AI Compliance for Australian Businesses

1. Why This Matters Now

AI voice and messaging agents are cheap enough that a small business can deploy one in a week. That’s the good news. The complication is that the moment you do, you inherit a stack of obligations that were written for telemarketers, call centres, and data controllers — and they apply whether or not you thought of yourself as any of those things.

None of this is a reason not to build. Every requirement in this paper is satisfiable, and most of it is a one-time configuration decision rather than an ongoing burden. But the penalties are not small-business-sized: contraventions of the Do Not Call Register Act have attracted penalties in the hundreds of thousands of dollars, and serious Spam Act breaches are measured in the millions per day. It’s much cheaper to design for compliance than to retrofit it.

The practical framing we use with clients: compliance is mostly about three things — being honest about what you are, being careful about who you contact and when, and being deliberate about what you do with the data afterwards.

2. Inbound vs Outbound: The Split That Determines Everything

Before anything else, work out which side of this line you’re on. An AI receptionist answering calls has a materially lighter obligation set than an agent that dials out, and conflating the two is the most common mistake we see.

3. AI Disclosure

There is currently no single federal statute that says “you must tell people they’re speaking to an AI”. That does not make it optional.

The exposure runs through the Australian Consumer Law (Competition and Consumer Act 2010), which prohibits misleading or deceptive conduct. If a customer reasonably believes they were talking to a human employee and they weren’t, that is the shape of a misleading-conduct problem — and the ACCC has publicly flagged AI-enabled deception as an enforcement focus. Separately, the direction of Australian AI policy — the Voluntary AI Safety Standard and the consultation on mandatory guardrails for high-risk AI — is firmly toward transparency obligations becoming explicit.

Our position for every deployment: disclose in the first sentence, combine it with the recording disclosure, and keep it conversational rather than legalistic.

4. Call Recording by State

Most AI voice platforms record every call by default — recordings and transcripts are how the system works. Recording consent, however, is governed by state and territory surveillance and listening device laws, and they don’t agree with each other.

Victoria, Tasmania and the ACT require all-party consent to record a private conversation. You cannot know where an inbound caller is physically located, and outbound lists routinely span states. The only workable rule is therefore to comply with the strictest standard on every call: disclose the recording up front and treat the person continuing the conversation as consent.

5. The Do Not Call Register

The Do Not Call Register Act 2006 (Cth), administered by ACMA, prohibits telemarketing calls to numbers on the register unless an exemption or consent applies. Penalties for contravention run into the hundreds of thousands of dollars.

Two distinctions do most of the work here. First, the Act is concerned with telemarketing— calls that offer, advertise or promote goods, services, land, or business opportunities. A call to an existing customer about a debt they owe you, or a service appointment they’ve booked, is not marketing. A win-back campaign or a “we’ve got a special on” call is.

Second, consent — which may in some circumstances be inferred from an existing business relationship — permits calls that would otherwise be prohibited. That inference is narrower than most businesses assume and depends on the specifics of the relationship and how recent it is. Don’t rely on it for an old list without confirming your position.

6. Calling Hours & Caller ID

Permitted contact times for telemarketing and research calls are set by industry standard, and they run on the recipient’slocal time — which for a business calling nationally means the scheduler has to be timezone-aware, including the states that don’t observe daylight saving.

7. SMS and the Spam Act

Almost every AI voice deployment sends messages too — confirmations, payment links, follow-ups. The Spam Act 2003 (Cth) governs commercial electronic messages and imposes three requirements that are simple to meet and expensive to miss. Serious breaches have attracted penalties in the millions of dollars per day.

The boundary between transactional and commercial is less obvious than it looks, and getting it wrong is asymmetric — including sender ID and an opt-out on a transactional message costs you nothing. Default to including both.

8. Privacy Act & the Australian Privacy Principles

The Privacy Act 1988 (Cth) and the Australian Privacy Principles govern what you collect, why, and what happens to it. The Act has historically applied to organisations above a $3 million turnover threshold, with various exceptions — but the reform program has been moving toward broader coverage, so a small business planning to hold call recordings and customer conversation data should design to the APPs regardless.

9. Offshore Data & Retention

Most AI voice platforms are United States companies running on United States infrastructure. Recordings, transcripts, and structured outputs transit and are stored offshore. That’s workable, but it’s not something to discover after launch.

A workable retention policy

10. Pre-Launch Checklist

Both of our own products — Office Voice and workmylist — ship with this list built in rather than bolted on, because retrofitting compliance into a live calling system is genuinely painful. If you’re building your own, work through the checklist before your first real call, not after.