Glossary terms

Not by themselves. A model Code of Practice must be approved as a code of practice in a jurisdiction before it has legal effect there. Approved codes are not law, but they are admissible in court proceedings, and courts may rely on them to determine what is reasonably practicable. From What are the model WHS laws?

No. Section 13 indexes the amounts in subsections 29(1) and 29(3) to the Consumer Price Index and lists both expressly as relevant amounts. The figures printed in the Act are base amounts, so take the current weekly caps from Comcare rather than from the face of the legislation. From What is section 29 of the SRC Act?

No. The model WHS laws are a template. They only become legally binding when the Commonwealth, a state or a territory enacts them as its own legislation. Safe Work Australia maintains the model laws but does not regulate or enforce them. Enforcement sits with the WHS regulator in each jurisdiction. From What are the model WHS laws?

The question does not arise, because section 29A states no amounts. Section 13 indexes a closed list of relevant amounts to the Consumer Price Index, and that list names subsections 29(1) and 29(3) but not section 29A. Take any current figure for the non-catastrophic branch from Comcare rather than from the face of the legislation. From What is section 29A of the SRC Act?

FAR does not name AI, but accountability follows the area of responsibility. If an AI system sits within an accountable person's remit and produces harm through poor governance, that can be treated as a failure to act with care, skill, and diligence. Ownership and oversight of AI systems should therefore be clearly mapped. From What is Financial Accountability Regime?

No. The Fair Work Ombudsman states that other workplace instruments cannot provide for conditions less than the National Employment Standards, including an award, an employment contract, an enterprise agreement or another registered agreement. Those instruments also cannot exclude the NES. The NES applies regardless of what instrument covers the employee. From What is the Fair Work Act 2009?

Only with verification. AI tools can fabricate case names, party names, and tribunal references, or misstate the outcome of a real case. Always confirm each citation against the published decision on AustLII or the Tribunal record before relying on it, and de-identify any claim material before entering it into an AI tool. From What is Administrative Review Tribunal?

AI can assist with summarising evidence, drafting plain-English explanations, and structuring analysis against the statutory tests. It cannot make the determination. An authorised delegate must decide, a human must review every AI-assisted draft, and claimant data must be de-identified before it enters any general AI tool. From What is Safety, Rehabilitation and Compensation Act 1988?

Probably not. OWASP says prompt injection is possible due to the nature of generative AI, and that given the stochastic influence at the heart of the way models work, it is unclear if there are fool-proof methods of prevention. The realistic goal is impact reduction through least privilege, human approval for high-risk actions, output validation, segregation of external content and adversarial testing. From What is prompt injection?

Yes. Safe Work Australia warns that psychosocial hazards may interact or combine to create new, changed or higher risks. Some hazards may not create risk on their own but may do so when combined with others, and some may only create risk on their own when severe. Assessing hazards one at a time therefore understates the real exposure workers face. From What are psychosocial hazards?

No. The SRC Act uses a three-tier process: determination, then reconsideration producing a reviewable decision, then ART review. Under section 64 of the SRC Act, the ART can only review reviewable decisions. A first-tier determination must go through internal reconsideration before the Tribunal has jurisdiction to review it. From What is Administrative Review Tribunal?

No. Section 64 permits applications for review of a reviewable decision, which section 60 defines as a decision under subsection 38(4) or section 62. An original determination must first go through reconsideration under section 62, and it is the resulting decision that the Tribunal reviews. From What is section 64 of the SRC Act?

No. Paragraph 62(1)(b) and subsection 62(4) both require any delegated reconsideration to be carried out by a person other than the person who made, or was involved in the making of, the determination. Subsection 62(2A) also preserves licence conditions requiring reconsideration by another person. From What is section 62 of the SRC Act?

No. CPS 230 Operational Risk Management sits inside the CPS 220 architecture. The current CPS 230 determination, which commenced on 1 July 2026, states that operational risk requirements form part of the risk management framework required under CPS 220 and SPS 220, and requires CPS 220 framework reviews to cover operational risk management. From What is APRA Prudential Standard CPS 220?

No Australian instrument names agentic AI. The Guidance for AI Adoption, published 21 October 2025, sets six essential practices including maintaining human control, and it is voluntary. Existing duties still apply, so an agent acting inside a regulated process inherits that process and its obligations. From What is agentic AI?

Sections. The 2025 remake refers to its own provisions as sections throughout, for example the section 55C note pointing to section 55D. Citing clause numbers, or citing the repealed 2017 Regulation, marks a reference as out of date. From What is the WHS Regulation 2025 (NSW)?

They can. The Australian Work Health and Safety Strategy 2023 to 2033 warns that while automation may reduce physical risk, workers overseeing that technology could face more psychosocial hazards from increased or more complex interpersonal interactions. AI changes job demands, job control and role clarity, all named hazards. From What are psychosocial hazards?

Generally the APPs bind organisations with an annual turnover above $3 million. Smaller operators are still caught where an exception applies, including private sector health service providers, credit reporting bodies, businesses that buy or sell personal information, Commonwealth contracted service providers, and businesses that have opted in. From What are the Australian Privacy Principles?

They do not mention AI, but the duties are technology neutral and apply to it. The Australian Work Health and Safety Strategy 2023 to 2033 names the rise of AI and automation as an emerging challenge, warning that new technology needs appropriate design and oversight so workers face no new WHS risks. From What are the model WHS laws?

No. The Regulations as made contain no written prevention plan or periodic reporting obligation. The operative duties are identification of psychosocial hazards (regulation 14), control of risk (regulation 15) and review of control measures (regulation 16). Do not read obligations into the instrument that are not there. From What are the Victorian Psychological Health Regulations?

Yes. The note to regulation 55C ties the duty to section 19 of the Act via regulation 9, so managing psychosocial risks is an exercise of the primary duty of care, carried out through the risk management process in Part 3.1 of the Regulations. From What are regulations 55A to 55D of the WHS Regulations?

Not automatically. APP 1.7 reaches a computer program that does a thing substantially and directly related to making a decision, not only one that decides. The OAIC's issues paper puts exactly this to consultation, using an example where staff rely on a chatbot's eligibility recommendation before deciding. From What is automated decision-making?

Yes. APP 1.9 states that making a decision includes refusing or failing to make a decision, and that doing a thing includes refusing or failing to do a thing. A system that automatically rejects, defers or silently drops an application is therefore within scope. From What is automated decision-making?

Regulation 38(3) says a change at the workplace includes a change to the workplace itself or any aspect of the work environment, or a change to a system of work, a process or a procedure. Deploying or materially updating an AI tool that reshapes how work is done fits that description. From What are regulations 37 and 38 of the WHS Regulations?

APP 8 sets out the steps an APP entity must take before personal information is disclosed overseas. Where an AI tool is hosted outside Australia and staff enter personal information into it, that is a cross-border disclosure, so the APP 8 accountability and reasonable steps obligations need to be worked through first. From What are the Australian Privacy Principles?

AUSTRAC's AI transparency statement says it has not yet deployed AI that directly interacts with the public or is involved in decision making and administrative action without human intervention. It is trialling enterprise generative AI, and applies controls so no sensitive or classified information enters public generative AI systems. From What is AUSTRAC?

No. Comcare's AI Transparency Statement says it does not at present use AI for any of its core functions, and that AI is not used in compliance, auditing or decision-making processes without human oversight. Staff are not permitted to input sensitive employee or customer information into AI technologies. From What is Comcare?

No. Footnote 1 of the standard states that an RSE licensee is not treated as an APRA-regulated institution for CPS 220 purposes, and points to Prudential Standard SPS 220 Risk Management for the risk management requirements that apply to registrable superannuation entity licensees. From What is APRA Prudential Standard CPS 220?

