EU AI Act — Regulation (EU) 2024/1689 the comparator instrument for Australian AI governance

Why it matters for NETEVO

The EU AI Act — Regulation (EU) 2024/1689 — is the European Union's first horizontal AI regulation and the instrument every Australian AI governance discussion now refers to. It sets harmonised rules on AI systems, classifies them by risk (unacceptable / high-risk / limited-risk / minimal-risk), and imposes provider, deployer, importer, and distributor obligations across the AI value chain. Three operational consequences follow.

Art. 27 FRIA is the international convergence template. The Fundamental Rights Impact Assessment that Art. 27 establishes for high-risk AI in specified deployer categories is the instrument towards which Australian Privacy Act 1988 (Cth) PIAs, OAIC AI ethics-framework workflows, and the DISR Mandatory Guardrails impact-assessment guardrail most plausibly converge. An AI system impact assessment built on ISO/IEC 42005 already satisfies the FRIA structurally, so an Australian organisation converging on the international template does not need to maintain a parallel EU assessment alongside its domestic one.

Brussels-effect direct binding for Australian entities with EU reach. Under Art. 2, Australian entities offering AI systems or outputs into the EU market, or to EU persons, are directly bound by the Regulation. An Australian organisation with EU operations, EU subsidiaries, or EU customers therefore operates against the EU AI Act in addition to Australian instruments. Cross-walked against the corresponding Australian instruments, the two regimes can be satisfied by one engineered control set, evidenced once, rather than by a duplicate compliance stack.

Definitional alignment with ISO/IEC 22989. Art. 3(1) defines AI system in close alignment with the OECD definition that ISO/IEC 22989 also imports. That alignment is the operational basis for treating the ISO/IEC family as a single control foundation capable of satisfying both EU and Australian regimes. The Regulation accordingly operates in two distinct capacities: as a cross-jurisdictional benchmark for organisations with no EU exposure, and as a directly binding obligation for those within its Art. 2 reach.