EU AI Act for Australian businesses: does it apply to you?
Last updated:
Australia has no AI Act of its own, so it is easy to assume AI rules are a future problem. For businesses selling into Europe, Article 50 has applied since 2 August 2026. This guide covers who is exposed, what Article 50 asks for, and how it sits next to AI regulation in Australia.
Does the EU AI Act apply to Australian businesses?
It can, and the test is about where your AI is used, not where your business is registered. Article 2(1)(c) brings in “providers and deployers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the Union”. Australia is a third country for this purpose.
So an Australian business can be caught in three ways: it places an AI system on the EU market (for example, a SaaS product with an AI feature sold to EU customers), it has an establishment in the EU, or the output of the AI it runs is used by people in the EU. The third is the one most Australian websites miss. An ABN, an Australian domain and an Australian server don't change it.
If your customers and visitors are all in Australia, and you don't market to Europe, the Act is unlikely to apply. If you are not sure, your analytics will show how much of your traffic comes from EU countries. This is general information, not legal advice.
Which Australian businesses are most exposed
| Sector | Example | Why it matters |
|---|---|---|
| SaaS with EU users | A Sydney HR-software company whose in-app AI assistant answers customers in Ireland and the Netherlands. | It is the provider of its own AI feature, and the output is used in the EU. Article 50(1) applies to that assistant. |
| Ecommerce shipping to Europe | A Gold Coast swimwear brand that ships to the EU and uses an AI chat widget for sizing and returns questions. | EU shoppers talk to the widget. The business deploys it, and its vendor is the provider, so both have a part to play. |
| Tourism and travel | A Cairns reef-tour operator whose booking chatbot handles enquiries from backpackers planning trips from Germany and France. | The chat is used by people in the EU while they plan, so the chatbot disclosure rule is in play. |
| Education | A Melbourne college whose international-admissions chatbot answers prospective students in Italy and Spain. | Same test: the output is used in the EU. AI-generated course images or video shown to that audience can also be in scope. |
| Agencies and creators | A Perth creative agency producing realistic AI-generated video of people for a client's European campaign. | Realistic AI video of people can be a deep fake under Article 50(4), which asks the deployer to disclose it. |
| Local-only businesses | A Brisbane plumber whose site has a chatbot, serving south-east Queensland customers only. | Unlikely to be in scope. No EU market, and the output is not used in the EU. |
These are illustrative examples, not real businesses and not legal advice. Your position depends on your facts. For sector detail, see the guides for SaaS companies and ecommerce.
Article 50 in plain English
Article 50 is the transparency part of the AI Act. It is not about banning AI or about high-risk systems. It asks that people know when AI is involved. For an Australian website with European visitors, three duties matter most:
- →Chatbots and voice agents, Article 50(1). AI systems that talk to people must be designed so people are told they are interacting with AI, unless that is obvious. The duty sits with the provider, but if you embed a vendor's bot, check its AI notice is switched on and visible on your site. See chatbot disclosure under Article 50(1).
- →AI-generated content, Article 50(2). Providers of generative AI must mark audio, image, video and text output in a machine-readable way, so it can be detected as AI-generated. Systems already on the market before 2 August 2026 have until 2 December 2026 (Article 111(4)). See AI content labelling.
- →Deepfakes, Article 50(4). If you publish realistic AI-generated or manipulated images, audio or video of people, places or events, you must disclose it. AI-written text published to inform the public on matters of public interest needs a disclosure too, unless a human reviewed it and someone holds editorial responsibility. See deepfake disclosure.
Notices must be clear and distinguishable, and given at the latest at the first interaction or exposure (Article 50(5)). These rules have applied since 2 August 2026 (Article 113). Breaches can lead to fines of up to €15 million or 3% of worldwide annual turnover, with the lower amount for SMEs (Article 99(4) and (6)). The full text, paragraph by paragraph, is in our Article 50 guide.
AI regulation in Australia: how it compares
AI regulation in Australia is on its way, but it isn't here yet. As of November 2026, no AI-specific law is in force. The short version: Australian rules are coming; the EU's may already apply to you.
- →National AI Plan, December 2025. The federal government released its National AI Plan on 2 December 2025. It builds on existing, largely technology-neutral laws and regulators rather than a standalone AI Act, and it did not go ahead with the mandatory guardrails for high-risk AI proposed in September 2024 (full plan, PDF).
- →Australian Standards for AI, announced July 2026. On 15 July 2026 the Prime Minister announced legislation, planned for early 2027, to establish Australian Standards for AI (PM announcement), and created an Office of AI in the Department of the Prime Minister and Cabinet to coordinate the work.
