Do software and SaaS need to adopt the Voluntary AI Safety Standard (DISR 2024)?
A computed answer from the Rules Mate applicability engine, with the exact condition, the outcome for every structure and size, and the primary source.
Short answer: Yes
Yes. This obligation applies to software and SaaS whatever their structure or size. The deciding fact: Industry: Software & SaaS.
The obligation in brief
Adopt the Voluntary AI Safety Standard (DISR 2024). DISR released the Voluntary AI Safety Standard in September 2024 — 10 guardrails covering accountability, risk management, data governance, testing, transparency, human oversight, contestability, supply chain, records + stakeholder engagement. Mandatory regime for 'high risk' AI being developed (likely 2026-27).
Trigger: Deploying AI systems affecting Australians.
Why software & saas get a different answer
Rules Mate runs its applicability engine across 9 business structures and 6 size bands for each of the 35 industries it maps. For 34 of those industries the answer for "Adopt the Voluntary AI Safety Standard (DISR 2024)" is no. Software & SaaS is one of the 1 where the answer is different: yes.
The deciding fact for software and SaaS: Industry: Software & SaaS.
About the industry: Tech companies — captured by Privacy Act, Online Safety Act, AI Voluntary Standard, and SOCI if critical-infrastructure-aligned.
Compare a professional services (general) business with 6–19 employees structured as a Pty Ltd company: the obligation does not apply (Requires automated decisions about people or industry: Software & SaaS).
Answer by business structure and size
Each cell is the engine's outcome for a business in software & saas with that structure and size, assuming it sells to consumers and small businesses and holds customer contact details. "Check" means the obligation turns on a fact the industry does not settle.
| Structure | No employees | 1–5 employees | 6–19 employees | 20–99 employees | 100–499 employees | 500+ employees |
|---|---|---|---|---|---|---|
| Sole trader | Yes | Yes | Yes | Yes | Yes | Yes |
| Partnership | Yes | Yes | Yes | Yes | Yes | Yes |
| Trust | Yes | Yes | Yes | Yes | Yes | Yes |
| Pty Ltd company | Yes | Yes | Yes | Yes | Yes | Yes |
| Public company | Yes | Yes | Yes | Yes | Yes | Yes |
| Not-for-profit (unregistered) | Yes | Yes | Yes | Yes | Yes | Yes |
| Registered charity | Yes | Yes | Yes | Yes | Yes | Yes |
| Super fund | Yes | Yes | Yes | Yes | Yes | Yes |
| Foreign company | Yes | Yes | Yes | Yes | Yes | Yes |
What the obligation requires
- When due
- Voluntary now; mandatory expected 2026-27 for high-risk uses.
- Evidence to keep
- AI risk register, governance documentation, testing artefacts, accountability statements.
- Maximum penalty
- Voluntary today; mandatory regime expected with civil penalties
- Regulator
- See source
- Jurisdiction
- Commonwealth (national)
Other obligations where software & saas differ from the norm
Questions
- Do software and SaaS need to adopt the Voluntary AI Safety Standard (DISR 2024)?
- Yes. This obligation applies to software and SaaS whatever their structure or size. The deciding fact: Industry: Software & SaaS.
- Is the answer the same for every industry?
- No. For 34 of the 35 industries Rules Mate maps, the answer is no. Software & SaaS is one of 1 industries with a different answer.
Related
Sources
Computed by the Rules Mate applicability engine from the published obligation corpus; facts last checked 3 October 2026. Rules Mate is not a law firm and this is general information, not legal advice. Confirm your position with the regulator source or a qualified adviser before acting.