CPS 230 does not mention AI, but AI vendors and AI-enabled services fall within its service provider obligations. Where an AI tool supports a critical operation, the arrangement can be a material service provider arrangement, requiring a formal agreement, service levels, monitoring and oversight of fourth-party dependencies. From What is APRA CPS 230?

Yes, where an AI tool or vendor processes, stores or transmits regulated information assets it falls inside the information security framework CPS 234 governs. Third-party AI services attract the same assurance expectations as any other outsourced information asset, and AI failures can be material incidents. From What is APRA CPS 234?

Yes. AI used to target, score, or personalise offers is part of distribution, so it must stay consistent with the target market determination. An automated model that reaches consumers outside the target market does not escape DDO. The reasonable steps obligation applies regardless of automation. From What is Design and Distribution Obligations?

No. The OAIC notes information can be at risk of re-identification even when de-identified or anonymised, and that once data enters a generative AI system it is very difficult to control and potentially impossible to remove. Best practice is to keep personal and sensitive information out of public tools. From What is de-identification?

No. FAR sits alongside existing duties, including directors' duties under the Corporations Act and licensing obligations. It adds a specific personal accountability layer for senior executives in regulated financial entities. Practitioners should treat it as additional to, not a substitute for, their other regulatory obligations. From What is Financial Accountability Regime?

No, and this is the most common error. Subsections 8(6) and 8(7) increase the figure for increments and promotion, subsections 8(9) and 8(9A) move it with the minimum payable to the employee's class, and subsections 8(9B) to 8(9G) apply annual indexation from 1 July, including after the employee ceases that employment. From What is section 8 of the SRC Act?

No. RAG reduces fabrication by grounding answers in retrieved passages, and the 2020 paper reported more factual language than a parametric-only baseline. The model can still misread a passage, blend sources, or answer confidently when retrieval returns nothing useful. Citations make errors easier to catch, not impossible. From What is retrieval-augmented generation (RAG)?

Not on its own. The OAIC warns that removing name, address or other direct identifiers alone may not result in de-identification for the purposes of the Privacy Act. A second step is needed, either altering other identifying information or applying controls and safeguards in the data access environment. From What is de-identification?

It can. NIST identifies RAG systems and internet-connected agents as the classic settings for indirect prompt injection, because the model pulls in outside resources an attacker may control. A poisoned document in a knowledge base becomes an instruction the model may follow at retrieval time. From What is prompt injection?

No. This is a common practitioner confusion. Section 14 deals only with liability to pay compensation. The reasonable administrative action carve-out sits in the closing words of subsection 5A(1), with subsection 5A(2) providing non-exhaustive examples of reasonable administrative action. From What is section 14 of the SRC Act?

No. It does not prohibit outsourcing, contracting or procurement. It means the legal duty stays with the duty holder regardless of those arrangements. A person conducting a business or undertaking that outsources a function keeps its own duties, and the contractor acquires duties of its own under section 16. From What is section 14 of the WHS Act?

Yes, with limits. Section 16(6) compensates necessary journeys and associated stays, but section 16(7) requires the journey (including the return leg) to exceed 50 kilometres, unless the injury reasonably required public transport or ambulance services regardless of distance. From What is section 16 of the SRC Act?

No. Section 29 is expressly confined to services obtained as a result of an injury other than a catastrophic injury. Both subsection 29(1) and subsection 29(3) carry that limitation on their face. Services obtained as a result of a catastrophic injury are dealt with separately under section 29A, which is a different provision with different mechanics. From What is section 29 of the SRC Act?

No. The phrase "accurately and quickly" sits in paragraph 69(a), which lists Comcare's functions, including making determinations accurately and quickly in relation to claims and requests. Section 61 deals with notifying determinations in writing, not with the general standard for making them. From What is section 61 of the SRC Act?

Subsection 61(1A) requires the determining authority to consider and determine each claim for compensation under section 14 within the period prescribed by the regulations. The notice itself must then be served as soon as practicable after the determination is made. From What is section 61 of the SRC Act?

No, and this is the most common error. Subsection 29(5) removes liability only for compensation under subsection 29(1), the household services limb, for any week within the 28 days beginning on the date of the injury. Attendant care under subsection 29(3) is not caught. The exclusion can also be lifted by Comcare on the ground of financial hardship or the need to provide for adequate supervision of dependent children. From What is section 29 of the SRC Act?

No. Subsection 29(5) removes liability only for compensation under subsection 29(1), the household services limb of the non-catastrophic provision. Section 29A carries no equivalent exclusion, so the 28-day rule has no work to do once the injury meets the catastrophic threshold. From What is section 29A of the SRC Act?

The ART conducts merits review, which means it stands in the shoes of the original decision maker and decides the correct or preferable decision on the material before it. This is broader than judicial review, which examines only whether the decision was lawful. The ART can affirm, vary, set aside, or remit the decision. From What is Administrative Review Tribunal?

It can. Article 2 extends the regulation to providers and deployers established in a third country where the output produced by the AI system is used in the Union, and to anyone placing an AI system on the Union market. Australian establishment alone does not put an organisation outside it. From What is the EU AI Act?

The Act does not name AI. It bites indirectly, through unfair dismissal tests that ask whether a dismissal was harsh, unjust or unreasonable, through general protections, through award consultation obligations on major change, and through the right to disconnect where AI-enabled tooling extends contact beyond working hours. From What is the Fair Work Act 2009?

The President published an exposure draft Guidance Note on the use of generative AI in Commission cases in March 2026, with comments due by 10 April 2026. The draft would require a party who used generative AI to prepare a document to tell the Commission and to check that all details are correct and relevant. From What is the Fair Work Commission?

Yes, indirectly. Australia's Voluntary AI Safety Standard, published on 5 September 2024, states it draws on and is aligned with AS ISO/IEC 42001:2023 and NIST AI RMF 1.0, with each guardrail requirement aligned to relevant international and local standards. The department has since published Guidance for AI Adoption, on 21 October 2025, which it describes as evolving that standard. Australian legal obligations still come from Australian law. From What is the NIST AI Risk Management Framework?

No. The statutory tort for serious invasions of privacy commenced on 10 June 2025 and sits in Schedule 2 of the Privacy Act, but the OAIC states it does not have a direct role in administering the tort. Individuals pursuing it are directed to seek independent legal advice. From What is the Office of the Australian Information Commissioner?

Yes. The OAIC states the Privacy Act applies to all uses of AI involving personal information, covering both what an organisation puts into an AI system and what the system generates. Inferred or hallucinated information about an identifiable person is still personal information and must be handled under the Australian Privacy Principles. From What is the Privacy Act 1988?

In some situations the Act does not cover an organisation's handling of employee records connected to a current or former employment relationship. The exemption is narrow and does not remove other obligations, so employers running AI over workforce data need to confirm whether the exemption applies before relying on it. From What is the Privacy Act 1988?

Yes. The guardrails are aligned with AS ISO/IEC 42001:2023, the leading international standard on AI management systems, and with the United States NIST AI Risk Management Framework 1.0. The National AI Centre says this supports organisations operating internationally by aligning Australian practice with other jurisdictions and their expectations. From What is the Voluntary AI Safety Standard?

No. The obligation to apply appropriate risk-based controls remains with the reporting entity, not the tool. If you use AI for monitoring or customer due diligence, you must be able to explain its outputs, govern the model, keep records of escalation decisions, and maintain human oversight so the system supports rather than replaces your compliance program. From What is AML/CTF regime?

