The Compliance Cliff
The Compliance Cliff is Naveniem's verified timeline of AI and automated-decision-making obligations binding Australian organisations between 2024 and December 2026 — spanning NSW Government, APRA-regulated entities, Commonwealth agencies, and any organisation using AI or automated logic to make or support decisions about people. Every date is sourced to a primary regulator.
Verified Timeline
Sourced to the regulator or the enacting instrument — not summarised into ambiguity. If your organisation matches a "who" column below, at least one obligation applies to you.
Mandatory alongside the NSW AI Ethics Policy for all NSW Government agencies.
Effective 1 July 2025; pre-existing material-service-provider contracts must comply by 1 July 2026.
Effective 15 December 2025; first mandatory requirement binds 15 June 2026; remaining requirements bind December 2026.
Three subclauses — APP 1.7, 1.8 and 1.9, never "APP 1.7" alone. APP entities whose computer programs make, or substantially assist in making, decisions that could reasonably be expected to significantly affect an individual's rights or interests must disclose this in their privacy policy.
A$2.5M penalty plus A$500K costs under s912A — the first significant enforcement signal in this space.
By Audience
The AI Assessment Framework is already mandatory. If you haven't run an assessment against it, that's the immediate gap — not a future one.
Talk to us about an assessment →CPS 230 is in force. If AI vendors underpin a critical operation, treat them as material service providers now — contracts must comply by 1 July 2026.
Talk to us about CPS 230 gaps →The DTA's first mandatory requirement binds June 2026, with the rest landing by December 2026. Sequencing matters — leaving it to Q4 2026 is a compressed timeline.
Talk to us about the DTA timeline →If a system you run makes or substantially assists a decision about a person — credit, eligibility, pricing, hiring — the ADM transparency obligation likely applies from 10 December 2026, whether or not you call it "AI".
Talk to us about ADM exposure →Frequently Asked
It's Naveniem's verified timeline of AI and automated-decision-making obligations binding Australian organisations between 2024 and December 2026, sourced to the responsible regulator for each obligation.
It's shorthand for three subclauses of Australian Privacy Principle 1 — never just "APP 1.7" alone — commencing 10 December 2026, requiring APP entities to disclose in their privacy policy when a computer program makes or substantially assists a decision significantly affecting an individual.
Potentially yes — the Privacy Act ADM transparency obligation captures rule-based automated logic as well as AI, not just machine-learning systems.
Verified July 2026, reviewed quarterly.