AI and technology

Although the legislative framework to be adopted for the introduction of the mandatory guardrails and the timing of its introduction are not yet clear, submissions by the key regulators on the Mandatory Guardrails Proposals Paper have indicated broad support for new framework legislation and associated amendments to existing legislation.⁹

We expect regulators will, in the interim, look to the Voluntary Standard when enforcing existing regulatory regimes in connection with AI harms. Public statements by regulators also indicate a focus on:¹⁰

• Consumer protection (including fake reviews and scams, product safety, misleading and deceptive conduct, unfair trading practices, credit scoring, price optimisation and discrimination. The Australian Treasury has indicated that new and targeted consumer protections to prohibit false and misleading representations to consumers in relation to AI may be introduced¹¹);
• Market risks (machine-learning based trading algorithms, and collusive autonomous pricing models);
• Competition (use of AI in digital platform services and algorithmic collusion);
• Privacy (the first tranche of reforms to the Privacy Act last year, along with comments by the OAIC, highlight that Australian companies should expect greater scrutiny from the OAIC on AI transparency, data governance processes and controls in connection with AI¹²);
• Online safety (deepfake and exploitation material); and
• Operational resilience (which we expect will be a headline issue in 2025 for APRA-regulated entities developing or deploying generative AI tools, noting the commencement from 1 July 2025 of CPS 230 (Operational Risk Management).

In addition to the Australian enforcement activity identified above, recent enforcement activity in other jurisdictions provides some guidance as to the potential areas of focus for Australian regulators, including:

• 'AI washing'—or misleading or exaggerated statements about the use of AI in a company's products or services. Both the US Securities and Exchange Commission (SEC)¹³ and the Federal Trade Commission (FTC)¹⁴ have been focused on this conduct, and ASIC's Chair, Joe Longo, referred to these cases in a recent speech, noting '[t]his is a serious emerging issue and all Australian companies should be on notice that ASIC is on the lookout for this conduct here'.¹⁵
• Misuse of personal and sensitive data—the UK Information Commissioner's Office has been focused on data misuse, including in relation to generative AI chatbots¹⁶ and FRT,¹⁷ and has issued enforcement notices and fines, and required companies to carry out revised data protection impact assessments. The FTC has also been focused on the extraction and mishandling of sensitive personal data,¹⁸ and its actions also continue a trend in its enforcement activity of relying on 'algorithmic disgorgement' as a remedy—the deletion of data that was processed unfairly, and any AI models or algorithms associated with that data.¹⁹
• Deceptive and unfair practices—as part of its 'Operation AI Comply', the FTC has announced five separate enforcement actions against entities that are alleged to have used AI technology in deceptive or unfair ways, including promoting fake reviews, selling 'AI Lawyer' services and claiming they could help consumers make money through online storefronts.²⁰ Regulators in the UK²¹ and US²² have also made public statements indicating their focus on the use of pricing algorithms.
• Compliance guidance—the US Department of Justice recently updated its Evaluation of Corporate Compliance Programs (ECCP) to address risks related to AI.²³ The ECCP is used by prosecutors to assess corporate compliance programs, and prosecutors will now closely consider the nature of the risk assessments, risk management strategies, controls and ongoing monitoring processes implemented by companies with respect to AI.