Yes. CVE-2025-32711, published 11 June 2025, records an AI command injection flaw in Microsoft 365 Copilot allowing an unauthorised attacker to disclose information over a network. It is classified CWE-74 and scored 9.3 critical by Microsoft and 7.5 high by NIST in the national vulnerability database. From What is prompt injection?

Yes. The OAIC has published guidance on privacy and the use of commercially available AI products, and separate guidance on privacy and developing and training generative AI models. Its stated position is that the Privacy Act applies to all uses of AI involving personal information, covering both inputs and generated outputs. From What is the Office of the Australian Information Commissioner?

It has been evolved rather than withdrawn. On 21 October 2025 the government published Guidance for AI Adoption, which condenses the 10 guardrails into 6 essential practices and extends the audience to developers as well as deployers. The standard pages remain live and carry a banner pointing to the newer guidance. From What is the Voluntary AI Safety Standard?

No. Victoria retains its own Occupational Health and Safety Act 2004 rather than enacting the model WHS Act adopted elsewhere in Australia. Duty holders are employers and employees rather than PCBUs and workers, and the operative employer duty is section 21, not the model Act's section 19. From What is the Occupational Health and Safety Act 2004 (Vic)?

First seek reconsideration of the determination through the original decision-maker. If you still disagree, apply to the Administrative Review Tribunal, which reviews Commonwealth workers compensation decisions on the merits. The ART replaced the Administrative Appeals Tribunal in October 2024. Check current timeframes on the ART website before lodging. From What is Safety, Rehabilitation and Compensation Act 1988?

CPS 230 requires business continuity plans that keep critical operations within defined tolerance levels through severe but plausible disruptions, tested regularly. If a critical operation depends on an AI model or vendor, the entity should define tolerances for that dependency and confirm a workable fallback if the AI fails. From What is APRA CPS 230?

Under section 912DAA(3), the report must be lodged with ASIC within 30 days after the licensee first knows that, or is reckless with respect to whether, there are reasonable grounds to believe a reportable situation has arisen. The clock starts on knowledge or recklessness, not on internal confirmation. From What is the Corporations Act 2001?

A chatbot returns text for a person to act on. An agent takes the action itself, calling tools, writing files, sending messages or moving money, often across many turns. That shifts the control question from whether the output is accurate to whether the action was authorised. From What is agentic AI?

They compensate the same two services but sit either side of one threshold. Section 29 applies to an injury other than a catastrophic injury, and bounds household services at not less than fifty per cent of the amount paid and not more than a stated maximum. Section 29A applies to a catastrophic injury and states no amount at all, leaving the weekly figure to what Comcare considers reasonable in the circumstances. From What is section 29A of the SRC Act?

Section 36 is the assessment step: a qualified person or panel assesses capability and gives a written assessment under section 36(8). Section 37 is the separate program step, where the rehabilitation authority determines that a program be undertaken, having regard to that assessment. From What is section 36 of the SRC Act?

They are separate bodies. The Commission is the tribunal that hears and decides matters, sets minimum wages, maintains awards and approves enterprise agreements. The Fair Work Ombudsman provides information about workplace rights and obligations and enforces compliance with those laws. The Ombudsman does not investigate unfair dismissal claims. From What is the Fair Work Commission?

Subsection 29(1) leaves the amount to what Comcare considers reasonable in the circumstances, but bounded at both ends. It must be not less than fifty per cent of the amount per week paid or payable by the employee for those services, and not more than the weekly maximum stated in the subsection. From What is section 29 of the SRC Act?

During maximum rate compensation weeks, section 19(2) pays normal weekly earnings (NWE) minus AE, where AE is the greater of what the employee is able to earn in suitable employment and what they actually earn from any employment that week. From What is section 19 of the SRC Act?

You generally have 60 days from receiving the reviewable decision, which is the decision made after reconsideration under the SRC Act. The Tribunal can grant extensions in limited circumstances, but you should treat the 60-day period as firm and lodge early rather than relying on an extension being granted. From What is Administrative Review Tribunal?

The claimant has 28 days after the date of the notice, or a further period the relevant authority allows on the claimant's request. Under section 58(2), giving the specified information or document copy within that window is taken to be compliance with the notice. From What is section 58 of the SRC Act?

An employee must apply to the Fair Work Commission within 21 days of the dismissal. Eligibility also requires at least 6 months of service with that employer, or 12 months where the employer is a small business employer with fewer than 15 employees. The Commission decides the case. From What is the Fair Work Act 2009?

There are 13 Australian Privacy Principles, set out in Schedule 1 of the Privacy Act 1988. They run from open and transparent management of personal information at APP 1 through to correction of personal information at APP 13, covering collection, notification, use, disclosure, cross-border transfer, quality, security and access. From What are the Australian Privacy Principles?

AUSTRAC stated in March 2026 that from 1 July the number of businesses it regulates would grow from around 19,000 to close to 100,000 nationwide. AUSTRAC described the reforms as the most significant overhaul of Australia's AML/CTF framework in more than 20 years. From What are the AML/CTF Tranche 2 reforms?

You must notify APRA within 72 hours of becoming aware of a material information security incident, including any incident already notified to another regulator. Separately, material control weaknesses you cannot remediate in a timely way must be notified within 10 business days. From What is APRA CPS 234?

No. Section 53 requires written notice of an injury to the relevant authority as soon as practicable, and the Act does not apply to the injury unless notice is given. Section 54 is the separate written claim for compensation. Notice preserves the Act's application; the claim founds the entitlement. From What is section 54 of the SRC Act?

AUSTRAC is a regulator and a financial intelligence unit rather than a police force. It collects and analyses financial reports and other data to create targeted, actionable intelligence that supports law enforcement and national security investigations. Its intelligence functions form part of the national intelligence community. From What is AUSTRAC?

No. Subsection 24(7) withholds compensation where the degree of permanent impairment is less than ten per cent, but subsection 24(8) disapplies that threshold for the loss, or loss of the use, of a finger or a toe, and for the loss of the sense of taste or smell. Binaural hearing loss has its own five per cent test in subsection 24(7A). From What is section 24 of the SRC Act?

No. CPS 234 covers information security and took effect in 2019. CPS 230 covers operational risk management, including service provider management and business continuity, and took effect on 1 July 2025. They are complementary, so AI security and AI operational resilience should be managed together. From What is APRA CPS 234?

Not necessarily. The OAIC notes several terms are used in Australia for similar processes, including anonymisation and confidentialisation, and advises checking that all parties understand the terminology consistently. The Privacy Act test is whether an individual remains reasonably identifiable, not which label the parties use. From What is de-identification?

No, provided the de-identification is robust. The OAIC's position is that information which has undergone an appropriate and robust de-identification process is not personal information and is not subject to the Privacy Act. The same data can be personal in one release context and de-identified in another. From What is de-identification?

They overlap but are not identical. NIST defines a jailbreak as a direct prompting attack intended to circumvent restrictions placed on model outputs, such as circumventing refusal behaviour. Prompt injection is the broader mechanism of exploiting untrusted input concatenated onto higher-trust instructions, and indirect injection usually aims at data theft or unauthorised action rather than rude answers. From What is prompt injection?

It depends on the controls around the index, not on RAG itself. Retrieval can surface any document the permissions allow, so access control must be enforced at retrieval time. NIST also identifies RAG knowledge bases as a route for indirect prompt injection, where poisoned documents carry hidden instructions. From What is retrieval-augmented generation (RAG)?

No. Claims for compensation are made under section 54, which requires a written claim in the approved form. Section 58 operates only after the relevant authority has received a claim, and lets the authority request information or documents that are relevant to that claim from the claimant. From What is section 58 of the SRC Act?

