and sector regulators, supported by voluntary guidance and a new AI Safety Institute. No standalone AI Act, and IMO no near-term path to one.
This creates more flexibility for marketing teams than the EU approach, and less regulatory clarity. The gap between “permitted” and “prudent” is wider than in jurisdictions with prescriptive rules, and that is the gap most teams are sitting in without realising it.
The one binding constraint
The Privacy Act’s automated decision-making transparency obligation, commencing 10 December 2026, is the primary legally binding constraint on AI in marketing. Any AI-driven marketing decision that significantly affects individuals has to be documented and disclosed in the organisation’s privacy policy.
This captures more than most marketing teams realise. Programmatic bidding algorithms that determine which ads a person sees. Personalisation engines that change pricing or offers based on inferred characteristics. Lead scoring models that determine which prospects receive follow-up. Dynamic content systems that alter messaging based on behavioural data. All of these are substantially automated decisions that could significantly affect individuals, and most of them currently sit in marketing stacks without an ADM register attached.
The backstop, Australian Consumer Law
Beyond the Privacy Act, the Australian Consumer Law applies to misleading or deceptive AI outputs. AI-generated marketing content that misleads consumers is already actionable. This is existing law applied to a new tool, with the same standard either way: if the output misleads, the organisation is liable, regardless of whether a human or a machine generated it.
Voluntary guidance, the six practices
In October 2025, the government published guidance outlining six practices for responsible AI adoption: establish governance, know your AI systems, manage data responsibly, be transparent, ensure human oversight, and operate reliably.
These are voluntary today and a fairly clear signal of where mandatory requirements will eventually land. Organisations that build governance now will not have to retrofit it under regulatory pressure later (the retrofit cost is always higher).
What to do
Treat the voluntary guidance as a diagnostic and the automated decision-making disclosure as a hard deadline.
Inventory every AI system in the marketing stack. Not just the ones labelled “AI”, but every system that makes or influences decisions about which individuals see which content, at what price, through which channel.
Document how each system works, what data it uses, and what decisions it makes. This documentation is what you will need for the December 2026 disclosure obligation, and it is also useful internal hygiene if you are buying agentic tooling on top of these systems.
Review AI-generated content for misleading or deceptive outputs. The ACL does not require intent. It requires that the output not mislead. The liability sits with the organisation, not the tool, which is a point that some vendors will work hard to obscure.
The regulatory environment is moving toward mandatory requirements on a longer timeline than the EU, with the same direction of travel. Building governance now is cheaper than building it under regulatory pressure later.