SaaS and product AI governance under the Privacy Act, ACL, and the EU AI Act.

Privacy Act 2024 amendments require disclosure of automated decision-making in privacy policies and product documentation by 10 December 2026. SaaS platforms training models on customer data, using AI in onboarding or pricing, or processing personal information through machine learning pipelines need to explain which decisions use AI and what personal data is processed. Enhanced data governance obligations apply to training data quality and provenance, and significant penalties apply for serious or repeated violations.

The Australian Consumer Law applies strict product liability to businesses manufacturing AI-powered products. The Government is consulting on reforms that could extend liability across the AI supply chain. When an AI system makes a decision that harms a user, accountability structures and risk management controls need to be in place before the harm. Liability questions become harder when multiple parties contribute to an AI solution.

Extraterritorial scope applies to Australian tech businesses whose AI outputs affect EU users. High-risk AI systems require full compliance by August 2026, with penalties up to 7% of global turnover. General-purpose AI model providers must meet transparency and documentation obligations. Risk classification and conformity assessment determine the compliance strategy for any organisation planning to scale in European markets.

Due diligence now includes AI governance questions as standard. VCs review Corporations Act compliance, ACL adherence, privacy controls, and AI risk management. ISO/IEC 42001 is the de facto benchmark for AI management systems and is increasingly required by enterprise procurement. Governance maturity directly influences growth capital decisions and how quickly enterprise deals close.