Australia's draft AI laws are close: what NZ firms should do now

On 29 October the Australian Financial Review reported that the Albanese government plans to ban new data centres in suburban Australia and release draft AI laws for public consultation this year, according to Capital Brief's summary of the report. Under the reported changes, AI companies could have to disclose the content used to train their models, and data centres could have to use renewable energy or face power cuts. The AFR's information comes from unnamed sources and no draft has been published, so any of those details could shift before a bill appears.

What's been reported so far

Copyright policy appears to have changed shape. Capital Brief says the government will pursue a model where rights holders negotiate directly with AI companies, with protections so smaller creators benefit when their work is used for training. Grafa reports that the government had considered copyright exemptions for tech firms before moving to direct negotiation. Albanese ruled out a text and data mining exception in July and said creatives should be able to set a price for their work, without explaining how they'd do so. The reported model would answer that question.

Energy rules moved in the same week. The Australian Energy Market Commission published two requests on 28 October from energy minister Chris Bowen. They'd require qualifying data centres to back their demand with eligible firming arrangements, and a non-compliant site could be told to cut demand until it has enough cover. PV Tech reports that the requests set no megawatt threshold.

The Prime Minister's department's September paper proposed excluding facilities under 30MW, with baseline rules from 30MW to 100MW. Nobody outside government yet knows how the draft will define "suburban". Greenpeace responded on 30 October by calling for a moratorium on AI data centre developments, arguing the problem can't be shifted to regional Australia.

Why the next five weeks matter

Australia's timetable is tight. A Senate inquiry into AI and data centres is due to report by 16 November, and the Joint Select Committee on AI follows on 30 November. The ABC says the government hopes to introduce legislation by the end of 2026 and pass it in early 2027. The joint committee's early advice, reported in the same ABC story, recommended independent safety checks for AI companies and timely incident reporting by frontier labs.

Incident reporting has been a live political issue since September. OpenAI says its models accessed Australian government websites without authorisation in June, during internal training and evaluation, and that a review identified the activity in mid-August. OpenAI emailed Services Australia on 10 September and the Prime Minister announced the incident on 24 September, according to Responsible AI Australia's timeline. The same page says the delay didn't breach any law.

Most of the reported package targets frontier developers and large data centre operators. Whether organisations that only use AI will carry duties is still open. SafeAI-Aus, in a page reviewed on 19 October, notes that one committee recommendation refers to the development and deployment of AI systems, while the safeguards section is scoped to frontier developers. Readers should look for that wording first when the draft lands.

What it means for NZ businesses

The nearest obligation for NZ firms sits in Australian privacy law, separate from the AI standards. From 10 December, entities bound by the Australian Privacy Principles must state in their privacy policies what personal information their computer programs use, and which kinds of decisions those programs make or substantially support, where a decision could significantly affect someone's rights or interests. Buddle Findlay points out that a NZ organisation can be caught if it carries on business in Australia or holds personal information of people there. NZ's Privacy Act has no equivalent, so complying at home won't cover the Australian duty.

Firms without an Australian presence are exposed through their suppliers. If Australia requires disclosure of training content, any AI vendor selling there will need documentation that NZ buyers can reasonably ask to see. We'd expect procurement teams on both sides of the Tasman to start requesting it.

The OpenAI timeline has a sharper lesson for contracts, because more than three weeks passed between identification and notice. Until a law says otherwise, a NZ customer's protection against a similar delay is the notice period written into its own agreement.

Hosting is the least certain effect. Rules on new large facilities could feed into Australian cloud and colocation pricing over time, but nothing published supports a figure and we wouldn't budget around one. Firms running workloads in Australian regions should simply check how their contracts treat supplier cost increases.

NZ's own settings could move as well. Simpson Grierson's comparison, based on information at 30 October, has National largely keeping the current light-touch model. Labour proposes more central oversight and new copyright rules, while the Greens want rules on training data, high-risk systems and AI-generated content. Labour's September policy also has data centre operators securing their own renewable energy and reducing demand at peak times, which sits close to the Australian proposals. Our judgement is that the Australian draft will become the obvious reference point for NZ policy debate, whichever parties form the next government.

Next steps

These are worth doing before the draft arrives, and the privacy work can't wait for it:

• Get Australian legal advice on whether your organisation is bound by the Australian Privacy Principles, and do it well before 10 December.
• List every AI tool, rules engine and automated platform that influences decisions about customers, staff or applicants, including features embedded in your ERP, HR and CRM systems. Our AI consultancy team can help with that inventory if you don't have the internal capacity.
• Rewrite the relevant privacy policy wording if you're caught. Buddle Findlay warns that generic statements are unlikely to be enough, and you stay responsible when a third party supplies the tool.
• Add fixed incident notification periods to AI vendor contracts at the next renewal, along with a right to see what the vendor discloses to regulators about training data and model behaviour.
• Ask your cloud and colocation providers how they'd pass on any cost increases from Australian energy or data centre rules.
• Name one person to read the Senate and joint committee reports and the draft when they appear. Their first question should be whether the duties reach organisations that only use AI.