No. Subsection 5A(2) states that, without limiting subsection 5A(1), reasonable administrative action is taken to include listed examples such as a reasonable appraisal of performance, reasonable counselling, suspension or disciplinary action, and anything reasonable done in connection with those actions. It is a non-exhaustive examples list, not a checklist of factors to weigh. From What is section 5A of the SRC Act?

Stress is a response, not a hazard and not an injury in itself. Safe Work Australia explains that psychosocial hazards can create stress, and that stress can cause psychological or physical harm where workers are stressed often, over a long time, or at a high level of intensity. From What are psychosocial hazards?

Yes. Comcare describes the SRC Act scheme as a no fault scheme with limited access to common law. It takes an integrated approach across injury prevention, occupational rehabilitation and workers' compensation, with employers responsible for the occupational rehabilitation and return to work of their employees. From What is Comcare?

Yes. Section 37(5) replaces section 19 or 31 compensation during the program: full-time participants receive the amount section 19 would have paid, and part-time participants receive an amount the relevant authority determines within the statutory band. From What is section 37 of the SRC Act?

No. Subsection 5B(2) lists matters that may be taken into account, including the duration of the employment, its nature and particular tasks, any predisposition of the employee, non-employment activities, and other matters affecting the employee's health. The subsection states expressly that it does not limit the matters that may be taken into account. From What is section 5B of the SRC Act?

No. Subsection 24(9) states a maximum amount, but section 13 indexes it to the Consumer Price Index, and section 13 expressly lists subsection 24(9) as a relevant amount. Always take the current figure from Comcare rather than from the face of the Act. From What is section 24 of the SRC Act?

No. NIST states the framework is intended to be voluntary, rights-preserving, non-sector-specific and use-case agnostic. It was produced as directed by the National Artificial Intelligence Initiative Act of 2020 and offers a resource rather than a compliance obligation, even for organisations in the United States. From What is the NIST AI Risk Management Framework?

No. Section 14 is the liability provision only. The reasonable administrative action carve-out sits in the closing words of subsection 5A(1), which exclude a disease, injury or aggravation suffered as a result of reasonable administrative action taken in a reasonable manner in respect of the employee's employment. From What is section 5A of the SRC Act?

No. Every limb of section 19 is qualified by the words so far as is reasonably practicable. The duty holder must do what is reasonably practicable to ensure health and safety, not guarantee that no harm ever occurs. Dropping the qualifier overstates the duty. From What is section 19 of the WHS Act?

No. Section 47(1) requires the person conducting a business or undertaking to consult so far as is reasonably practicable, with workers who are, or are likely to be, directly affected by a matter relating to work health or safety. Restating the duty without the qualifier is a documented drafting error. From What are sections 47 to 49 of the WHS Act?

No. The standard states that being voluntary, it does not create new legal duties about AI systems or their use. It asks organisations to commit to understanding their AI use, engaging stakeholders, running risk and impact assessments, testing, and adopting appropriate controls. Existing law still applies regardless. From What is the Voluntary AI Safety Standard?

Yes. Subsection 8(10) reduces the calculated amount by any excess over what the employee would receive if not incapacitated, or, where the employee has ceased that employment, over the greater of the two continuing-employment comparisons the subsection sets out. From What is section 8 of the SRC Act?

Yes. NIST released NIST AI 600-1, the Generative AI Profile, on 26 July 2024. It is a companion to the AI RMF that helps organisations identify risks specific to generative AI and proposes actions for managing them in line with their own goals and priorities. From What is the NIST AI Risk Management Framework?

No. They share a number only. Section 14 of the WHS Act is the non-transferability principle for work health and safety duties. Section 14 of the SRC Act is the liability provision for compensation in the Commonwealth workers compensation scheme. From What is section 14 of the WHS Act?

No. They share a number only. Section 19 of the WHS Act is the primary duty of care owed by a person conducting a business or undertaking. Section 19 of the SRC Act deals with compensation for incapacity in the Commonwealth workers compensation scheme. From What is section 19 of the WHS Act?

Decide who is accountable, understand impacts and plan accordingly, measure and manage risks by implementing AI-specific risk management, share essential information, test and monitor, and maintain human control. Two versions exist, a foundations edition for low-risk and early AI use, and an implementation guidance edition for complex and higher-risk use. From What is the Voluntary AI Safety Standard?

A reporting entity must enrol and register with AUSTRAC, develop and maintain a risk-based AML/CTF program, conduct customer due diligence, report suspicious matters, report threshold transactions such as large cash dealings, and keep supporting records. The exact services that trigger these obligations are the designated services listed in the Act. From What is AML/CTF regime?

Subsection 14(2) provides that compensation is not payable for an injury that is intentionally self-inflicted. Subsection 14(3) excludes an injury caused by the serious and wilful misconduct of the employee, unless the injury results in death, or serious and permanent impairment. From What is section 14 of the SRC Act?

Govern, Map, Measure and Manage. Govern cultivates a culture of risk management and sets the structures that align AI work with organisational policy. Map establishes the context to frame risks. Measure analyses, benchmarks and monitors those risks. Manage allocates resources to treat them and plans incident response. From What is the NIST AI Risk Management Framework?

The NES are the minimum entitlements for employees in the national system. They cover maximum weekly hours, flexible working requests, casual employment, parental leave, annual leave, personal, carer's, compassionate and family and domestic violence leave, community service leave, long service leave, public holidays, superannuation, notice and redundancy, and the required information statements. From What is the Fair Work Act 2009?

Article 99 sets three tiers. Breaching the Article 5 prohibitions can draw fines up to 35 million euro or 7 per cent of total worldwide annual turnover, whichever is higher. Most other breaches reach 15 million euro or 3 per cent, and supplying misleading information 7.5 million euro or 1 per cent. From What is the EU AI Act?

After the threshold, compensation is based on a percentage of normal weekly earnings minus AE. The percentage is 75 if the employee is not working, then 80, 85, 90 or 95 as the share of normal hours worked rises, and 100 at full normal hours. From What is section 19 of the SRC Act?

Subsection 19(3) opens without limiting subsections (1) and (2), then lists sub-duties including a safe work environment, safe plant and structures, safe systems of work, safe use and storage of substances, adequate welfare facilities, necessary information, training, instruction or supervision, and monitoring of worker health and workplace conditions. From What is section 19 of the WHS Act?

NIST lists valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed. Validity and reliability is treated as the base condition, and accountability and transparency relates to all the others. The characteristics must be balanced by context of use. From What is the NIST AI Risk Management Framework?

A duty holder must ensure a control measure is, and is maintained so that it remains, effective, including by ensuring it is and remains fit for purpose, suitable for the nature and duration of the work, and installed, set up and used correctly. The third limb is the one most often dropped in summaries. From What are regulations 37 and 38 of the WHS Regulations?

OWASP published a Top 10 for Agentic Applications in December 2025. It runs from agent goal hijack and tool misuse through identity and privilege abuse, supply chain vulnerabilities, unexpected code execution, memory and context poisoning, insecure inter-agent communication, cascading failures, human-agent trust exploitation, and rogue agents. From What is agentic AI?

The AML/CTF Amendment Act 2024 extends the regime to more professions, including certain lawyers, accountants, conveyancers, real estate professionals, and dealers in precious metals and stones. Broader reforms commenced 31 March 2026, and newly regulated Tranche 2 businesses are regulated by AUSTRAC from 1 July 2026, subject to transitional rules. From What is AML/CTF regime?

