Skip to content

International AI Legal Landscape (2025) — What Australian Businesses Should Know

Last updated: 20 August 2025 (AUS/Adelaide). This page is informational and not legal advice.

As AI regulation accelerates globally, many jurisdictions already impose binding requirements or have near-term obligations that will affect Australian organisations exporting, operating, or handling data linked to those regions.

Below is a practical snapshot of the US, Canada, EU, UK, Japan, South Korea, Singapore, plus the global frameworks most often referenced by regulators.

Executive Snapshot

  • EU — The EU AI Act is in force with staged obligations. Bans on “unacceptable risk” uses started 2 Feb 2025; general-purpose AI (GPAI) duties start 2 Aug 2025; most remaining rules phase in through 2026–2027. Expect documentation, transparency, risk management and post-market monitoring obligations if you sell into the EU or provide GPAI there.
  • US — No single federal AI law. Federal direction runs through NIST AI RMF 1.0 and public-sector guidance (OMB M-24-10). States are moving: Colorado’s AI Act (effective 1 Feb 2026) requires risk programs, impact assessments and notices for “high-risk” AI. NYC mandates bias audits for automated hiring tools.
  • Canada — The federal Artificial Intelligence and Data Act (AIDA) (within Bill C-27) has not been enacted as of Aug 2025; it may be revisited in a new parliamentary session. Draft guidance remains a good indicator of direction (risk-based duties for “high-impact” systems).
  • UK — No single AI Act; regulator-led, “pro-innovation” model with central government coordination and the UK AI Safety Institute. Regulators are issuing sector guidance and pilots (assurance, sandboxes).
  • Japan — Operates “soft-law” guidance (AI Guidelines for Business, 2024; updated thereafter). In May 2025 Japan approved an AI Promotion Act focused on coordination and R&D; compliance is driven via guidelines and existing laws (e.g., privacy, consumer).
  • South Korea — Passed the AI Basic/Framework Act (promulgated 21 Jan 2025; effective Jan 2026). Establishes national governance, trustworthiness requirements and enables future rules; extra-territorial effects likely for some activities.
  • Singapore — Leading with Model AI Governance Framework (GenAI) and the open-source AI Verify testing toolkit. Often used as a practical implementation benchmark, interoperable with NIST AI RMF.

Why this matters for Australian businesses

  • Export exposure: Selling AI products/services into the EU, UK or Korea may trigger local provider/deployer duties even if you’re based in Australia.
  • Procurement pressure: Multinationals will increasingly require AI risk assessments, bias testing, and documentation aligned to EU/US frameworks (EU AI Act, NIST AI RMF, ISO/IEC 42001).
  • Interoperability benefits: Adopting risk-based governance now reduces later retrofit costs and smooths compliance across markets.

Jurisdiction Guides

European Union (EU)

Status & scope: The EU AI Act (Regulation (EU) 2024/1689) is live with a risk-tiered regime (prohibited, high, limited, minimal), dedicated GPAI obligations, and strong enforcement (up to 7% global turnover). Key dates: 2 Feb 2025 (prohibitions), 2 Aug 2025 (GPAI, governance/penalties), from Aug 2026–27 (most high-risk rules).
What to do:

  • Map any EU-facing AI systems to risk categories; identify if you’re a provider, deployer, importer or distributor.
  • For GPAI/models, prepare training-data summaries, technical documentation, and risk-mitigation processes (red-teaming, incident reporting).

United States (US)

Status & scope: No omnibus federal AI law. Federal levers include NIST AI RMF 1.0 (widely adopted) and OMB M-24-10 (governance for US federal agencies). States and cities are active: Colorado SB24-205 (effective 1 Feb 2026) mandates risk management programs, impact assessments, consumer notices and appeal/human review for “high-risk” AI; NYC Local Law 144 requires bias audits and notices for automated hiring tools.
What to do:

  • Align your program to NIST AI RMF (often accepted as a defence/interoperability baseline, including in Colorado’s framework).
  • If serving US customers/employers, build impact assessment and bias-audit capability into your lifecycle.

Canada

Status & scope: The federal AIDA (within Bill C-27) did not pass before the previous session ended; status is uncertain as of Aug 2025. Government materials outline a risk-based regime for “high-impact” systems if/when re-introduced.
What to do: Monitor re-introduction; use AIDA’s companion guidance as design input for governance (impact assessments, incident reporting) to future-proof.

