Reference
The AI and regulation glossary.
The Australian regulatory terms that decide how AI can be used at work, explained in plain English. Each entry leads with a short definition, then the detail a practitioner actually needs, with primary sources.
Intelligence, At Your Command.
Concepts and frameworks
The vocabulary of AI at work: techniques, threats, regulators and governance frameworks.
AML/CTF Tranche 2 reforms (Tranche 2)
Tranche 2 extends Australia's anti-money laundering and counter-terrorism financing regime to lawyers, conveyancers, accountants, trust and company service providers, real estate professionals and dealers in precious stones and metals. Parliament passed the amending Bill on 29 November 2024. Those businesses became regulated by AUSTRAC from 1 July 2026, with enrolment open since 31 March 2026.
Read the full definition →AML/CTF regime (AML/CTF)
The AML/CTF regime is Australia's legal framework for stopping money laundering and terrorism financing. Under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, regulated businesses must enrol with AUSTRAC, run an AML/CTF program, verify customers, and report suspicious and high-value transactions.
Read the full definition →APRA CPS 230 (CPS 230)
CPS 230 is APRA's Prudential Standard on Operational Risk Management. Effective 1 July 2025, it requires banks, insurers and superannuation trustees to manage operational risk, maintain critical operations through severe disruptions, and oversee material service providers, including the AI vendors and AI-enabled services they rely on.
Read the full definition →APRA CPS 234 (CPS 234)
CPS 234 is APRA Prudential Standard CPS 234 Information Security. Effective 1 July 2019, it requires APRA-regulated entities such as banks, insurers and super funds to maintain information security capability matched to threats, clearly assign roles, test controls, and notify APRA of material incidents within 72 hours.
Read the full definition →AUSTRAC
AUSTRAC is the Australian Transaction Reports and Analysis Centre. It has a dual role as Australia's anti-money laundering and counter-terrorism financing regulator and as the national financial intelligence unit. It supervises reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, and analyses their reports to support law enforcement and national security investigations.
Read the full definition →Administrative Review Tribunal (ART)
The Administrative Review Tribunal (ART) is the Commonwealth body that conducts independent merits review of Australian Government decisions. It commenced on 14 October 2024 under the Administrative Review Tribunal Act 2024 (Cth), replacing the Administrative Appeals Tribunal. For workers compensation, it reviews Comcare reviewable decisions after reconsideration.
Read the full definition →Agentic AI
Agentic AI describes systems where a language model plans and takes actions through tools, rather than only producing text. NIST defines an agent as software that interacts with its environment, receives information and undertakes self-directed actions towards an externally specified goal. The defining risk is that the model now acts.
Read the full definition →Australian Privacy Principles (APPs)
The Australian Privacy Principles are the 13 principles in Schedule 1 of the Privacy Act 1988 (Cth). They bind APP entities, meaning most Australian Government agencies and organisations turning over more than $3 million, and cover open management, collection, notification, use and disclosure, cross-border transfer, security, access and correction of personal information.
Read the full definition →Automated decision-making (ADM)
Automated decision-making is the use of a computer program to make, or to do something substantially and directly related to making, a decision about a person. From 10 December 2026, Australian Privacy Principle 1.7 requires APP entities to describe such decisions in their privacy policy where the decision could significantly affect an individual's rights or interests.
Read the full definition →Comcare
Comcare is the national work health and safety regulator and workers' compensation authority for the Commonwealth jurisdiction. It is established under the Safety, Rehabilitation and Compensation Act 1988 and also administers the Work Health and Safety Act 2011. The Comcare scheme covers Australian Government employees and corporations licensed to self-insure.
Read the full definition →De-identification
De-identification is the process of treating personal information so an individual is no longer reasonably identifiable. Under the Privacy Act 1988, information is de-identified when the risk of re-identification in the relevant data access environment is very low. Properly de-identified information is not personal information, so the Australian Privacy Principles no longer apply to it.
Read the full definition →Design and Distribution Obligations (DDO)
The Design and Distribution Obligations (DDO) are rules in Part 7.8A of the Corporations Act 2001 (Cth), in force from 5 October 2021 and administered by ASIC. They require issuers and distributors of financial products to make a target market determination, distribute consistently with it, and review it over time.
Read the full definition →EU AI Act
The EU AI Act is Regulation (EU) 2024/1689, the European Union's horizontal law on artificial intelligence. It sorts AI systems by risk, banning some practices outright and imposing obligations on high-risk uses. It binds providers and deployers outside the Union where the system's output is used in the Union.
Read the full definition →Fair Work Act 2009 (FW Act)
The Fair Work Act 2009 (Cth) is the principal statute of Australia's national workplace relations system. It sets the National Employment Standards, underpins modern awards and enterprise agreements, establishes the Fair Work Commission, and provides the unfair dismissal, general protections and right to disconnect frameworks that most Australian employers work within.