Three limbs. A disease suffered by an employee; a physical or mental injury (other than a disease) arising out of, or in the course of, the employee's employment; or an aggravation of such an injury that arose out of, or in the course of, that employment. All three are subject to the reasonable administrative action carve-out. From What is section 5A of the SRC Act?

The Privacy Act gives examples: a decision under an Act or legislative instrument to grant or refuse a benefit, a decision affecting rights under a contract, agreement or arrangement, and a decision affecting access to a significant service or support. Beneficial effects count, not just adverse ones. From What is automated decision-making?

Common matters include unfair dismissal, bullying, sexual harassment, dismissal under general protections, unfair deactivation or termination for regulated workers, disputes about flexible work or unpaid parental leave, changes from casual to permanent employment, and right to disconnect disputes. It also handles industrial action and bargaining disputes. From What is the Fair Work Commission?

Section 55A defines psychosocial hazard, section 55B defines psychosocial risk, section 55C requires a PCBU to manage psychosocial risks in accordance with Part 3.1 and to implement the control measures required by section 55D, and section 55D requires elimination or minimisation so far as is reasonably practicable, having regard to the matters listed in section 55D(2). From What is the WHS Regulation 2025 (NSW)?

Subsection 60(1) defines a reviewable decision as a decision made under subsection 38(4) or section 62. An original determination is not itself a reviewable decision. It must first pass through reconsideration under section 62 before the Administrative Review Tribunal can review the resulting decision. From What is section 60 of the SRC Act?

AWS describes four stages. Create external data as vector representations in a database, retrieve relevant information by relevancy search, augment the prompt by adding the retrieved data in context, and update the external data asynchronously through real-time processes or periodic batch, so it does not go stale. From What is retrieval-augmented generation (RAG)?

Subsection 4(1) provides that aggravation includes acceleration or recurrence. That inclusive definition feeds directly into the injury definition in section 5A and the disease definition in section 5B, both of which cover an aggravation as well as the underlying injury or ailment. From What is section 4 of the SRC Act?

APP 1 requires open and transparent management of personal information, which in practice means a current privacy policy and documented practices and procedures. From 10 December 2026 it also requires entities using personal information in automated decision making affecting rights or interests to describe that use in the policy. From What are the Australian Privacy Principles?

AUSTRAC stands for the Australian Transaction Reports and Analysis Centre. It describes itself as having a dual role, acting as Australia's anti-money laundering and counter-terrorism financing regulator and as the national financial intelligence unit, using both regulation and intelligence to detect, deter and disrupt serious crime. From What is AUSTRAC?

Comcare is the national work health and safety and workers' compensation authority. It acts as a regulator, claims manager, scheme manager and insurer. It is established under the Safety, Rehabilitation and Compensation Act 1988 and holds functions, compliance and enforcement powers under both that Act and the Work Health and Safety Act 2011. From What is Comcare?

Sharing relevant information about the matter, giving workers a reasonable opportunity to express views, raise work health or safety issues and contribute to the decision-making process, taking workers' views into account, and advising workers of the outcome in a timely manner. Any health and safety representative must be involved. From What are sections 47 to 49 of the WHS Act?

Eliminate any risk associated with a psychosocial hazard so far as is reasonably practicable. If elimination is not reasonably practicable, reduce the risk by altering the management of work, the plant, the systems of work, the work design or the workplace environment, or by information, instruction or training, or a combination, subject to the limits in regulations 15(3) and 15(4). From What are the Victorian Psychological Health Regulations?

Section 21(1) requires an employer, so far as is reasonably practicable, to provide and maintain for employees a working environment that is safe and without risks to health. Section 21(2) lists specific failures, including plant and systems of work, and section 21(3) extends the duty to independent contractors and their employees for matters the employer controls. From What is the Occupational Health and Safety Act 2004 (Vic)?

Subsection 4(1) is the Act's dictionary. It defines terms such as ailment (any physical or mental ailment, disorder, defect or morbid condition, whether of sudden onset or gradual development), aggravation (which includes acceleration or recurrence), impairment, permanent, licensee, suitable employment and medical treatment, and it applies unless the contrary intention appears. From What is section 4 of the SRC Act?

Section 912A sets the general obligations of Australian financial services licensees, including doing all things necessary to ensure the financial services covered by the licence are provided efficiently, honestly and fairly, managing conflicts of interest, complying with licence conditions and the financial services laws, and ensuring representatives comply. From What is the Corporations Act 2001?

Subsection 5B(3) defines it in the Act itself, providing that significant degree means a degree that is substantially more than material. A disease claim only satisfies section 5B if the employment contributed to the ailment or its aggravation to at least that threshold. From What is section 5B of the SRC Act?

Article 3 defines it as a machine-based system designed to operate with varying levels of autonomy, that may exhibit adaptiveness after deployment, and that infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions influencing physical or virtual environments. From What is the EU AI Act?

It describes itself as Australia's independent workplace relations tribunal and registered organisations regulator. Its responsibilities span dispute resolution, labour standards including annual wage reviews and modern awards, bargaining and enterprise agreements, and the regulation of registered organisations through its General Manager. From What is the Fair Work Commission?

The OAIC regulates privacy, freedom of information and government information policy. Its work includes conducting investigations, reviewing decisions, handling complaints, and providing guidance and advice. It administers the Privacy Act 1988, receives notifiable data breach notifications, and publishes the Australian Privacy Principles guidelines that entities are expected to follow. From What is the Office of the Australian Information Commissioner?

The full operative text is one sentence, "A duty cannot be transferred to another person." It sits with the other principles that apply to duties, alongside section 15 (a person can have more than one duty) and section 16 (more than one person can concurrently have the same duty). From What is section 14 of the WHS Act?

Under the model WHS laws a person conducting a business or undertaking must eliminate psychosocial risks, or if that is not reasonably practicable, minimise them so far as is reasonably practicable. The model WHS Regulations require PCBUs to have regard to all relevant matters when choosing control measures. From What are psychosocial hazards?

Under section 58(3), where the claimant refuses or fails, without reasonable excuse, to comply, the relevant authority may refuse to deal with the claim until the information or document copy is given. That is a pause on the claim, not the section 57(2) suspension of compensation rights. From What is section 58 of the SRC Act?

Refusal or failure without reasonable excuse suspends the employee's rights to compensation and related proceedings until the program is begun (section 37(7)). Compensation for medical treatment costs under section 16 continues despite the suspension (section 37(7A)). From What is section 37 of the SRC Act?

Refusal or failure without reasonable excuse, or obstruction, suspends the employee's rights to compensation and related proceedings until the examination takes place (section 36(4)). Section 36(4A) preserves compensation for medical treatment costs payable under section 16. From What is section 36 of the SRC Act?

Under section 57(2), where the employee refuses or fails, without reasonable excuse, to undergo the examination, or obstructs it, the employee's rights to compensation and to institute or continue proceedings are suspended until the examination takes place. Section 57(5) provides that compensation is not payable in respect of the suspension period. From What is section 57 of the SRC Act?

Two different answers apply. Under subsection 8(4), where shortness makes the calculation impracticable, normal weekly earnings are taken from another employee performing comparable work. Under subsection 8(5), where the calculation would not fairly represent the weekly rate being paid, Comcare calculates over such other period as it considers reasonable. From What is section 8 of the SRC Act?

Three things under APP 1.8: the kinds of personal information used in the operation of such computer programs, the kinds of decisions made solely by those programs, and the kinds of decisions for which a program does something substantially and directly related to making the decision. From What is automated decision-making?