United Kingdom (UK)

Status & scope: No single AI Act; the UK follows a contextual, regulator-led approach under the Government Response (Feb 2024) to its AI White Paper. Central functions coordinate regulators; the UK AI Safety Institute evaluates advanced systems and supports guidance/testing.
What to do: Track sector regulators (ICO, CMA, FCA, MHRA etc.). Expect assurance, transparency, and evaluation asks for frontier/GPAI uses.

Japan

Status & scope: Japan emphasises soft-law via the AI Guidelines for Business (2024, METI/MIC), updated subsequently; in May 2025 Parliament approved an AI Promotion Act to coordinate policy and R&D (not a prescriptive compliance code).
What to do: Apply the Guidelines lifecycle controls (risk identification, governance, transparency) and ensure compliance with APPI and sector rules.

Republic of Korea (South Korea)

Status & scope: AI Basic/Framework Act passed 26 Dec 2024, promulgated 21 Jan 2025, effective Jan 2026. Creates national governance (AI committee, safety institute), a trustworthiness baseline, and foundation for detailed rules; extra-territorial reach is anticipated in some areas.
What to do: If offering AI into Korea, prepare for registration/notice, risk management, and safety/trust controls as implementing measures roll out.

Singapore

Status & scope: Model AI Governance Framework (GenAI) and the AI Verify testing toolkit provide practical, testable governance guidance; mapped to NIST AI RMF for interoperability. Frequently used by multinationals for assurance.
What to do: Use AI Verify (or equivalent) for bias, robustness, transparency testing and publish assurance artefacts for enterprise buyers.

Side-by-Side Summary

Jurisdiction Legal posture (Aug 2025) Primary instruments Key dates Headline obligations (examples)
EU Binding, phased EU AI Act Feb 2025 (bans); Aug 2025 (GPAI); 2026–27 (high-risk) Risk-tiered duties, GPAI transparency/docs, post-market monitoring, penalties up to 7% turnover
US Patchwork + federal guidance NIST AI RMF; OMB M-24-10; Colorado AI Act; NYC AEDT law CO: 1 Feb 2026; NYC AEDT: in force Risk programs, impact assessments, notices, bias audits (hiring), consumer appeal/human review
Canada Proposed (not enacted) AIDA (Bill C-27) + companion doc Status uncertain Anticipated risk-based regime for “high-impact” systems; monitor for re-intro
UK Regulator-led framework Gov’t Response (Feb 2024); AI Safety Institute Ongoing Sector regulators issue guidance; evaluation & assurance focus (frontier/GPAI)
Japan Soft-law + promotion act AI Guidelines for Business; AI Promotion Act (2025) Guidelines ongoing; Act passed May 2025 Lifecycle governance guidance; coordination/R&D focus under Act
Korea Binding (framework) AI Basic/Framework Act Effective Jan 2026 National governance; trust/safety foundations; further rules expected
Singapore Voluntary but influential Model AI Governance (GenAI); AI Verify 2024– Testing toolkit + governance guidance; NIST RMF cross-walk

Global Reference Frameworks (useful everywhere)

  • NIST AI Risk Management Framework 1.0 — broad, practical, and widely referenced (US and beyond).
  • ISO/IEC 42001:2023 — AI management system standard (AIMS) for organisations building/using AI.
  • OECD AI Principles — internationally endorsed principles aligned with human-centred, trustworthy AI.

This page should be read together with our governance tools:

Key References

  • EU AI Act timelines & GPAI guidance: European Commission / EU AI Office
  • US: NIST AI RMF 1.0; OMB M-24-10; Colorado SB24-205; NYC Local Law 144
  • Canada: LEGISinfo status for Bill C-27; ISED AIDA companion docs
  • UK: Government Response (Feb 2024); UK AI Safety Institute
  • Japan: METI/MIC AI Guidelines for Business; Japan AI Promotion Act overview
  • South Korea: MSIT press release; AI Basic Act analysis
  • Singapore: IMDA Model AI Governance (GenAI); AI Verify toolkit
  • Standards/Principles: ISO/IEC 42001; OECD AI Principles