Australia has no AI Act. A title search of the Federal Register of Legislation for “Artificial Intelligence” on 8 October 2026 returns two instruments, both grant-programme funding rules, and no regulatory statute. An outbound AI sales agent is instead governed by the Do Not Call Register Act 2006, the Spam Act 2003, the Privacy Act 1988 and the Australian Consumer Law.
“No AI law” gets heard as “no rules”. The opposite is true. An AI voice agent dialling Australian numbers sits inside a stack of instruments drafted before generative AI existed, two of which already name synthetic voice. Here is that stack, with the primary source for each.
The Do Not Call Register Act 2006 already names synthetic voice
Section 11 of the Do Not Call Register Act 2006 (Cth) prohibits making a telemarketing call to an Australian number on the Do Not Call Register. Section 5 defines a telemarketing call as a voice call to an Australian number made for a listed commercial purpose, and section 4 defines a voice call to include “a call that involves a recorded or synthetic voice”. Section 11(2) lifts the prohibition where the account-holder or their nominee consented; section 11(3) lifts it where the number was washed against the Register in the previous 30 days.
Written in 2006 for the interactive-voice-response era, it catches a 2026 conversational agent without a word being amended. ACMA keeps the Register under section 13 and enforces the Act; we cover its enforcement record against AI voice callers separately.
Section 25 sets maxima in penalty units, not dollars: for a body corporate with no prior record, up to 100 penalty units per contravention of section 11(1) and 2,000 penalty units in total for contraventions on a single day. The Crimes (Amount of a Penalty Unit) Instrument 2026, made by the Attorney-General on 15 June 2026 and commencing 1 July 2026, states at section 5: “For the purposes of subsection 4AA(1A) of the Act, the amount of a penalty unit is $364.” Its note adds that this amount “only applies to offences committed on or after 1 July 2026 (see subsection 4AA(8) of the Act)”, and section 4AA(8) of the Crimes Act 1914 says the same of any indexed increase. Section 4AA(1), which applies to a law of the Commonwealth unless the contrary intention appears, still reads $330, subject to indexation under section 4AA(3). Section 11(8) of the Do Not Call Register Act makes section 11(1) a civil penalty provision, not an offence, and neither instrument says which amount applies to it. Our arithmetic, not the Act’s: $36,400 and $728,000 at $364 a unit, or $33,000 and $660,000 at $330. Take advice before relying on either conversion.
The Telemarketing Standard 2017 has a synthetic-voice rule of its own
The Telecommunications (Telemarketing and Research Calls) Industry Standard 2017 sets calling hours and what a caller must say. For calls that are not research calls, section 8(1) bans calls before 9am and after 8pm on weekdays, before 9am and after 5pm on Saturdays and at any time on Sunday; section 8(3) adds seven national public holidays; section 8(5) lifts all of that where the account-holder gave express consent in advance to that day or time.
The word “synthetic” appears five times in the Standard, across four provisions, and they do not all point the same way. Section 9(2)(a) requires the caller to give “the given name of the individual making the call (unless the call is made solely using a recorded or synthetic voice)” — a carve-out, repeated for research calls at section 10(2)(a). But section 12, headed “Calls that involve a recorded or synthetic voice”, runs the other way: a caller making a call that involves recorded or synthetic voices must ensure a mechanism is provided during the call so the recipient can request the section 9(4) information — the caller’s contact details, the contact details of whoever caused the call to be made, and the name and contact details of whoever handles complaints. The Standard’s own example is a button to talk to an operator.
So a synthetic-voice agent is excused one identification duty and handed another: a live route to a human, in-call, on request. What the Standard never does is make you say the caller is an AI. The words “artificial”, “automated” and “AI” do not appear in it at all, and no Australian instrument imposes that duty as at 8 October 2026. The rest of section 9 still binds: business name, the person causing the call to be made and the purpose, all as the call starts.
The Standard is scheduled for repeal on 1 April 2027 under section 50 of the Legislation Act 2003, recorded on the Register as a future status change. That is automatic sunsetting, not policy, and no replacement is published as at 8 October 2026. Detail at the telemarketing standard sunset.