A material service provider is one the entity relies on to undertake a critical operation, or one that exposes the entity to material operational risk. For AI, this can include a hosted model or AI-enabled service supporting claims, underwriting or customer decisions. The Material Service Provider Register should capture these arrangements. From What is APRA CPS 230?

A hazard that arises from, or relates to, the design or management of work, a work environment, plant at a workplace, or workplace interactions or behaviours, and that may cause psychological harm, whether or not it may also cause physical harm. The plant at a workplace limb is often dropped in summaries. From What are regulations 55A to 55D of the WHS Regulations?

Rogue agents is the tenth OWASP agentic risk, ASI10. It covers agents that begin showing misalignment, concealment and self-directed action. OWASP is explicit that the entry focuses on loss of behavioural integrity and governance once drift begins, not on the initial intrusion that may have started it. From What is agentic AI?

The SRC Act allows eligible corporations and Commonwealth authorities to hold a licence to self-insure their workers' compensation liabilities, claims management, or both. The relevant minister must first declare a corporation eligible, after which it applies to the Safety, Rehabilitation and Compensation Commission for the licence. From What is Comcare?

A target market determination, or TMD, is the document an issuer must make under Part 7.8A. It defines the class of consumers a financial product suits, the distribution conditions and restrictions, the review triggers, and the information distributors must report. Distribution must stay consistent with it. From What is Design and Distribution Obligations?

Subsection 4(1) defines ailment as any physical or mental ailment, disorder, defect or morbid condition, whether of sudden onset or gradual development. Section 5B then builds the disease definition on that term, covering both the ailment itself and an aggravation of it. From What is section 5B of the SRC Act?

It is Australia's framework for preventing money laundering and terrorism financing, set out in the AML/CTF Act 2006 and administered by AUSTRAC. Regulated businesses, called reporting entities, must enrol with AUSTRAC, maintain a compliance program, verify customers, and report suspicious and threshold transactions. From What is AML/CTF regime?

Subsection 8(1) calculates normal weekly earnings over the relevant period from three inputs. NH is the average number of hours worked each week, RP is the average hourly ordinary time rate of pay, and A is the average weekly allowance, excluding an allowance for special expenses incurred in the employment. Subsection 8(2) adds a separate overtime component where overtime is worked on a regular basis. From What is section 8 of the SRC Act?

Compilation No. 147, register ID C2026C00339, in force from 1 July 2026 and registered on 28 July 2026. The Act is amended frequently, so always confirm currency on the Federal Register of Legislation before quoting section text; earlier compilations such as No. 145 (C2026C00058) are superseded. From What is the Corporations Act 2001?

Authorised version 045, effective 6 August 2025, published on the Victorian legislation website as the in-force text of Act No. 107/2004. Always confirm the current version before relying on section text, because the register lists each superseded version separately. From What is the Occupational Health and Safety Act 2004 (Vic)?

Safe Work Australia defines a psychosocial hazard as anything that could cause psychological harm, for example harm to someone's mental health. Psychosocial hazards can arise from the design or management of work, the work environment, plant at a workplace, or workplace interactions and behaviours. From What are psychosocial hazards?

Anthropic draws the line at who controls the path. Workflows are systems where models and tools are orchestrated through predefined code paths. Agents are systems where models dynamically direct their own processes and tool usage, keeping control over how they accomplish tasks. Workflows are predictable, agents are not. From What is agentic AI?

An issuer designs and offers the financial product and must prepare and maintain the target market determination. A distributor deals in or arranges the product, including AFS licensees and advisers, and must take reasonable steps to distribute consistently with the TMD and report relevant information back to the issuer. From What is Design and Distribution Obligations?

Direct injection comes from the person using the system, whose input changes how the model behaves. Indirect injection arrives through content the model processes, such as a web page, email or document carrying hidden instructions. NIST notes that in indirect attacks the primary user is often the one harmed. From What is prompt injection?

BEAR, the Banking Executive Accountability Regime, applied only to banking and was administered by APRA. FAR replaced BEAR and extended the accountability model to insurance and superannuation, with joint administration by both APRA and ASIC. FAR also adds a conduct regulator dimension that BEAR did not have. From What is Financial Accountability Regime?

Fine-tuning changes the model weights by training on additional examples. RAG leaves the model unchanged and supplies information at query time from an external index. NIST notes RAG lets the internal knowledge of a model be modified without retraining, so updating a document updates the answer immediately. From What is retrieval-augmented generation (RAG)?

The Administrative Review Tribunal replaced the Administrative Appeals Tribunal on 14 October 2024 under the Administrative Review Tribunal Act 2024 (Cth). It performs the same core function of independent merits review of Commonwealth decisions, but under a new governing Act with revised structure and procedures. The AAT no longer exists. From What is Administrative Review Tribunal?

Section 5A defines injury and excludes conditions suffered as a result of reasonable administrative action taken in a reasonable manner against the employee. It covers actions like performance management, transfers, and discipline. The exclusion frequently determines psychological claims, so the action's reasonableness must be assessed on the evidence. From What is Safety, Rehabilitation and Compensation Act 1988?

The Guide for Arranging Rehabilitation Assessments and Requiring Examinations, prepared by Comcare, approved by the Minister and given effect as a legislative instrument. Section 57(1A) requires the relevant authority to comply with it when deciding to require an examination, including relying on the treating practitioner's information as much as possible before an independent referral. From What is section 57 of the SRC Act?

The SRC Act 1988 is the Commonwealth law that runs the federal workers compensation scheme. It governs liability for injury, disease, rehabilitation, and compensation for employees of the Australian Government and corporations licensed to self-insure under it. Comcare administers claims for many Commonwealth agencies under the Act. From What is Safety, Rehabilitation and Compensation Act 1988?

Introduced by Schedule 2 of the Privacy Act and commenced on 10 June 2025, it lets an individual sue for intrusion upon seclusion or misuse of information where they had a reasonable expectation of privacy. Courts may award damages, an injunction or an order requiring an apology. The OAIC does not administer it. From What is the Privacy Act 1988?

Section 16(1) compensates the cost of medical treatment obtained in relation to the injury, being treatment that it was reasonable for the employee to obtain in the circumstances. The amount is what the determining authority determines is appropriate to that treatment. From What is section 16 of the SRC Act?

Tranche 2 is the expansion of Australia's AML/CTF regime into industries recognised domestically and globally as high risk for criminal exploitation. It covers certain designated services provided by real estate professionals, dealers in precious stones and metals, lawyers, conveyancers, accountants, trust and company service providers, and some virtual asset businesses. From What are the AML/CTF Tranche 2 reforms?

The Australian Information Commissioner Act 2010, Act No. 52 of 2010, establishes the Office of the Australian Information Commissioner. The Office consists of three information officers, the Information Commissioner, the Freedom of Information Commissioner and the Privacy Commissioner, with the Information Commissioner as head of the Office. The OAIC sits as an independent agency within the Attorney-General's portfolio. From What is the Office of the Australian Information Commissioner?

Subsection 24(2) requires regard to the duration of the impairment, the likelihood of improvement in the employee's condition, whether the employee has undertaken all reasonable rehabilitative treatment for the impairment, and any other relevant matters. It is a list of mandatory considerations, not a fixed time period. From What is section 24 of the SRC Act?

At a minimum, a Board-approved risk appetite statement, a Board-approved risk management strategy, a Board-approved business plan, a designated risk management function, and a review process. The framework must also include forward-looking scenario analysis and stress testing based on severe but plausible assumptions. From What is APRA Prudential Standard CPS 220?

