Simon Burns

Regulatory signal: APRA is moving from implementation to demonstrable resilience - with deeper supervision of cyber, AI, critical operations, common technology platforms and material service providers.

On 15 July, Prime Minister Anthony Albanese, delivered a speech at the University of Sydney titled AI in Australia's interests, in which he foreshadowed a new national framework for “large-scale” data centres, including mandatory rules for …

Australia has become a key destination for data centre developers, investors and operators seeking exposure to long-term digital infrastructure growth.

Boards are being told, in increasingly direct terms, that AI-enabled cyber risk and geopolitical risk are no longer separate emerging-risk issues.

Australian regulators have substantially increased their rhetoric on how regulated entities and their boards are expected to govern AI-related risk.

As AI accelerates vulnerability discovery, OT-heavy businesses face new governance challenges. Explore the implications for boards and GCs.

The final report on the independent review into the Security of Critical Infrastructure Act 2018 (SOCI Act), conducted by Dr Jill Slay AM, was delivered on 2 February 2026 and was subsequently made public on 25 March 2026 (the Report). The …

Mythos AI signals faster cyber threats. Why boards must act now on governance, risk, disclosure and resilience in an era of AI-driven vulnerabilities. Visit Gilbert + Tobin for more.

Anthropic’s Mythos-class AI marks a leap in automated cyber attacks, accelerating vulnerability discovery and forcing boards to rethink cyber risk, governance, and defence strategies. Visit Gilbert + Tobin to find out more.

On 25 March 2026 , the Minister for Home Affairs opened consultation on two significant reforms to the Security of Critical Infrastructure Act 2018 (Cth) (SOCI Act): proposed amendments to the Ministerial Directions Powers under Part 3 of t…

The escalating armed conflict in the Middle East has materially increased cyber risk for Australian organisations. War, coupled with broader geopolitical tensions, has driven a significant increase in state-sponsored cyberattacks, targeting…

ART overturns Privacy Commissioner, holding Bunnings’ facial recognition use was permitted under the Privacy Act, with lessons for business. Read more at Gilbert + Tobin.

Government finds Australian Consumer Law fit for AI – no overhaul needed, only minor updates and guidance to clarify how ACL applies to AI-enabled goods and services. Find out more at Gilbert + Tobin.

Sustainability Insights provides strategic analysis of global sustainability policy and practice to help leaders anticipate trends, risks and opportunities.

We may find out the answer this week from the outcome of the US presidential election.

Former British prime minister Tony Blair’s vision is that each citizen would have a Personal Health Account containing their genomic information predicting future health, which would empower every individual to make better informed de…

We review a proposal from Oxford University researchers to fundamentally shift AI developer incentives by imposing a legal obligation to design truth-telling AI.

The Senate has passed a bill introducing climate-related financial disclosure for Australian companies. Learn more about the new sustainability reporting requirements in the Corporations Act. Read now.

Study finds AI assistance improves human legal analysis. Learn about the first randomized control study on AI tools for lawyers. Read now.

Over the last year, there have been several international commitments at bilateral, regional and multilateral levels to collaborate and cooperate on AI, such as the Bletchley Declaration between the EU and 27 other countries including …

In early March 2024, the UK Government released a report by an independent expert panel into equity in medical devices.The inquiry was triggered by concerns that a medical device called a pulse oximeter, which clips on the end of your finge…

Last week, the White House Office of Management and Budget (OMB) released its memorandum to US government departments and agencies on the AI governance measures they must implement. The most striking feature is that a positive obligation of…

If you met a time-traveller from 10 years in the future, and they told you that AI was now ubiquitous in your profession, how would you feel?

In the ever-evolving AI landscape, unprecedented advances have been made across many domains. Unfortunately, shadows follow progress (and worse, sometimes the other way around). As society entrusts AI systems with increasingly complex tasks…

The Robodebt Royal Commission report said that: "When done well, AI and automation can enable government to provide services in a way that is “faster, cheaper, quicker and more accessible.” The concept of “when done well&r…

It was almost 4 years ago, back in December of 2019 that the review of the Privacy Act 1988 (Cth) (Privacy Act) was first announced by the then Attorney-General (the Review).

The Atlantic Council, drawing on a task force of forty experts across industry, civil society, academia, and philanthropy, has recently released a report arguing that we are at a pivotal moment in the evolution of governance of online space…

The study compared the views of experts in the UK and Japan. While unpaid work is disproportionately performed by women in both countries, there were significant national differences in views about the impact of AI in the domestic sphe…

Generative AI, aptly named, has the ability to generate new content, be it text, images, music or even videos. Could generative AI be used to generate rules to regulate itself? As interesting as that may be, it would probably be better left…

A recent article by three UK academics argues that the ‘many hands’ problem is much more complex in AI supply chains and that we need some urgent rethinking of ‘traditional’ tech governance and accountability models.

