AI regulation outside the US, EU and China: Australia, Brazil, Japan, Singapore

Summary

This guide reads one primary document for each country. The four instruments differ in legal weight: a voluntary standard, a bill, an Act and a set of guidelines. The steps for a security leader differ with them. Each section below says what the source document states, and the last section sets out the practical steps the documents themselves support.

Australia: a voluntary standard with security content

The Department of Industry, Science and Resources says it published the Guidance for AI Adoption on 21 October 2025, which outlines six essential practices for AI governance. The department's page says this guidance is the updated version of the Voluntary AI Safety Standard, whose 10 guardrails the page sets out.

The page is clear about legal weight. It says the standard is voluntary and creates no new legal duties. It also says that full adoption means all 10 guardrails, not a selection.

Guardrail 3 is the one that most directly concerns security teams. The department's text says the following about protecting AI systems. The detailed actions under that guardrail name the Essential Eight. The page asks organisations to set up an organisation-wide process for applying it to AI systems.

Two further items touch security work. Under guardrail 4, the page says general-purpose AI systems, including those based on large language models, should get adversarial testing such as red teaming. Under guardrail 3, it asks organisations to record breach reporting duties for each AI system, citing the Notifiable Data Breach scheme as an example.

Brazil: a bill, not yet a law

The Law Library of Congress reported on 23 May 2025 that the Brazilian Senate approved an AI bill on December 10, 2024 and forwarded it to the Chamber of Deputies on March 17, 2025. The report states that the bill needs two more approvals before it becomes law.

On content, the report says the bill would sort AI systems by risk level, set civil liability for damages caused by AI, and provide for supervision and inspection of AI. The report also says the bill would generally ban systems it treats as "excessively risky".

The report describes a bill under review. It does not describe duties that apply now, and this guide does not present any.

Japan: an Act in effect, built on guidelines

The Government of Japan Public Relations Office, in its November 2025 issue, says the Act on Promotion of Research and Development, and Utilization of Artificial Intelligence-related Technology came into full effect in September 2025.

The article says Japan chose a light-touch design. It describes the framework as existing laws plus ministry guidelines. It adds that the Act tasks the government with three things.

Reach matters for companies headquartered elsewhere. The article states the following about scope. The article also says the AI Basic Plan, which sets the government's basic AI policy, is scheduled to be finalized within the year.

Singapore: security guidelines from the Cyber Security Agency

The Cyber Security Agency of Singapore (CSA) published its page on 15 October 2024. CSA says it developed Guidelines on Securing AI Systems to help system owners secure AI across its lifecycle. It says the guidelines address two kinds of risk.

CSA also describes a Companion Guide, built with AI and cybersecurity practitioners. It calls the guide community-driven and says it complements the Guidelines. CSA states that the guide is not prescriptive. It names the MITRE ATLAS database and the OWASP Top 10 for Machine Learning and Generative AI as resources it references.

What a security leader needs to do

The four documents do not ask for the same thing, so the steps below are split by country.

Australia. Nothing in the department's page makes the standard mandatory. A team that adopts it should treat guardrail 3 as the security core. That means mapping existing cybersecurity practice to the Essential Eight for each AI system, adding red teaming for general-purpose systems, and documenting breach reporting duties. The page also says organisations should keep records of compliance, including an inventory of their AI systems.

Brazil. The report describes a bill that has not become law. The practical step is to follow its progress through the Chamber of Deputies and the president, since the report names both as required approvals.

Japan. The Act is in effect and the article says it covers foreign business operators who target Japanese business operators or citizens. A company serving those customers should read the ministry guidelines the article points to. The article says they are the main route for mitigating risk.

Singapore. CSA's page frames security as a starting condition. A team operating there can use the Guidelines and the Companion Guide as reference material, and CSA invites views and suggestions at the address on its page.

Across all four, the common thread in the documents is security and governance work applied to AI systems across their lifecycle. Only Japan's instrument is described as in effect, and the legal weight differs in each case.