From 1 July 2026 newly regulated businesses must comply with obligations under the AML/CTF laws, including implementing AML/CTF programs, conducting customer due diligence, reporting suspicious matters and keeping records. Most only need to enrol, though remittance and virtual asset service providers must also apply for registration. From What are the AML/CTF Tranche 2 reforms?

Eight matters: any written assessment under section 36(8), any reduction in future compensation liability, the cost of the program, improvement in the employee's employment opportunities, the likely psychological effect of not providing it, the employee's attitude, the relative merits of alternative programs, and any other relevant matter. From What is section 37 of the SRC Act?

A written claim in the form approved by Comcare and, except where the claim is for compensation under section 16 or 17, a certificate by a legally qualified medical practitioner in the approved form. Under section 54(5), strict compliance with an approved form is not required and substantial compliance is sufficient. From What is section 54 of the SRC Act?

Subsection 61(1) requires the notice to set out the terms of the determination, the reasons for the determination, and a statement that the claimant may, if dissatisfied, request a reconsideration of the determination under subsection 62(2). A notice carrying terms and reasons alone does not satisfy the provision. From What is section 61 of the SRC Act?

Reporting entities must implement AML/CTF controls and report to AUSTRAC. Core obligations include maintaining an AML/CTF program, conducting customer due diligence, submitting suspicious matter reports, threshold transaction reports and international funds transfer reports, and keeping records. AUSTRAC requires a business to apply to enrol no later than 28 days after the day it starts providing a designated service. From What is AUSTRAC?

Under subsection 62(5), the person reconsidering may make a decision affirming or revoking the determination, or varying it in such manner as the person thinks fit. That decision is a reviewable decision under section 60, which is what the Administrative Review Tribunal can then review. From What is section 62 of the SRC Act?

From 10 December 2026, APP entities that use personal information in a computer program to make a decision that could reasonably be expected to significantly affect an individual's rights or interests must set out in their privacy policies the kinds of personal information used and the kinds of decisions made that way. The OAIC consulted on guidance during 2026. From What is the Privacy Act 1988?

CPS 230 came into force on 1 July 2025. There is a transitional arrangement for existing material service provider contracts, which runs to 1 July 2026 at the earliest of the next renewal date. Separate targeted amendments for non-traditional service providers also take effect on 1 July 2026. From What is APRA CPS 230?

CPS 234 took effect on 1 July 2019. APRA allowed a transition period until 1 July 2020 for information assets managed by third parties, recognising that entities needed time to obtain assurance over systems and data they relied on but did not directly control. From What is APRA CPS 234?

DDO commenced on 5 October 2021 under Part 7.8A of the Corporations Act 2001 (Cth). The regime was introduced by the Treasury Laws Amendment (Design and Distribution Obligations and Product Intervention Powers) Act 2019. ASIC administers it and published Regulatory Guide 274 to set out its expectations. From What is Design and Distribution Obligations?

FAR commenced in two stages. It applied to the banking sector, including authorised deposit-taking institutions, from 15 March 2024. It then applied to the insurance and superannuation sectors from 15 March 2025. The underlying Act received Royal Assent on 14 September 2023. From What is Financial Accountability Regime?

The right to disconnect applied from 26 August 2024 for employees of non-small business employers, and from 26 August 2025 for employees of small business employers, meaning those with fewer than 15 employees. It lets employees refuse to monitor, read or respond to out of hours contact unless refusing is unreasonable. From What is the Fair Work Act 2009?

Parliament passed the AML/CTF Amendment Bill 2024 on 29 November 2024, amending the Anti-Money Laundering and Counter-Terrorism Financing Act 2006. Newly regulated businesses could enrol with AUSTRAC from 31 March 2026 and became subject to obligations from 1 July 2026. Changes for existing reporting entities started 31 March 2026. From What are the AML/CTF Tranche 2 reforms?

They commenced on 1 December 2025. The Regulations were made on 30 September 2025 as S.R. No. 103/2025 under section 158 of the Occupational Health and Safety Act 2004, and version 001 is the in-force text on the Victorian legislation register. From What are the Victorian Psychological Health Regulations?

Later than originally legislated. Regulation (EU) 2026/1744, the Digital Omnibus on AI adopted on 8 July 2026, moved the high-risk obligations for standalone Annex III systems to 2 December 2027 and for AI embedded in regulated products under Annex I to 2 August 2028. From What is the EU AI Act?

Under the notifiable data breaches scheme, an entity covered by the Privacy Act must notify affected individuals and the OAIC when a data breach involving personal information is likely to result in serious harm. The notification to individuals must include recommendations about the steps they should take in response. From What is the Office of the Australian Information Commissioner?

When the measure does not control the risk so far as is reasonably practicable, before a change at the workplace likely to give rise to a new or different risk the measure may not control, when a new relevant hazard or risk is identified, when consultation indicates a review is necessary, or when a health and safety representative requests one. From What are regulations 37 and 38 of the WHS Regulations?

When identifying hazards and assessing risks, deciding on ways to eliminate or minimise risks, deciding on welfare facilities, proposing changes that may affect health or safety, and deciding procedures for consultation, issue resolution, worker health monitoring, workplace condition monitoring, or information and training, plus any activity prescribed by the regulations. From What are sections 47 to 49 of the WHS Act?

Under subsection 62(3), the request must be given to the determining authority within 30 days after the day the determination first came to the notice of the person making the request, not 30 days from the determination date. The authority may allow a further period, before or after that period expires. From What is section 62 of the SRC Act?

The obligation commences on 10 December 2026. It was introduced by the Privacy and Other Legislation Amendment Act 2024 and sits in Australian Privacy Principle 1. The OAIC published an issues paper on 18 May 2026 to inform its guidance, with submissions closing on 15 June 2026. From What is automated decision-making?

APP 11.2 requires an entity that no longer needs personal information for any permitted purpose to take reasonable steps to destroy or de-identify it. That obligation does not apply where the information sits in a Commonwealth record, or where an Australian law or a court or tribunal order requires the entity to retain it. APP 4.3 and APP 6.4 also refer to de-identification. From What is de-identification?

When the cumulative hours the employee has been prevented from working exceed 45 times their normal weekly hours (section 19(2A)). It is an hours-based pool, not a count of 45 calendar weeks, so partial incapacity draws it down more slowly. From What is section 19 of the SRC Act?

Where a claim requires a medical certificate and none accompanies the written claim, section 54(3) provides the claim is taken not to have been made until the certificate is given to the relevant authority. Practitioners track that date, not the date the form first arrived. From What is section 54 of the SRC Act?

From a paper submitted in May 2020, Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks, by Patrick Lewis and colleagues. It described models that combine pre-trained parametric memory, a sequence-to-sequence model, with non-parametric memory, a dense vector index of Wikipedia accessed by a neural retriever. From What is retrieval-augmented generation (RAG)?

In regulation 55D(2) alone. Regulation 55C imposes the duty, requiring the PCBU to manage psychosocial risks in accordance with Part 3.1 and to implement the control measures required by regulation 55D. The matters, such as job demands, systems of work and workplace interactions, all sit in 55D(2). From What are regulations 55A to 55D of the WHS Regulations?

Not on the face of section 29A. Subsection 4(1) defines a catastrophic injury as an injury where the conditions specified in the legislative rules are satisfied, and legislative rules means rules made under section 122A. The threshold question is therefore answered by a separate instrument, not by reading this section. From What is section 29A of the SRC Act?

Not in section 4 itself. Subsection 4(1) provides that injury has the meaning given by section 5A, disease has the meaning given by section 5B, and employee has the meaning given in section 5. Section 4 is the signpost; the operative definitions sit in those sections. From What is section 4 of the SRC Act?