Read the full definition →Fair Work Commission (FWC)
The Fair Work Commission is Australia's independent national workplace relations tribunal and registered organisations regulator, established under the Fair Work Act 2009. It resolves disputes including unfair dismissal, bullying and general protections matters, reviews minimum wages, maintains modern awards, approves enterprise agreements, and regulates registered organisations through its General Manager.
Read the full definition →Financial Accountability Regime (FAR)
The Financial Accountability Regime (FAR) is an Australian accountability framework for banking, insurance, and superannuation entities, jointly administered by APRA and ASIC under the Financial Accountability Regime Act 2023. It places personal obligations on named senior executives, called accountable persons, for the parts of the business they run.
Read the full definition →Model Work Health and Safety laws (Model WHS laws)
The model WHS laws are a nationally agreed template developed by Safe Work Australia in 2011. They comprise the model WHS Act, the model WHS Regulations and the model Codes of Practice. They are not law until a jurisdiction enacts them. Every jurisdiction except Victoria has implemented them, and local regulators enforce them.
Read the full definition →NIST AI Risk Management Framework (AI RMF)
The NIST AI Risk Management Framework, published as NIST AI 100-1 in January 2023, is a voluntary framework for managing risks across the AI lifecycle. It is organised around four core functions, Govern, Map, Measure and Manage, and seven characteristics of trustworthy AI. It has no legal force in Australia.
Read the full definition →Office of the Australian Information Commissioner (OAIC)
The Office of the Australian Information Commissioner is Australia's independent regulator for privacy, freedom of information and government information policy. Established by the Australian Information Commissioner Act 2010, it administers the Privacy Act 1988, receives data breach notifications, investigates and handles complaints, reviews decisions, and issues guidance including on AI.
Read the full definition →Privacy Act 1988
The Privacy Act 1988 (Cth) regulates how Australian Government agencies and organisations with annual turnover above $3 million handle personal information. It contains the 13 Australian Privacy Principles, the notifiable data breaches scheme, credit reporting and tax file number rules, and since 10 June 2025 a statutory tort for serious invasions of privacy.
Read the full definition →Prompt injection
Prompt injection is an attack where crafted input alters a language model's behaviour or output in unintended ways. It works because generative models combine the data and instruction channels, so text that arrives as content can be read as a command. OWASP ranks it the top LLM application risk.
Read the full definition →Psychosocial hazards
A psychosocial hazard is anything at work that could cause psychological harm. Safe Work Australia names job demands, low job control, poor support, lack of role clarity, poor organisational change management, inadequate reward and recognition, poor organisational justice, traumatic material, remote work, poor physical environment, violence, bullying, harassment and poor workplace relationships. PCBUs must eliminate or minimise the risks.
Read the full definition →Retrieval-augmented generation (RAG)
Retrieval-augmented generation, or RAG, is a technique that pairs a language model with a separate search over a defined knowledge base. The system retrieves relevant passages for a question and supplies them to the model as context, so answers are grounded in named documents rather than model memory alone.
Read the full definition →Safety, Rehabilitation and Compensation Act 1988 (SRC Act)
The Safety, Rehabilitation and Compensation Act 1988 (SRC Act) is the Commonwealth law that runs Australia's federal workers compensation scheme, administered by Comcare and licensed self-insurers. It sets liability for injury, the reasonable administrative action exclusion, disease provisions, rehabilitation, and compensation for incapacity.
Read the full definition →Voluntary AI Safety Standard (VAISS)
The Voluntary AI Safety Standard is Australian guidance published by the National AI Centre on 5 September 2024. It sets 10 voluntary guardrails covering accountability, risk management, data governance, testing, human oversight, disclosure, contestability, supply chain transparency, record keeping and stakeholder engagement. It creates no new legal duties.
Read the full definition →Legislation, standards and provisions
Verified explainers for the Australian statutes, regulations and prudential standards our articles cite, each linked to the current authoritative text. Educational summaries only, never a substitute for the source.
Corporations Act 2001 (Cth) (Corporations Act)
The Corporations Act 2001 (Cth) is Australia's principal statute governing companies and financial services. For this site's readers, the key parts are the AFS licensee general obligations in section 912A, breach reporting under section 912DAA, whistleblower protections in Part 9.4AAA and the design and distribution obligations in Part 7.8A.
Read the full definition →OHS (Psychological Health) Regulations 2025 (Vic) (Vic Psych Health Regs)
Victoria's Occupational Health and Safety (Psychological Health) Regulations 2025 (S.R. No. 103/2025) commenced on 1 December 2025. They require employers, so far as is reasonably practicable, to identify psychosocial hazards, eliminate or reduce the associated risks through a controls hierarchy in regulation 15, and review control measures against six defined triggers.