Spam Act 2003 covers the SMS and email legs, not the call
The Spam Act 2003 (Cth) governs commercial electronic messages: SMS, email and instant messages. Section 5(5) carves out the call: “If a message is sent by way of a voice call made using a standard telephone service, the message is not an electronic message for the purposes of this Act.” Consent for the call and consent for the text are therefore tested under two different statutes, and one “yes” captured once may satisfy one and not the other.
Privacy Act 1988, the OAIC and the 10 December 2026 ADM obligation
If your agent handles personal information, the Privacy Act 1988 applies as to any other system. The OAIC has published guidance on privacy and the use of commercially available AI products, the closest thing Australia has to a regulator position for buyers of AI tooling. One dated obligation is coming, and the guidance for it is now out: the OAIC’s May 2026 ADM issues paper said “The OAIC intends to release guidance by September 2026, prior to the commencement date for this new ADM obligation.” Submissions closed 15 June 2026, and on 30 September 2026 the OAIC published an APP 1.7-1.9 Transparency Obligation fact sheet, a supplementary fact sheet for government agencies, a flowchart and “an update to the APP 1 Guidelines” (checked 8 October 2026).
The OAIC’s APP 1 guidelines state that new APP 1 obligations for automated decisions commence on 10 December 2026, inserted by the Privacy and Other Legislation Amendment Act 2024. From then, an entity that has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual’s rights or interests, where personal information about the individual is used in the program’s operation, must say in its privacy policy (APP 1.8) the kinds of personal information used in the operation of such programs, the kinds of such decisions made solely by the operation of the program, and the kinds of such decisions for which the program does a thing that is substantially and directly related to making the decision. Whether AI lead scoring clears that threshold is arguable; drafting options are in our ADM transparency statement guide.
Separately, the Attorney-General’s Department consulted on an exposure draft Privacy Amendment (Personal Data Protection) Bill 2026. Submissions closed on Friday 18 September 2026, and as at 8 October 2026 the consultation page says “The Bill remains subject to further consideration by government.”
Australian Consumer Law, and call recording under state law
Section 18(1) of the Australian Consumer Law, Schedule 2 to the Competition and Consumer Act 2010, says: “A person must not, in trade or commerce, engage in conduct that is misleading or deceptive or is likely to mislead or deceive.” Treasury’s Review of AI and the Australian Consumer Law, final report 3 October 2025, found that the ACL, combined with other laws, can generally handle the challenges that come with AI products and services. An AI agent that overstates a discount is where a human rep would be.
Call recording is the messiest layer, because it is not federal, and the states do not agree. Three we read on 2 September 2026:
- Victoria. Section 6(1) of the Surveillance Devices Act 1999 (Vic), authorised version 048, prohibits knowingly using a listening device to record “a private conversation to which the person is not a party” without consent. A party to the call is outside that prohibition.
- Queensland. Section 43(1) of the Invasion of Privacy Act 1971 (Qld), current as at 1 July 2024, makes it an offence to use a listening device to record a private conversation, and section 43(2)(a) excepts the case “where the person using the listening device is a party to the private conversation”.
- Western Australia. Different answer. Section 5(1)(b) of the Surveillance Devices Act 1998 (WA), version 02-g0-00, prohibits using a listening device “to record a private conversation to which that person is a party”. Section 5(3) lets a party record only where every principal party consents, or where one principal party consents and the recording is reasonably necessary to protect that party’s lawful interests.
Recording is not the end of it either: Victoria’s section 11 and Queensland’s section 45 separately restrict communicating or publishing a record of a private conversation. Lawfully recorded does not mean freely shareable.
We could not retrieve the current authorised text of the New South Wales or South Australian instruments on 2 September 2026, and did not check Tasmania, the ACT or the Northern Territory. So do not carry a “one-party consent” rule of thumb across borders on the strength of a secondary explainer. Western Australia is the proof that it breaks.