- →Bills touching AI before Parliament. Some bills already in Parliament reach AI without being AI laws. The Online Safety Amendment (Digital Duty of Care) Bill 2026 is now before the Senate, after the House of Representatives agreed to it with amendments on 28 October 2026. It is not yet law. It would set minimum safety standards for online services, including certain AI chatbot conduct (Digital Duty of Care, bill introduced).
- →AI Safety Institute. The plan sets up an Australian AI Safety Institute to monitor risks and advise existing regulators. It is not a regulator itself (Keep Australians safe).
- →Privacy Act: automated decision-making transparency. From 10 December 2026, if your chatbot or other AI tool uses personal information to make or substantially inform decisions that significantly affect people, your privacy policy must say so (APP 1.7). The OAIC's final guidance defines “computer program” broadly, including generative AI and chatbots, but the duty turns on the decision: a chatbot is caught only when it is used for decisions that could reasonably be expected to significantly affect a person's rights or interests (APP 1 guidelines, OAIC fact sheet).
The two regimes ask for different things. APP 1.7 is about significant decisions and lives in your privacy policy. Article 50 is about telling people, at the moment they meet it, that they are talking to AI or looking at AI-generated content. A business whose chatbot serves EU users and also feeds decisions like that may need to deal with both, and meeting one does not meet the other.
Built in New Zealand
Article50.io is built in New Zealand by Maynard, a solo founder, so it is a short hop across the Tasman rather than the other side of the world. Questions come straight to me, and I reply within 24 hours. More about Article50.io.
Sources
- AI Act, Article 2: Scope
- AI Act, Article 50: Transparency obligations
- AI Act, Article 70: National competent authorities
- AI Act, Article 99: Penalties
- AI Act, Article 111: Systems already on the market
- AI Act, Article 113: Entry into force and application
- Department of Industry, Science and Resources: National AI Plan launch
- National AI Plan 2025 (PDF)
- Prime Minister: AI in Australia's interests
- PM&C: Office of AI
- Parliament of Australia: Online Safety Amendment (Digital Duty of Care) Bill 2026
- Department of Infrastructure: Digital Duty of Care Bill introduced
- Department of Infrastructure: Digital Duty of Care
- Proposals paper: mandatory guardrails for AI in high-risk settings
- OAIC: APP 1.7–1.9 transparency obligation fact sheet (PDF)
- OAIC: APP guidelines, Chapter 1
This page is general information, not legal advice. A clean result is not a compliance clearance, and this is not legal advice.
Frequently Asked Questions
Does the EU AI Act apply to Australian businesses?
It can. Article 2 of the AI Act covers providers and deployers based outside the EU when the output of their AI system is used in the EU. An Australian business with no European office can still be in scope if people in Europe use its chatbot, voice agent or AI-generated content.
Is there an AI Act in Australia?
Not yet. As of November 2026, no AI-specific law is in force in Australia. In July 2026 the Prime Minister announced legislation in early 2027 to establish Australian Standards for AI, after the December 2025 National AI Plan dropped the proposed mandatory guardrails. The EU AI Act sits outside Australian law and may already apply.
Does updating our privacy policy for APP 1.7 cover Article 50 as well?
No. They are separate duties. From 10 December 2026, APP 1.7 applies only where a computer program uses personal information to make or substantially inform decisions that significantly affect people, and asks for that in your privacy policy. Article 50 asks for a clear notice, at the latest at the first interaction, that people are dealing with AI.
What are the fines for an Australian business?
The same ceiling as for any business in scope. Article 99(4) sets fines for Article 50 breaches of up to €15 million or 3% of total worldwide annual turnover, whichever is higher. For SMEs, including start-ups, Article 99(6) applies whichever of the two amounts is lower. Fines are set in euros, not Australian dollars.
Who would enforce Article 50 against an Australian business?
Not an Australian regulator. Each EU member state names its own market surveillance authority under Article 70 of the AI Act, and that authority enforces Article 50 in its country. For an Australian business, that would be the authority where its AI output is used, for example in Ireland, Germany or France.
Check your site automatically
The free scan loads your public page in a real browser, the way a visitor in Europe would see it, and shows your single most severe finding in under a minute. No signup. A clean result is not a compliance clearance, and this is not legal advice.
Related Article 50 resources
- Art. 50EU AI Act Article 50 (Art. 50): Full Text & Plain-English Explanation
- Q&A · ScopeDoes Article 50 Apply to US Companies? (EU AI Act)
- Art. 50(1)Does Your Chatbot Need an AI Disclosure? Article 50(1) Explained
- Country guide · New ZealandEU AI Act for NZ Businesses (2026): Does It Apply to You?
- Question · Territorial scopeDoes the EU AI Act Apply to the UK? The Clear Answer
- MethodHow the Article50.io Scan Works: Method, Checks and Limits
Automated technical guidance, not legal advice. Citations refer to Regulation (EU) 2024/1689.