In September 2024, the Australian Government published the Voluntary AI Safety Standard through the Department of Industry, Science and Resources. It sets out ten practical guardrails for any organisation that develops or deploys artificial intelligence. The word worth noticing is voluntary: none of this is law yet. But the standard is the clearest signal so far of what Australian regulators will expect once mandatory rules arrive for high-risk AI. If your business already runs Claude or another AI system, treating these guardrails as your baseline now is far cheaper than retrofitting them later.
This guide walks through what the standard covers, what each guardrail means in ordinary language, and the handful of steps a Sydney or Melbourne business can take this quarter to get ahead of it.
What the standard is, and what it is not
The Voluntary AI Safety Standard is guidance, not legislation. It was written to sit alongside a proposed set of mandatory guardrails for AI used in high-risk settings, which the government consulted on separately. The voluntary version applies to any organisation using AI, from a two-person firm running a customer-service assistant to a bank scoring loan applications. It draws on international frameworks, including the ISO/IEC 42001 AI management system standard and the work of the OECD, so adopting it also moves you closer to global expectations.
There is a real cost to ignoring it. A single AI decision that goes wrong, such as an automated rejection that later proves discriminatory, can cost a mid-sized Australian firm well beyond $45,000 once you add remediation, legal advice, and the slower damage to customer trust. For a regulated business the figure climbs quickly. The guardrails exist to make those failures far less likely.
The ten guardrails in plain English
The standard groups its expectations into ten guardrails. Stripped of the policy language, they say this:
Accountability. Name who owns AI in your organisation, write down how you govern it, and build the internal skills to do that job.
Risk management. Run a process that finds the ways your AI could cause harm, and act to reduce those risks before deployment.
Data governance. Protect your AI systems and manage the quality and origin of the data that feeds them.
Testing. Evaluate how a model performs before you rely on it, and keep monitoring it once it is live.
Human oversight. Keep a person able to step in, override, or switch off the system when it matters.
Transparency with users. Tell people when they are dealing with AI, when a decision was AI-assisted, and when content was AI-generated.
The right to challenge. Give the people affected by an AI decision a clear way to question or contest it.
Supply-chain transparency. Be open with the organisations you work with about the data, models and systems involved, so they can manage their own risks.
Record-keeping. Keep enough documentation that a third party could check whether you are meeting these guardrails.
Stakeholder engagement. Understand the needs of the people your AI affects, with real attention to safety, fairness, inclusion and diversity.
What this means if you run Claude
Most of these guardrails are process, not technology. Claude gives you a head start on several of them, but the accountability sits with your business, not the model. A few practical translations:
Human oversight is simple when Claude drafts rather than decides. Keep a person approving anything customer-facing, financial, or legal, and you meet guardrail five by design.
Transparency is a labelling habit. Add a short line telling customers when they are talking to an AI assistant or reading AI-drafted content.
Record-keeping means logging your prompts, the model version, and who reviewed the output. This is the evidence a regulator or auditor will ask for.
Testing means checking Claude's output against real cases before you trust it in production, and spot-checking it afterwards.
None of this needs a large budget. A first pass at all ten guardrails for a small firm is usually a matter of writing three or four short documents and changing a few habits, not buying new software.
Where to start this quarter
Pick the two guardrails with the most exposure for your business, usually accountability and human oversight, and document them first. Name an owner. Write a one-page AI policy that says which tools are approved, what they may and may not be used for, and who signs off on customer-facing output. Then work through the rest over the following months. When the mandatory guardrails do arrive, high-risk deployers will have a firm deadline, and the businesses that started early will simply be ready.
The Voluntary AI Safety Standard is less a compliance burden than a checklist for using AI without nasty surprises. If you would like help turning these ten guardrails into a practical policy for your business, book a short call and we will map out where you stand and what to fix first.
