The Voluntary AI Safety Standard (VAISS) is no longer Australia's headline guidance. For anyone building or customising AI, the working reference is now the Guidance for AI Adoption (Implementation version), with VAISS's ten guardrails kept as a detailed mapping tool. The only firm legal date is 10 December 2026.
Is the Voluntary AI Safety Standard still the current standard?
Not in the way it was in 2024. The Department of Industry, Science and Resources (DISR) published the Guidance for AI Adoption (often shortened to AI6) on 21 October 2025. It sets out six essential practices for responsible AI governance and adoption.
Some commentators say AI6 replaces VAISS. The sources aren't settled on that. One lists the VAISS page as updated on 2 December 2025, and SafeAI-Aus notes that industry.gov.au doesn't publish a separate VAISS v2.
So the safest framing is this: aligned with AI6 (Implementation), mapped to the VAISS guardrails. Don't write "we comply with the current VAISS" into a proposal or policy.
Which version of the guidance applies to custom AI builders?
AI6 comes in two versions:
- Foundations: for organisations starting out, or using AI in lower-risk ways.
- Implementation: for organisations building or customising AI, or needing stronger controls.
If you're commissioning or developing a bespoke tool, you sit under Implementation. That includes a tool that triages enquiries, scores applications, summarises case files or flags learners at risk.
The ten VAISS guardrails still earn their place here. They carry more detail on testing, supply-chain transparency and record-keeping than a six-practice summary can.
Does "voluntary" mean no legal duties?
No. The National AI Plan (2 December 2025) confirmed Australia will rely on existing laws and sector regulators, backed by voluntary guidance and the Australian AI Safety Institute. There will be no standalone AI Act, and the proposed mandatory guardrails were effectively shelved.
That doesn't mean a free pass. Binding duties still come from laws already on the books:
- the Privacy Act
- the Australian Consumer Law
- anti-discrimination law
In practice, VAISS and AI6 are how you show you're managing the risks those laws already create. Think of them as evidence of diligence, not a substitute for compliance.
What is the one firm deadline?
The Privacy Act's automated decision-making (ADM) transparency obligations commence on 10 December 2026. One developer commentary on dev.to calls them the one Australian AI obligation that truly binds, with a fixed date and civil penalties.
They matter most for custom tools that make, or support, decisions about individuals. Eligibility checks, risk scoring and automated recommendations all deserve a hard look.
A caution: the exact scope hasn't been verified against Office of the Australian Information Commissioner (OAIC) guidance in this research. Read the OAIC material before you decide a tool is in or out.
Will new standards legislation catch custom tools?
Probably not directly. The planned standards legislation targets large data centres and frontier AI training, not AI use in general.
According to the research brief, National Cabinet agreed on 26 August 2026 to develop nationally consistent mandatory standards for large data centres. The Commonwealth intends to legislate in early 2027, and consultation closed on 9 October 2026. Media reports suggest serious AI incident reporting to the affected organisation and the Australian Signals Directorate. SafeAI-Aus is clear that the announcement doesn't withdraw VAISS or make its guardrails mandatory.
Most custom builders won't be covered. But if your tool runs on a covered supplier's infrastructure, expect questions flowing down the supply chain.
What might the Joint Select Committee change?
Early advice from the Joint Select Committee (12–13 October 2026, as reported by SafeAI-Aus citing ABC News and Capital Brief) touched on a risk-based framework, incident reporting, data sovereignty, AI literacy and procurement. Whether expectations will reach organisations that *deploy* AI is still open. The full report is due on 30 November 2026.
What does government-facing work add?
The Digital Transformation Agency's (DTA) first mandatory requirements took effect on 15 June 2026, with the rest following in December 2026. They bind only Commonwealth agencies. But they show where procurement expectations are heading, and anyone selling into government will feel that.
What should custom AI builders put in place now?
The practical deliverables that map to AI6 and the VAISS guardrails are not exotic. Build them into the project, not onto the end of it:
- An AI register listing each tool, its purpose and its data.
- An impact assessment covering who the tool affects and how.
- A named accountable owner for each system.
- A testing and monitoring plan that continues after launch.
- Human override so a person can step in and reverse an output.
- User disclosure so people know when AI is involved.
- A challenge or redress path for anyone affected by an outcome.
If a tool supports decisions about individuals, add one more step: check it against the ADM transparency obligations before 10 December 2026.
A note on the evidence
Much of the recent detail here comes from secondary commentary, not primary documents. Verify against DISR's Guidance for AI Adoption and OAIC guidance before you rely on any date or scope in a contract or policy.
Key takeaways
- Frame your approach as aligned with AI6 (Implementation) and mapped to the VAISS guardrails, not "VAISS is the current standard".
- There's no standalone AI Act. Privacy, consumer and anti-discrimination law remain the source of binding duties.
- The Privacy Act ADM transparency obligations commence on 10 December 2026. Check scope against OAIC guidance.
- Planned standards legislation targets large data centres and frontier AI, so most custom builders feel it only indirectly.
- An AI register, impact assessment, accountable owner, monitoring plan, human override, disclosure and redress path cover most of what the guidance asks.
Our take
The "voluntary" label is the most misleading word in this whole story. It tells teams to wait, when the Privacy Act clock is already running and procurement expectations are tightening. We'd treat AI6 (Implementation) as the design brief for any custom tool, and use the guardrails as the checklist underneath it. For training organisations, including RTOs weighing tools near assessment or learner decisions, that's cheaper than retrofitting governance after launch. It also means the question "who owns this tool's decisions?" gets answered at kickoff, not during an audit.
If you're scoping a custom build this quarter, it's worth asking: could we show our register, our owner and our override path tomorrow?
FAQ
Is the Voluntary AI Safety Standard mandatory in Australia?
No. VAISS is voluntary, and the National AI Plan confirmed there will be no standalone AI Act. But existing laws such as the Privacy Act, Australian Consumer Law and anti-discrimination law still apply to AI use.
Has the Guidance for AI Adoption replaced VAISS?
Commentators often say so, but sources disagree on whether VAISS has been formally withdrawn. The safest approach is to align with the Guidance for AI Adoption (Implementation) and map to the VAISS guardrails for detail.
Which version of the Guidance for AI Adoption suits custom AI builders?
The Implementation version. It's designed for organisations building or customising AI, or needing stronger controls. The Foundations version suits organisations starting out or using AI in lower-risk ways.
What is the firmest AI-related legal deadline for Australian businesses?
The Privacy Act automated decision-making transparency obligations, commencing on 10 December 2026. They matter most for tools that make or support decisions about individuals. Confirm exact scope against OAIC guidance.
Will the data centre and frontier AI standards affect small custom builders?
Mostly indirectly. The planned standards target large data centres and frontier AI training. Custom builders could still face questions or contract changes through their suppliers.