Read the full definition →Occupational Health and Safety Act 2004 (Vic) (Vic OHS Act)
The Occupational Health and Safety Act 2004 is Victoria's principal workplace safety statute. Victoria never adopted the model WHS laws, so the Act uses employer and employee duty holders rather than PCBUs. Section 21 sets the core employer duty and section 35 the consultation duty, each qualified by so far as is reasonably practicable.
Read the full definition →Prudential Standard CPS 220 (CPS 220)
CPS 220 is APRA's prudential standard on risk management. It requires banks, insurers, life companies and private health insurers to maintain a Board-approved risk management framework, risk appetite statement and risk management strategy. It commenced on 1 July 2019 and remains in force unamended; superannuation trustees follow SPS 220 instead.
Read the full definition →SRC Act section 14 (s14)
Section 14 of the SRC Act 1988 is the liability provision. Subject to Part II, Comcare is liable to pay compensation for an employee's injury that results in death, incapacity for work, or impairment. Subsections 14(2) and 14(3) exclude intentionally self-inflicted injuries and most injuries caused by serious and wilful misconduct.
Read the full definition →SRC Act section 16 (s16)
Section 16 of the Safety, Rehabilitation and Compensation Act 1988 (Cth) makes Comcare, or a licensee authorised to accept liability, liable to pay compensation for the cost of medical treatment obtained for a compensable injury, where the treatment was reasonable for the employee to obtain in the circumstances, plus qualifying journey and accommodation costs.
Read the full definition →SRC Act section 19 (s19)
Section 19 of the Safety, Rehabilitation and Compensation Act 1988 (Cth) pays incapacitated employees weekly compensation of normal weekly earnings minus the amount they can earn. Once the hours lost exceed 45 times the employee's normal weekly hours, compensation steps down to an adjustment percentage of normal weekly earnings, from 75 to 100 per cent.
Read the full definition →SRC Act section 24 (s24)
Section 24 of the SRC Act 1988 makes Comcare liable to pay compensation where an injury results in permanent impairment. The degree of impairment is determined under the approved Guide and expressed as a percentage. Compensation is generally not payable below a ten per cent threshold, or five per cent for binaural hearing loss.
Read the full definition →SRC Act section 29 (s29)
Section 29 of the SRC Act 1988 compensates household services and attendant care services an employee reasonably requires as a result of a non-catastrophic injury. Each limb carries its own weekly cap and its own list of mandatory considerations. Catastrophic injury is dealt with separately under section 29A.
Read the full definition →SRC Act section 29A (s29A)
Section 29A of the SRC Act 1988 compensates household services and attendant care services an employee reasonably requires as a result of a catastrophic injury. Unlike section 29, it states no weekly maximum and no fifty per cent floor. Whether an injury is catastrophic is settled by legislative rules made under section 122A.
Read the full definition →SRC Act section 36 (s36)
Section 36 of the Safety, Rehabilitation and Compensation Act 1988 (Cth) empowers the rehabilitation authority to arrange, at any time, an assessment of an injured employee's capability of undertaking a rehabilitation program, and obliges it to arrange one on the employee's written request. Refusing an examination without reasonable excuse suspends compensation rights.
Read the full definition →SRC Act section 37 (s37)
Section 37 of the Safety, Rehabilitation and Compensation Act 1988 (Cth) empowers the rehabilitation authority to determine that an injured employee undertake a rehabilitation program, provided itself or through an approved program provider. The determination must have regard to the eight matters in section 37(3), and unexcused refusal suspends compensation rights.
Read the full definition →SRC Act section 4 (s4)
Section 4 of the Safety, Rehabilitation and Compensation Act 1988 (Cth) is the Act's interpretation provision. Subsection 4(1) defines the terms the rest of the Act relies on, including ailment, aggravation, impairment, licensee and suitable employment, and points injury to section 5A, disease to section 5B and employee to section 5.
Read the full definition →SRC Act section 54 (s54)
Section 54 of the Safety, Rehabilitation and Compensation Act 1988 (Cth) governs claims for compensation. Compensation is not payable unless a claim is made under the section, by giving the relevant authority a written claim in the approved form plus, for most claims, a certificate from a legally qualified medical practitioner.
Read the full definition →SRC Act section 57 (s57)
Section 57 of the Safety, Rehabilitation and Compensation Act 1988 (Cth) lets the relevant authority require an employee who has given notice of injury or made a claim to undergo an examination by one nominated medical practitioner. Refusal or obstruction without reasonable excuse suspends compensation rights until the examination occurs.