The instrument map
| Instrument | What it covers | Binds an outbound AI sales agent? | AI-specific regulator guidance | Where it is published |
|---|---|---|---|---|
| Do Not Call Register Act 2006 (Cth) | Telemarketing calls to registered Australian numbers | Yes. “Voice call” includes a recorded or synthetic voice | Not published (ACMA, checked 8 October 2026) | legislation.gov.au, C2006A00088 |
| Telecommunications (Telemarketing and Research Calls) Industry Standard 2017 | Calling hours, caller identification, information on request. Section 12 requires an in-call mechanism to request contact details on recorded or synthetic-voice calls | Yes, until its scheduled repeal on 1 April 2027 | Not published (ACMA, checked 8 October 2026) | legislation.gov.au, F2017L00323 |
| Spam Act 2003 (Cth) | Commercial electronic messages: SMS, email, instant messaging | SMS and email legs only. Section 5(5) excludes voice calls on a standard telephone service | Not published (ACMA, checked 8 October 2026) | legislation.gov.au, C2004A01214 |
| Privacy Act 1988 (Cth) | Personal information handling; APP 1 automated-decision transparency from 10 December 2026 | Yes, wherever the agent touches personal information | Published. OAIC guidance on commercially available AI products; ADM transparency fact sheets, flowchart and updated APP 1 Guidelines, 30 September 2026 | oaic.gov.au and legislation.gov.au |
| Australian Consumer Law (Sch 2, Competition and Consumer Act 2010) | Misleading or deceptive conduct in trade or commerce, section 18 | Yes. It governs what the agent says on the call | Published. Treasury Review of AI and the ACL, October 2025 | legislation.gov.au, C2004A00109 |
| State surveillance-devices and listening-devices Acts | Recording private conversations | Yes, if you record calls. A party may record in Vic and Qld; WA requires all principal parties to consent unless the lawful-interests exception applies | Not published | State registers: Vic, Qld and WA read 2 September 2026; NSW and SA not retrievable |
| Australian Standards for AI, announced 15 July 2026 | Large data centres, AI training, energy, water, land use, copyright | No, on the documents published so far. Not conduct rules for callers | Not published. No exposure draft found as at 8 October 2026 | minister.industry.gov.au release 15 July 2026; National Cabinet statement 26 August 2026 |
What the National AI Plan and the Office of AI actually changed
In September 2024 the Department of Industry, Science and Resources consulted on a proposals paper for introducing mandatory guardrails for AI in high-risk settings; ACMA’s October 2024 submission to DISR responds to it by name. The National AI Plan followed on 2 December 2025. Its “Keep Australians safe” chapter states: “The government’s regulatory approach to AI will continue to build on Australia’s robust existing legal and regulatory frameworks, ensuring that established laws remain the foundation for addressing and mitigating AI-related risks.”
Commentary says the plan dropped the ten mandatory guardrails. The record is thinner than that. The published PDF does not contain the word “guardrail” anywhere and announces no decision on the 2024 proposals paper either way. If your position depends on the guardrails having been formally abandoned, you are relying on inference, not a published decision.
On 15 July 2026 the Prime Minister, the Minister for Industry and the Assistant Minister announced Australian Standards for AI. The release says: “Effective today, the Office of AI will be established within the Department of Prime Minister and Cabinet to accelerate implementation of the Australian Standards on a national level,” and “The Government’s approach will be considered by National Cabinet in August, with standards expected to be legislated early next year.”
It went to National Cabinet on 26 August 2026. The agreed statement of outcomes records that “The Commonwealth intends to legislate the AI standards in early 2027, including conditions associated with delivering AI training”, alongside mandatory standards for data centre energy, water and land use worked out with the states.
Read the substance, not the headline. Across both documents the standards stay pointed at large data centres and AI training: power supply, connection costs, grid response, water, siting, plus protections for Australian creative work. Neither imposes a duty on a business making outbound AI sales calls, and we found no exposure draft published as at 8 October 2026. A ministerial speech on 8 October 2026 says the Government is “developing AI standards legislation” and has “committed to legislating National AI Standards for frontier AI”; it names no duty on businesses making sales calls.
The AI Safety Institute page lists three goals: analyse and test AI models, support regulators and agencies, and shape safe AI development and governance. No enforcement power appears there. The 25 November 2025 establishment release was broader: “The Government will ensure the Institute has capability to ensure AI companies are compliant with Australian law and uphold legal standards around fairness and transparency.” We found no published instrument conferring compliance powers on it, so treat it as advisory. The $29.9 million funding figure circulating in commentary is in neither the plan PDF nor that release, so we are not repeating it as a government number.
What “no AI Act” does not mean
It does not mean no rules: every obligation above is live today and most carry civil penalties. It does not mean no regulator either. ACMA, the OAIC and the ACCC each hold a piece, and none needs new AI powers to act on a misleading call to a registered number using improperly obtained personal information.
