The Voluntary AI Safety Standard is a zombie
Most Australian AI governance products still sell against VAISS and its ten guardrails. VAISS was never withdrawn — but the standard that 'evolves' it says something different, and the National AI Plan says the word guardrail zero times.
If a vendor pitches you AI governance tooling built around the ten guardrails of the Voluntary AI Safety Standard, they are selling against a document that is technically alive and practically superseded. Both things are true at once, which is exactly why it keeps being sold.
Three documents, one muddle
Sep 2024
Mandatory guardrails proposed
A proposals paper floats mandatory guardrails for AI in high-risk settings. This is the framing most of the market still assumes.
21 Oct 2025
Guidance for AI Adoption published
Six essential practices, described as evolving VAISS. VAISS stays online and is not withdrawn.
2 Dec 2025
National AI Plan published
Abandons mandatory guardrails in favour of a technology-neutral, sectoral-regulator model. Frames this as 'not proceeding at this time' rather than formal repeal.
What the National AI Plan actually commits to
Not guardrails. The plan pushes responsibility down to the regulators who already own each domain:
Agencies and regulators will retain responsibility for identifying, assessing, and addressing potential AI-related harms within their respective policy and regulatory domains.
This is why APRA and ASIC wrote separately to their own populations in 2026 rather than a single central AI regulator issuing one instrument. Under a sectoral model, your AI obligations arrive through your existing regulator, in your existing supervisory relationship.
How to read the stack without getting caught out
Three practical rules:
- Build controls, label them later. The labels are moving faster than the underlying expectations. Contestability is contestability whether it is principle seven or practice four.
- Follow your sectoral regulator first. Under the National AI Plan model, APRA or ASIC or OAIC correspondence outranks a general standard for what you will actually be asked to show.
- Treat "mandatory" as a spectrum. Law in force, mandatory-by-policy-not-law, passed but not yet applicable, draft, and voluntary are five different things. Collapsing them into a boolean is how organisations end up over-building for voluntary standards and under-building for the Privacy Act reforms.
