Australia

• Australian Government agencies and APP entities, generally organisations above the statutory turnover threshold plus specified classes. It applies to personal information used to train, test, deploy or operate AI where the entity is covered, including identifiable images, audio, inferred information and deepfake material.

APP 3 limits collection to information reasonably necessary for functions or activities and imposes higher conditions for sensitive information APP 5 requires collection notices APP 6 limits use and disclosure APP 10 concerns quality APP 11 requires security and destruction/de-identification APP 12–13 concern access and correction. Biometric information used for automated biometric verification or identification is sensitive information.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Accredited digital-ID providers, relying parties, participating government services and the Australian Government Digital ID System.

Restrictions on collection, use and disclosure of biometric information rules for authorised collection, testing/continuous improvement and destruction accreditation and data/security standards. The standards address biometric presentation-attack detection, biometric matching, eIDVT and authentication. Digital ID use is voluntary for individuals, and an entity cannot require a person to create a Digital ID merely to access a service.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 and associated rules/program requirements. From 2026-07-01, newly regulated legal, accounting, real-estate and jeweller businesses are in scope for the relevant designated services.

Establish individual customers’ identity on reasonable grounds assess ML/TF risk collect and verify KYC information with reliable and independent data identify beneficial owners and politically exposed persons maintain documented AML/CTF procedures conduct ongoing and enhanced due diligence as risk requires. AUSTRAC recognises biometric comparison, video comparison and third-party digital-ID services as possible methods when appropriately risk-based. If there are reasonable grounds to suspect a person is not who they claim to be, the entity must not provide the designated service until satisfied and may have a suspicious-matter reporting obligation.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Reporting business entities, relevant connectable-product suppliers and other covered entities
• National Cyber Security Coordinator and Department of Home Affairs.

Covered entities must report qualifying ransomware or cyber-extortion payments within 72 hours. The broader Act also provides for mandatory security standards for certain internet-connectable products and voluntary major-incident information sharing.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• APP entities developing, training, fine-tuning or using AI, including foreign providers with an Australian link where the Privacy Act applies.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• APP entities using facial recognition, biometric verification, biometric templates or facial identification in commercial, retail or other settings.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Online platforms, AI developers/deployers, users and people affected by serious online abuse
• eSafety Commissioner.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Regulated entities in a designated sector
• the ACCC is the general regulator and digital-platform sector regulator, ASIC regulates the banking sector and ACMA regulates telecommunications. The Act permits sector codes, rules, information sharing, senior governance and external dispute-resolution arrangements.

The statutory principles require reasonable steps to govern, prevent, detect, report, disrupt and respond to scams connected with a regulated service. Sector-specific requirements are set through SPF codes and rules the 2026 Treasury exposure-draft consultation and proposed redress arrangements must not be treated as final law.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• APRA-regulated banks, insurers, superannuation trustees and other regulated entities.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Government, critical infrastructure and industry organisations developing, deploying or procuring AI.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• All Australian organisations across the AI supply chain, especially developers and deployers in legitimate but potentially high-risk settings.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.