Australia: technology regulation at a glance

Framework: Corporations Amendment (Digital Assets Framework) Act 2026 (enacted April 2026, commences 9 April 2027); ASIC INFO 225 and existing Corporations Act 2001 (Ch 7) financial-services regime; AUSTRAC AML/CTF Act 2006 (expanded VASP regime effective 31 March 2026); ATO CGT rules; Treasury Payments System Modernisation Bill (Tranche 1 exposure draft) for tokenised stored-value facilities/stablecoins.

Crypto is legal in Australia and is transitioning from a patchwork regime (AUSTRAC AML registration for DCEs, ASIC applying existing financial-product law to tokens via INFO 225, ATO CGT treatment) to a comprehensive licensing framework. The Corporations Amendment (Digital Assets Framework) Act was passed on 1 April 2026 and received Royal Assent on 8 April 2026, but its core licensing obligations only commence on 9 April 2027. In the interim, ASIC has extended class no-action relief for digital-asset businesses to 30 September 2026 while a parallel stablecoin/payments regime (Tranche 1) remains in exposure draft.

Framework: Reliance on existing sectoral laws (Privacy Act 1988, Australian Consumer Law, anti-discrimination and safety statutes) complemented by the non-binding Voluntary AI Safety Standard / Guidance for AI Adoption (Oct 2025), Australia's AI Ethics Principles (2019) and the National AI Plan (Dec 2025); no dedicated comprehensive AI Act

Australia has no comprehensive AI-specific statute. In December 2025 the Government released the National AI Plan and formally dropped the previously consulted 'Mandatory Guardrails' proposal, opting instead to rely on existing technology-neutral laws (privacy, consumer protection, anti-discrimination, work-health-safety, sector regulators) supplemented by voluntary standards and a new Australian AI Safety Institute (AISI) that has advisory — not enforcement — powers. Binding AI-related obligations exist in specific sectors, notably Privacy Act automated-decision-making transparency rules that commence 10 December 2026.

Framework: Privacy Act 1988 (Cth), as amended by the Privacy and Other Legislation Amendment Act 2024 (Cth); enforced by the Office of the Australian Information Commissioner (OAIC), with the 13 Australian Privacy Principles (APPs) forming the core obligations.

Australia has a comprehensive federal privacy regime centred on the Privacy Act 1988 and the 13 Australian Privacy Principles, regulated by the OAIC and covering Commonwealth agencies and most private-sector organisations with annual turnover above AU$3 million (plus certain smaller entities such as health providers). The first tranche of the Privacy Act reform package received Royal Assent on 10 December 2024, introducing a statutory tort for serious invasions of privacy (in force from 10 June 2025), stronger OAIC enforcement powers, and a forthcoming Children's Online Privacy Code. A second, more ambitious tranche of reforms (including likely narrowing of the small-business exemption and a 'fair and reasonable' test) remains proposed rather than enacted as of mid-2026.

Framework: Australian Financial Services Licence (AFSL) under the Corporations Act 2001 for non-cash payment facilities and stored-value facilities (with APRA prudential oversight of large SVFs); National Consumer Credit Protection Act 2009 for BNPL/credit; Consumer Data Right (CDR) for open banking; Reserve Bank of Australia (RBA) as payments-system regulator under the Payment Systems (Regulation) Act 1998. A modernised, activity-based payments licensing regime (Payment Systems Modernisation Bill, Tranche 1) was released in exposure draft on 12 March 2026.

Australia has an in-force but fragmented, product-based licensing regime: payment and stored-value products are captured under the AFSL framework administered by ASIC, with APRA prudential oversight for major stored-value facilities and ADIs. Open banking is live via the Consumer Data Right, real-time payments run on the New Payments Platform/PayTo, and BNPL was brought under full credit licensing on 10 June 2025. Treasury's Tranche 1 payments modernisation exposure draft (March 2026) will introduce a cohesive activity-based PSP licensing regime, but is not yet enacted.

Framework: Migration Act 1958; Department of Home Affairs — no dedicated digital nomad visa. Remote workers rely on Visitor (subclass 600), eVisitor (651), ETA (601) or Working Holiday (417/462) visas.

Australia has no dedicated digital nomad or remote-work visa in 2026, and none is currently proposed. Remote workers typically enter on visitor-class visas (600/651/601), under which limited online work for an overseas employer that is incidental to a genuine holiday is tolerated by policy, though paid work for Australian entities is prohibited. Longer stays with work rights are only available via age-restricted Working Holiday visas (417/462) or standard skilled/employer-sponsored routes; the Significant Investor 'golden' visa was scrapped in mid-2024.

Framework: Online Safety Act 2021 (Cth), administered by the eSafety Commissioner; amended by the Online Safety Amendment (Social Media Minimum Age) Act 2024; supplemented by Basic Online Safety Expectations and registered Phase 1/Phase 2 Industry Codes and Standards.

Australia operates one of the world's most developed online-safety regimes, built around the Online Safety Act 2021 and an independent statutory regulator (the eSafety Commissioner) with take-down, information-gathering and civil-penalty powers. Since December 2025 Australia has enforced a world-first minimum age of 16 for accounts on designated social media platforms, and Phase 2 industry codes covering age-assurance for adult content took effect in March 2026. The Government announced in April 2026 that it will legislate a broader statutory 'digital duty of care' on platforms, with draft legislation expected later in 2026.

Framework: Cyber Security Act 2024 (Cth) (Australia's first standalone cyber law), supported by the Security of Critical Infrastructure Act 2018 (SOCI Act), the Privacy Act 1988 Notifiable Data Breaches (NDB) scheme, and sectoral rules such as APRA Prudential Standard CPS 234; administered by the Department of Home Affairs, the Australian Signals Directorate (ASD/ACSC), OAIC and APRA.

Australia now operates a comprehensive, multi-layered cybersecurity regime anchored by the Cyber Security Act 2024, its first dedicated cyber statute, which introduced mandatory ransomware-payment reporting (commenced 30 May 2025), enforceable smart-device security standards (commenced 4 March 2026), a Cyber Incident Review Board, and limited-use protections for voluntary information sharing. It is layered over the SOCI Act's cyber and risk-management obligations for 11 critical infrastructure sectors (with 12-hour/72-hour incident reporting), the Privacy Act's NDB scheme for personal-data breaches to the OAIC, and APRA CPS 234 for regulated financial entities. A first statutory review of the SOCI Act was delivered on 31 January 2026 and further reforms opened for consultation in March 2026.

Framework: Corporations Act 2001 (Cth), administered by the Australian Securities and Investments Commission (ASIC); Foreign Acquisitions and Takeovers Act 1975 administered by the Foreign Investment Review Board (FIRB); Australian Business Register (ABR) for ABN/tax registrations.

Australia is one of the world's easiest places for a foreigner to start a business: incorporation of a proprietary limited (Pty Ltd) company is fully online via ASIC, typically completes in 1-3 business days, and there is no minimum paid-up capital. There are no foreign-ownership caps for most private businesses, but every Pty Ltd must have at least one director who ordinarily resides in Australia, and larger acquisitions or investments in sensitive sectors may need FIRB approval. On the World Bank's last Doing Business benchmark, Australia ranked 7th globally for 'Starting a Business' (3 procedures, ~2 days).