Not in section 64. Subsection 65(4) requires an application for review of a reviewable decision to be made within 60 days after the applicant is served with notice of the decision, despite section 18 of the Administrative Review Tribunal Act 2024. An extension may be sought under section 19 of that Act. From What is section 64 of the SRC Act?

APP 3 governs collection, and the OAIC treats AI-generated or inferred personal information as a collection. APP 6 limits use and disclosure to the primary purpose unless consent or reasonable expectation applies. APP 8 covers overseas disclosure, which most hosted AI triggers. APP 11 requires reasonable security steps. From What are the Australian Privacy Principles?

AUSTRAC regulates reporting entities across accountants, banks, casinos, conveyancers, dealers in precious stones, metals and products, financial service providers, legal professionals, pubs, clubs and bookmakers, real estate, remittance service providers, superannuation providers and virtual asset service providers. Regulation follows the designated service provided, rather than the industry label a business uses. From What is AUSTRAC?

Subsection 60(1) lists them: a determination, decision or requirement made under section 8, 14, 15, 16, 17, 18, 19, 20, 21, 21A, 22, 24, 25, 27, 29, 29A, 30, 31, 34, 36, 37, 39 or 57, under paragraph 114B(5)(a), or under Division 3 of Part X. From What is section 60 of the SRC Act?

It applies to all APRA-regulated entities across five industries: authorised deposit-taking institutions, general insurers, life companies and friendly societies, private health insurers, and superannuation RSE licensees. It also reaches information assets managed on their behalf by related parties and third parties. From What is APRA CPS 234?

The prohibitions on unacceptable-risk practices and the AI literacy duty applied from 2 February 2025. Obligations for general-purpose AI models, governance arrangements, notified bodies and penalties applied from 2 August 2025. The regulation itself entered into force on 1 August 2024. From What is the EU AI Act?

Safe Work Australia states that the model WHS laws have been implemented in all jurisdictions except Victoria. Some jurisdictions have made variations, often to stay consistent with their own drafting protocols and other laws. The model WHS Act Cross-Comparison Table published by Safe Work Australia summarises those differences. From What are the model WHS laws?

Comcare administers the SRC Act for the Australian Government and many of its agencies. Corporations holding a self-insurance licence under the Act determine their own claims. Both apply the same legislation. State schemes use separate workers compensation laws, so always confirm which scheme a claim falls under first. From What is Safety, Rehabilitation and Compensation Act 1988?

The Commission is led by a President, who under section 629A of the Fair Work Act has the same status as a Judge of the Federal Court, supported by Vice Presidents, Deputy Presidents and Commissioners based in Adelaide, Brisbane, Canberra, Hobart, Melbourne, Newcastle, Perth and Sydney. Expert Panel Members are appointed part-time for periods of not more than five years, and some state industrial tribunal members hold dual appointments. From What is the Fair Work Commission?

Subsection 64(1) lists the applicants: the claimant, the Commonwealth if the decision affects it, a Commonwealth authority the decision affects, or a corporation holding a Part VIII licence that the decision affects. Subsection 64(3) provides that no one else may apply, despite section 17 of the Administrative Review Tribunal Act 2024. From What is section 64 of the SRC Act?

The relevant authority, meaning the licensee for an employee employed by a licensee and Comcare for any other employee. The power arises once a section 53 notice is given or a section 54 claim is made. The examination is by one legally qualified medical practitioner nominated by the authority, which pays the examination cost and reasonable travel expenses. From What is section 57 of the SRC Act?

The rehabilitation authority, which is Comcare for exempt authority employees and otherwise the principal officer of the employing entity, authority or licensee. It may arrange an assessment at any time and must arrange one on the employee's written request (section 36(1)). From What is section 36 of the SRC Act?

Subsection 24(5) requires Comcare to determine the degree of permanent impairment under the provisions of the approved Guide, and subsection 24(6) requires it to be expressed as a percentage. The approved Guide is prepared under section 28. The assessment is a determination made by an authorised person, not a calculation a model can complete. From What is section 24 of the SRC Act?

It applies to most Australian Government agencies and to private sector organisations with an annual turnover of more than $3 million, together called APP entities. Some smaller operators are also covered, including private health service providers, credit reporting bodies, businesses that buy or sell personal information, and Commonwealth contracted service providers. From What is the Privacy Act 1988?

All organisations across the AI supply chain, though the first version focuses on AI deployers rather than developers. A deployer is an individual or organisation that supplies or uses an AI system to provide a product or service, whether the deployment is internal to the organisation or external. From What is the Voluntary AI Safety Standard?

ASIC enforces DDO. It can issue stop orders that halt distribution of a product where the target market determination is deficient or distribution is inconsistent with it, and it has commenced litigation. ASIC has issued multiple DDO stop orders since the regime began in October 2021. From What is Design and Distribution Obligations?

The Commonwealth, state and territory regulators enforce WHS laws in their own jurisdictions, supported by the National Compliance and Enforcement Policy. Safe Work Australia is not a regulator and cannot advise on workplace WHS issues. In the Commonwealth jurisdiction the regulator is Comcare, which administers the Work Health and Safety Act 2011. From What are the model WHS laws?

All APRA-regulated entities must comply. That covers authorised deposit-taking institutions (banks), general insurers, life insurers, private health insurers, and superannuation trustees. The standard sits within the existing risk management framework under CPS 220 and SPS 220. From What is APRA CPS 230?

Subsection 60(1) defines a claimant as a person in respect of whom a determination is made. The definition applies for the purposes of Part VI, the Part that governs reconsideration of determinations and Tribunal review of reviewable decisions. From What is section 60 of the SRC Act?

An accountable person is an individual who holds a position of senior executive responsibility within an accountable entity, such as a CEO, a senior risk or compliance executive, or a head of a major business line. Their specific responsibilities must be set out in the entity's accountability statements and accountability map. From What is Financial Accountability Regime?

The Safety, Rehabilitation and Compensation Act 1988 covers employees of the Australian Government, of Australian Government authorities and corporations, and of corporations holding a licence to self-insure under that Act. A separate Parliamentary Injury Compensation Scheme covers parliamentarians and the Prime Minister's spouse. From What is Comcare?

Subsection 14(1) names Comcare as the liable body. Where a licence under Part VIII authorises a licensee to accept liability, section 108A provides that the licensee is liable to pay compensation and Comcare is not, so self-insured licensees stand in Comcare's place for their own employees. From What is section 14 of the SRC Act?

AUSTRAC names real estate professionals, dealers in precious stones, metals and products, lawyers, conveyancers, accountants, trust and company service providers, and businesses providing certain virtual asset services beyond the previously regulated digital to fiat currency exchange services. Regulation attaches to the designated service provided, not the profession. From What are the AML/CTF Tranche 2 reforms?

Section 16(1) makes Comcare liable. Where a Part VIII licensee is authorised to accept liability for an injury, section 108A transfers that liability to the licensee and Comcare is not liable for it. From What is section 16 of the SRC Act?

AUSTRAC, the Australian Transaction Reports and Analysis Centre, is the regulator. It is both Australia's financial intelligence unit and the supervisor of reporting entities. AUSTRAC publishes the AML/CTF Rules, guidance, and program starter kits, and it takes enforcement action against businesses that fail to meet their obligations. From What is AML/CTF regime?

The Work Health and Safety Regulation 2017 was due for automatic repeal on 1 September 2025 under the Subordinate Legislation Act 1989. The 2025 Regulation repealed and replaced it (section 702D), commencing on publication on the NSW legislation website on 3 October 2025, with anything done under the 2017 Regulation continuing in effect. From What is the WHS Regulation 2025 (NSW)?