Read the full definition →SRC Act section 58 (s58)
Section 58 of the Safety, Rehabilitation and Compensation Act 1988 (Cth) lets the relevant authority, once a claim is received, request in writing that the claimant provide information or documents within 28 days of the notice date. If the claimant refuses or fails without reasonable excuse, the authority may refuse to deal with the claim until the material is provided.
Read the full definition →SRC Act section 5A (s5A)
Section 5A of the SRC Act 1988 defines injury for the Commonwealth scheme. Subsection 5A(1) covers a disease, a physical or mental injury, or an aggravation, but its closing words exclude conditions suffered as a result of reasonable administrative action taken in a reasonable manner. Subsection 5A(2) lists non-exhaustive examples of that action.
Read the full definition →SRC Act section 5B (s5B)
Section 5B of the SRC Act 1988 defines disease as an ailment, or an aggravation of an ailment, that was contributed to, to a significant degree, by the employee's employment by the Commonwealth or a licensee. Section 5B(3) sets the threshold, providing that significant degree means a degree that is substantially more than material.
Read the full definition →SRC Act section 60 (s60)
Section 60 of the SRC Act is the interpretation provision for Part VI, which covers reconsideration and review of determinations. Subsection 60(1) defines claimant, determination, determining authority and reviewable decision, and lists the provisions whose decisions count as determinations. A reviewable decision means a decision under subsection 38(4) or section 62.
Read the full definition →SRC Act section 61 (s61)
Section 61 of the SRC Act requires a determining authority to serve written notice of each determination on the claimant as soon as practicable, setting out its terms, reasons, and the right to request reconsideration under subsection 62(2). Subsection 61(1A) requires section 14 claims to be determined within the period prescribed by the regulations.
Read the full definition →SRC Act section 62 (s62)
Section 62 of the SRC Act governs reconsideration of determinations. A determining authority may reconsider on its own motion, and a claimant, the Commonwealth or a Commonwealth authority may request reconsideration within 30 days of the determination coming to their notice. The reconsideration produces a reviewable decision affirming, revoking or varying the determination.
Read the full definition →SRC Act section 64 (s64)
Section 64 of the SRC Act sets out who may apply to the Administrative Review Tribunal for review of a reviewable decision: the claimant, or the Commonwealth, a Commonwealth authority or a licensed corporation the decision affects. The 60 day application window sits in subsection 65(4), not section 64.
Read the full definition →SRC Act section 8 (s8)
Section 8 of the SRC Act 1988 sets how an employee's normal weekly earnings before an injury are calculated. The base formula multiplies average weekly hours by the average hourly ordinary time rate and adds average allowances, with regular overtime added separately. Later subsections keep the figure moving after the injury date.
Read the full definition →WHS Act section 14 (s14)
Section 14 of the Work Health and Safety Act 2011 (Cth) states that a duty cannot be transferred to another person. Outsourcing work, engaging contractors or buying in an AI system never moves a work health and safety duty off the duty holder who owes it under the Act.
Read the full definition →WHS Act section 19 (s19)
Section 19 of the Work Health and Safety Act 2011 (Cth) is the primary duty of care. A person conducting a business or undertaking must ensure, so far as is reasonably practicable, the health and safety of workers and others, with subsection 19(3) listing specific sub-duties including information, training, instruction and supervision.
Read the full definition →WHS Act sections 47 to 49 (ss 47-49)
Sections 47 to 49 of the Work Health and Safety Act 2011 (Cth) govern consultation with workers. Section 47 imposes the duty, qualified by so far as is reasonably practicable; section 48 defines what consultation requires; section 49 lists when consultation is required, including proposed changes that may affect health or safety.
Read the full definition →WHS Regulations regs 37 and 38 (regs 37-38)
Regulation 37 of the Work Health and Safety Regulations 2011 (Cth) requires control measures to remain effective, including being fit for purpose, suitable for the work, and installed, set up and used correctly. Regulation 38 requires review and revision of control measures in defined circumstances, including when a new relevant hazard or risk is identified.
Read the full definition →WHS Regulations regs 55A to 55D (regs 55A-55D)
Regulations 55A to 55D of the Work Health and Safety Regulations 2011 (Cth) govern psychosocial risks. Regulation 55A defines psychosocial hazard, 55B defines psychosocial risk, 55C requires a person conducting a business or undertaking to manage those risks under Part 3.1, and 55D lists the matters for determining control measures.
Read the full definition →Work Health and Safety Regulation 2025 (NSW) (NSW WHS Reg 2025)
The Work Health and Safety Regulation 2025 (SL 2025 No 440) is the NSW remake of the 2017 Regulation, which it repealed on commencement in October 2025. Built on the model WHS Regulations, it carries the psychosocial framework in sections 55A to 55D and is cited internally as sections, not clauses.
Read the full definition →General information and education only. Not legal, compliance, financial, or professional advice. Always confirm obligations against the primary source and current regulator guidance.