AI standards increasingly a ‘yardstick’ for assessing Australian legal liability

Even while voluntary, recognised AI frameworks and standards may increasingly inform assessments of whether organisations and their executives and boards have taken reasonable steps to govern AI-related risks.

Courts, regulators, insurers and customers already assess organisational conduct through concepts such as reasonableness, due care and adequate risk management. As AI adoption accelerates, technical standards and governance frameworks, including the federal government's voluntary AI safety standard, are likely to become increasingly important reference points when assessing whether organisations have met those obligations.

There are already examples of Australian regulators using industry standards as benchmarks for assessing reasonable conduct. In its statement relating to Australian Clinical Labs' breach of APP 11.1, the Office of the Australian Information Commissioner (OAIC) referred to various cybersecurity frameworks and standards, including the Australian Cyber Security Centre's essential eight, the US National Institute of Standards and Technology's cybersecurity framework and the ISO 27000 series as benchmarks to support compliance with the data protection obligations under Australian Privacy Principle (APP) 11.1 and whether reasonable steps had been taken.

The Australian Securities and Investments Commission (ASIC) has demonstrated a willingness to treat recognised technology standards and frameworks as indicators of reasonable risk management. For example, following the Federal Court's 2022 decision against RI Advice Group Pty Ltd for failing to maintain adequate cyber risk management systems and thereby breaching its obligations as an Australian Financial Services Licensee, ASIC publicly encouraged organisations to refer to the Australian Cyber Security Centre's essential eight mitigation strategies as a means of strengthening cyber resilience.

This suggests that regulators will look to established cybersecurity frameworks when assessing whether an organisation has taken reasonable steps to manage cyber risk.

The same approach is also likely to emerge in relation to AI. In a letter to industry on 30 April 2025, the Australian Prudential Regulation Authority (APRA) said it expects regulated entities, at a minimum, to employ "globally recognised control frameworks including control libraries, and change control for AI implementations". While courts have not yet considered AI standards in this context, it is likely that AI standards will increasingly be relied upon as evidence of the applicable standard of care in regulatory proceedings or private claims.

These developments are particularly relevant to directors' duties. Section 180(1) of the Corporations Act 2001 (Cth) requires directors to exercise their powers and discharge their duties with the degree of care and diligence that a reasonable person would exercise in the same circumstances. Breaches can result in civil penalties, disqualification orders and compensation orders.

In practice, this means standards, including voluntary ones, are likely to become important benchmarks when regulators and courts assess whether organisations and their boards have taken reasonable steps to identify and manage AI risks.

Regulators and courts recognise that AI-related harms cannot be eliminated entirely. The relevant question is usually not whether a risk materialised but whether reasonable steps were taken to identify, assess and manage that risk in the circumstances. What is reasonable will depend on factors such as the organisation's industry, size, resources, technical capabilities, risk profile and operational complexity.

A useful way to assess AI governance is to consider the following areas:

Accountability

Organisations should identify who is responsible for managing AI risks and ensure those individuals have the authority, expertise and resources needed to perform that role. Responsibility should be clear and should not be fragmented in a way that creates gaps in oversight or accountability.

Knowledge and capability

Organisations need sufficient expertise to identify, assess and manage AI risks. This includes understanding the extent of any unauthorised use of AI tools, legacy technology risks, data vulnerabilities and potential cyber exposures.

Technical expertise alone is not enough. Employees should understand the organisation's policies, risk appetite and acceptable-use requirements. Where capability gaps exist, organisations should consider obtaining specialist external advice and providing ongoing training.

Risk identification and assessment

Risks should be identified, documented, prioritised and reviewed regularly. Assessment should extend beyond technical vulnerabilities and should consider legal, operational, financial, reputational and ethical risks. For AI systems, organisations should consider reliability, bias, explainability, intellectual property, data provenance and privacy impacts. Risk assessments should be refreshed periodically and whenever there are material changes to technology, business operations or the regulatory environment.

Systems, controls and governance

Organisations should maintain controls that are appropriate to their risk profile and available resources.

This includes technical safeguards as well as governance measures such as policies, procedures and approval processes. Risk management requirements should also be reflected in procurement activities, supplier arrangements and other third-party relationships.

Resourcing

Investment in AI risk management should be proportionate to the likelihood and consequences of identified risks. Staffing, budgets and management attention should align with the organisation's stated risk appetite. Significant mismatches may be difficult to justify during regulatory investigations or litigation.

Third-party risk management

Many organisations' most significant vulnerabilities arise through suppliers and service providers.

Effective governance requires due diligence, appropriate contractual protections and ongoing monitoring. Organisations should also consider whether suppliers' AI practices and controls align with their own requirements.

Monitoring, testing and assurance

Controls should be tested regularly to ensure they work in practice. This may involve audits, penetration testing, vulnerability assessments, tabletop exercises, AI model validation and independent assurance reviews. Governance arrangements are only effective if they operate in practice rather than merely existing on paper.

Incident response and resilience

No control environment can eliminate every risk. The key question is how effectively an organisation can respond when incidents occur. Incident response, crisis management and business continuity plans should be maintained and tested regularly. Decision-making authority, escalation pathways and regulatory notification processes should be clearly defined.

Continuous improvement

AI technologies and regulatory expectations continue to evolve rapidly.

Governance frameworks should therefore be reviewed and updated regularly. Organisations should monitor emerging risks, legal developments, industry standards and regulatory guidance and adjust their controls accordingly.

AI and digital systems now underpin critical business operations, customer interactions and strategic decision-making. As a result, AI can no longer be treated solely as a technical matter for IT teams.

Takeaways

Boards and senior executives are expected to understand the risks that can arise from the technologies on which their organisations depend and to exercise informed oversight of those risks. Accountability for governance cannot be delegated.

Regulators, shareholders, customers and courts are increasingly likely to judge leaders not by whether an incident occurred, but by whether they understood the risks, implemented appropriate controls and maintained effective oversight. Standards issued by regulators, governments and recognised industry bodies are likely to play an increasingly important role in defining what those reasonable steps look like.

Failures in AI governance can have consequences far beyond regulatory enforcement. They can damage reputation, undermine customer trust, disrupt operations and generate significant financial losses. In an environment where technology risk is business risk, effective governance is a core component of organisational resilience and long-term value creation.

Over time, adherence to AI standards is likely to become an important indicator of whether an organisation has acted reasonably and fulfilled its legal obligations. Failure to do so could create not only immediate legal risks but also longer-term consequences for reputation, stakeholder confidence and an organisation's social licence to operate.

Co-written by Amy Atkinson of Pinsent Masons.