Artificial intelligence is already changing how businesses, government agencies and professionals make decisions, deliver services and manage information.

The legal issue is no longer whether AI will be adopted, but how its use will be governed and where responsibility will lie when it causes harm.

Against that background, the release of the Terms of Reference for Australia’s first Royal Commission into Artificial Intelligence is a significant development.

he Commission, chaired by Dr Iain Ross with Kate Pounder and Professor Christopher Manning, began on 1 October 2026 and must report by 1 July 2027. The inquiry provides South Australia with an opportunity to examine whether existing legal and policy settings are adequate to support innovation while protecting individuals, businesses and the community from foreseeable risks.

AI is not operating in a legal vacuum

Although Australia does not yet have a unified legal framework regulating AI, organisations using these systems are already subject to established legal obligations.

Depending on how the AI tools are used, those obligations may arise under privacy, employment, anti-discrimination, consumer protection, corporations, administrative and common law.

The collection and use of personal information may attract privacy obligations. An AI-assisted decision may also expose an organisation to claims in negligence, questions of procedural fairness or scrutiny of whether directors and officers exercised appropriate oversight.

The use of a third-party platform does not necessarily transfer those risks to the technology provider. Contracts should therefore address data use, confidentiality, security, intellectual property, performance standards, audit rights, warranties, indemnities and responsibility for defective or unlawful outputs.

The regulatory choices before the Commission

The Terms of Reference invite consideration of productivity, innovation, workforce impacts, education, regulation and public services.

For lawyers and their clients, the central questions include whether existing laws are sufficient, whether specific uses of AI require additional safeguards, and how legal responsibility should be allocated among developers, suppliers, deployers and end users.

The Commission may also consider when organisations should be required to disclose the use of AI, undertake risk or impact assessments, retain meaningful human oversight, test systems for bias and reliability, and keep records sufficient to explain consequential decisions.

The scope of the inquiry nevertheless has important legal limits. Matters primarily within Commonwealth responsibility, including national security, cyber security, financial market stability, intellectual property and copyright, are excluded. This raises a practical question about which reforms can be implemented by SA, and which will require national coordination to avoid inconsistent obligations across jurisdictions.

Participating in the inquiry

Businesses, educational institutions, industry bodies and other organisations can provide valuable perspectives about how AI is being deployed, the barriers to responsible adoption and the areas in which the present legal framework creates uncertainty. Submissions grounded in actual use cases, supported by evidence and directed to matters within the Commission’s remit are likely to be the most useful.

Before making a submission, organisations should identify information that is confidential, commercially sensitive, legally privileged or subject to contractual restrictions. The Commission may publish information it obtains, although it may also make orders forbidding publication of specified evidence or of material identifying a witness. Organisations should also ensure that statements about productivity, safety, workforce impacts and system performance can be substantiated.

What organisations should do now

Organisations do not need to wait for the Commission’s final report to review how they use AI and the legal risks that use creates.

In practice, that means listing the AI tools in use or under consideration, assigning a person responsible for each, identifying the laws that apply, reviewing supplier terms and data flows, and introducing approval, testing, human-review and record-keeping controls proportionate to the risk of each use.

Boards and senior management should be able to demonstrate not only that an AI system delivers value, but also that its use is authorised, lawful, appropriately supervised and capable of being explained.

Higher-impact uses will generally warrant more rigorous controls. In ASIC v Bekier [2026] FCA 196, Lee J suggested that it would be prudent for boards to govern any use of AI in preparing and reviewing board materials through formally adopted policies, rather than “just wink at informal ‘shadow’ use”. As his Honour put it, “the use of technology may assist comprehension, but it cannot displace judgment”.

The Royal Commission may influence the future direction of AI policy in South Australia and contribute to the broader national debate. Its work should be closely monitored by organisations that develop, procure or deploy AI, particularly where systems affect employees, customers, citizens or other individuals.