Australia’s AI policy framework is now reasonably mature on paper. The voluntary AI safety standards, the proposed mandatory guardrails for high-risk uses, the AI Ethics Principles, the Privacy Act amendments, and the various sector-specific regulator positions all add up to a credible policy stack.

The implementation gap is wide.

Where the gap shows up

Three categories. The first is interpretation. The standards and principles are general enough that two reasonable people read them differently. Without clear guidance on how to comply, organisations are making conservative decisions that may go further than the policy intends, or aggressive decisions that test the policy boundaries.

The second is capability. Most Australian organisations do not have the internal AI governance expertise to apply the frameworks well. The pool of qualified people is small and the demand is large.

The third is enforcement. The regulators have positions but limited enforcement experience in the AI space. Until there are precedent-setting cases, organisations are working in a fog.

What is happening operationally

Larger enterprises with formal compliance functions are over-engineering their governance. The result is slow AI deployment and risk-averse decisions that probably exceed what the policy actually requires.

Smaller organisations are under-engineering their governance. The result is faster deployment with risk exposure they may not understand.

Neither group is doing what good policy would produce, which is proportionate risk management calibrated to the actual use case.

What would close the gap

Plain-English implementation guidance from the regulators. More clarity on what constitutes high-risk under the proposed mandatory framework. Practical case studies of compliant deployments at different organisation sizes.

For organisations sitting in the middle of this, AI governance consultants who have worked across multiple sectors are the most useful conversation. The framework knowledge is now table stakes. The judgement about proportionate application to a specific business is the value.

The next twelve months will see the first enforcement actions and the first formal guidance documents. Until then, the implementation gap is real and organisations are navigating it without much help.