In the format your office already uses: key messages and possible questions

Key messages

• The Standards will require what every review since Robodebt has recommended: every determination has an author, and the record shows who.
• We are regulating the mechanism, not the marketing. Obligations attach to defined, testable terms - not to a buzzword.
• Nothing here is new machinery. The Consumer Data Right already runs consented, revocable data sharing; the Digital ID Act already runs verifiable credentials; collecting societies already run collective licensing. The Standards connect what parliament has already built.
• Certainty is what the framework provides. Certainty about weaker rules is a different product, and it is not for sale.
• The consultation will publish all submissions, log meetings, and attribute adopted text to its source. A government confident of its position has no reason to do less.
• Some of the machinery should stay open. Where the reference implementation is open source, anyone can inspect it, run it and improve it - so no single vendor owns the definition of compliance, and there is nowhere quiet for the rules to drift toward whoever lobbies hardest.

Possible questions and answers

Q: Industry says this framework is research-grade technology being written into law. A: The Standards require properties, not products - that provenance be verifiable, that revocation actually stop use. Conformity recognises a maturity ladder, with documentary records as today's floor and verified implementations as the tooling matures. The destination is named; the road is not mandated.

Q: Won't a consent regime for data cut across the Privacy Act reforms? A: It completes them. The Privacy Act's automated decision-making transparency obligations commence in December; the Standards specify what a well-formed consent record contains - who, what, purpose, duration, revocation. No new rights are created; existing consents become inspectable.

Q: How can citizens hold revocation rights without breaking tax, courts and policing? A: They don't hold them there, and the design says so. Consensual services carry an enforceable veto. Coercive functions carry due process instead: compelled access must be warranted, scoped and logged, so abuse is provable afterwards. Agencies gain the ability to demonstrate they acted lawfully - something they cannot cleanly do today.

Q: Isn't a "never automate" list either unworkable or a chill on innovation? A: The list is drawn by decision type, not technology, and it is short: liberty, the use of force, the exercise of mercy, the framing of law. Parliament already accepts some decisions are non-delegable. The list sits in a reviewable instrument with a statutory floor.

Q: What about the compliance burden on small business? A: Under auditor-and-paperwork conformity, the burden is real, recurring and regressive - which is why these Standards move toward machine-verifiable conformity with an open reference implementation, making compliance the cheap path. The organisations with most to fear are those whose compliance currently exists only on paper.

Q: Why does it matter whether parts of this are open source? A: Open components are the difference between a standard the public can verify and one a few firms privately own. When the code that demonstrates compliance is open, a competitor, a regulator, a researcher or a citizen can each check that it does what it claims - and improve it. That is the quiet safeguard against a framework being shaped, over time, to suit whoever has the most lawyers in the room. It is not an anti-business position; it keeps the market for compliance competitive rather than closing it around an incumbent.

Q: Large investors say they need regulatory certainty before committing. A: They have it. The Data Centre Expectations were published in March; the Standards give them force. What is sometimes meant by certainty is an assurance of weaker rules, and that assurance will not be given by this government.

Q: The Opposition says the Office of AI is just more bureaucracy. A: The alternative to coordination is what we had: eleven frameworks, none binding, drafted separately. One office, one set of standards, existing regulators enforcing in their own sectors - that is less bureaucracy with more effect.

Prepared openly by Meanwhile (meanwhile.computer), with model assistance, read and edited by its human author. Every answer above has a longer, sourced version on the linked hub. If an answer is wrong, the contact page reaches the person who will fix it.

Reviewed and checked by the human author: 2026-07-20.