It does not mean no disclosure norm. Under the Commercial Radio Code of Practice 2026, in effect from 1 July 2026, stations must tell listeners when a synthetic voice hosts a regular programme or news broadcast. ACMA’s 10 February 2026 announcement notes: “This is the first time AI has been addressed in a broadcasting code of practice.” But that code was developed by the industry body Commercial Radio & Audio and registered by ACMA, and it binds commercial radio licensees and nobody else. Do not read a broadcasting code as a rule for your dialler.
And it does not mean nothing is changing: the Telemarketing Standard sunsets 1 April 2027, APP 1 automated-decision transparency starts 10 December 2026 and consultation on a privacy exposure draft closed 18 September 2026. So the diligence question is not “is your AI compliant with the AI Act”. There isn’t one. Ask whether the platform washes lists against the Do Not Call Register, holds consent evidence per channel, logs what was said and enforces calling windows that respect the 2017 Standard.
This article is general information, not legal advice. Every provision cited was read against the primary instrument on 2 September 2026, and the regulatory-status statements (the AI Act search, AI disclosure, the Telemarketing Standard’s replacement, ACMA guidance, OAIC guidance, the privacy exposure draft and the Australian Standards for AI) were re-checked on 8 October 2026, but your obligations turn on your own facts and the states you dial. Get advice.
Apply For Partnership to talk to Zian AI about how our SmartReach AI™ and PrecisionPitch AI™ agents handle Australian outbound during our partner beta.
Frequently asked questions
Does Australia have an AI Act in 2026?
No. Checked 8 October 2026: a title search of the Federal Register of Legislation for “Artificial Intelligence” returns two instruments, both made under the Industry Research and Development Act to fund grant programmes. There is no standalone AI statute and no AI regulator with conduct powers.
Does the Do Not Call Register Act apply to an AI voice agent?
Yes. Section 4 defines a voice call to include “a call that involves a recorded or synthetic voice”, so a synthetic-voice sales call to a registered number engages section 11 exactly as a human call does.
Do I have to tell someone they are talking to an AI?
No Australian instrument requires it on an outbound sales call as at 8 October 2026. The Telemarketing and Research Calls Industry Standard 2017 mentions synthetic voice in four provisions: section 9(2)(a) and section 10(2)(a) excuse a synthetic-voice call from giving a human given name, and section 12 requires an in-call mechanism for the recipient to request contact and complaint details. None of them requires you to say the caller is an AI. ACMA has registered a code imposing synthetic-voice disclosure in commercial radio, but not in telemarketing.
What is the maximum penalty for calling a number on the Do Not Call Register?
Section 25 sets maxima in penalty units. A body corporate with no prior record faces up to 100 penalty units per contravention of section 11(1) and 2,000 penalty units for contraventions on a single day. At $364 a unit from 1 July 2026 that is $36,400 and $728,000, but section 4AA(8) of the Crimes Act 1914 applies the increased amount only to offences committed on or after 1 July 2026, section 11(1) is a civil penalty provision (s 11(8)), and neither instrument says which amount applies to it; at $330 a unit it would be $33,000 and $660,000. Take advice before relying on either figure.
Will the Australian Standards for AI regulate my AI sales agent?
On the documents published so far, no. The 15 July 2026 announcement and the 26 August 2026 National Cabinet statement both describe duties on large data centres and AI training, covering power, water, land use and copyright. The Commonwealth says it intends to legislate in early 2027. We found no exposure draft published as at 8 October 2026, so the final scope is not knowable yet. A ministerial speech on 8 October 2026 says the Government has committed to legislating National AI Standards for frontier AI; it names no duty on businesses making sales calls.
What changes on 10 December 2026?
New APP 1 obligations for automated decisions commence, inserted by the Privacy and Other Legislation Amendment Act 2024. Entities that have arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual’s rights or interests, where personal information about the individual is used in the program’s operation, must say in their privacy policy the kinds of personal information used, the kinds of such decisions made solely by the program, and the kinds of such decisions for which the program does a thing that is substantially and directly related to making the decision. The OAIC’s APP 1 guidelines set out the commencement date and the required disclosures. On 30 September 2026 the OAIC published a fact sheet, a flowchart and an updated version of the APP 1 guidelines for the obligation.