We discuss the recent Supporting Responsible AI Discussion Paper on AI Regulation in Australia, what is so unique about AI?, how to approach regulating AI, and key focus areas.

We provide the Australian guide to Data Protection & Cyber Security Guide in the Legal 500 2022 publication.

Readers of the Australian Financial Review may have read with interest James Thomson’s Chanticleer column on May 3.  For those that missed it, the article concerned Chegg Inc, a NYSE-listed company. Chegg provides online services…

From 10 November 2023 Australia’s unfair contract terms (UCT) regime will apply to a much, much larger pool of contracts than it has in the past. Businesses that might previously have been comfortable that the UCT regime did not affec…

You wake up in the morning and think about having bagels for breakfast. As soon as you visualise the bagels in your head, your mobile sends you a notification: ‘craving detected: there’s a local cafe selling your favourite salmo…

Start-ups increasingly are engaging with AI - both as a tool to write code and as the ‘engine’ which powers their innovative products and services. However, as we all know now, the gains from AI are not without risks to consumer…

When we last wrote about deepfakes in 2019 they had just started to capture the public’s imagination. Jordan Peele’s viral deepfake of Barack Obama, which intended to caution against the inherent political risks of the technolog…

The election of a majority Labor government in New South Wales ended the past 12 years of Coalition Government and will lead to a shift in the State’s infrastructure priorities. So, to prioritise maintaining the state’s valued A…

In this article we look at the Discussion Paper released on Australian Cyber Security Strategy.

Following a period of consultation at the end of 2022, the Security of Critical Infrastructure Rules have now been registered under the Security of Critical Infrastructure Act 2018 (Cth).

In this article we explore the key highlights of the Privacy Act Report.

Last year, OECD member countries adopted an intergovernmental agreement setting out their shared principles for government access to personal data held by private entities. The OECD Declaration documents principles and safeguards, drawn fro…

In early 2023, computer science student, Edward Tian, from Princeton University developed the GPTZero app to analyse the likelihood that a passage of text is written by AI.

Neurotechnology refers to any technology that provides greater insight into, or control over, the activity of the brain or nervous system. An example of currently available neurotechnology is brain-computer interfaces.

The Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022 (Bill) has now passed both Houses of Parliament and will become law imminently, commencing the day after it receives Royal Assent. The Attorney-General tabled…

As science fiction increasingly becomes a reality, outer space is the next frontier in legal and governance policymaking. In this article, we review recent developments in the space industry, the international regulation of space, Australia…

We look at law reforms and harsher penalties surrounding ransomware attacks and explain if outcomes will change for Australian businesses.

New licence conditions require carriers and CSPs to report cyber incidents and asset information, creating complex compliance duties. Read more at Gilbert + Tobin.

We discuss how the use of artificial intelligence and blockchain technology can be used to decarbonise the energy sector.

After a long and circuitous journey, on 31 March 2022 Parliament passed the Security Legislation Amendment (Critical Infrastructure Protection) Act 2022 (SLACIP Act), which implements the final package of amendments to the existing Security…

The Corporations Amendment (Meetings and Documents) Bill 2021 has permanently allowed electronic and split execution under sections 126 and 127, we explain.

Australia’s critical infrastructure laws expand again with new asset definitions, draft application rules and Bills strengthening cyber and transport security.

We outline the new Security of Critical Infrastructure Act (SOCI) reforms and what your business needs to know.

We outline the draft Trusted Digital Identity Bill 2021 which aims to improve the way Australians are able to verify their identity when accessing online services.

We discuss employers obligation to provide a safe place of work for their staff and visitors and if they should require employees to be vaccinated.

Electronic execution and split execution of documents under section 127 of the Corporations Act 2001 (Cth), will again be permitted. We take you through the latest amendments of the Bill

We outline the definition of Ransomeware and its impacts, discuss whether paying for ransomware should be illegal or not & how companies can protect themselves.

A fundamental function of any government is to provide for the safety and wellbeing of its citizens. While we commonly think of law enforcement, emergency services and public healthcare as the primary tools used by governments to meet this …

Remote witnessing and attestation laws have been updated again. We outline the new regulations facilitating remote witnessing & electronic signature attestation.

This Gilbert + Tobin insight explores how private companies are a step closer to being able to seek accreditation to join the Australian Government’s digital identity scheme, ‘GovPass’.

The Federal Court of Australia recently found in Luppino v Fisher that a mobile phone should not be treated as a “computer” or a “data storage device”.