The week in digital: AI safety rules, a CommBank lawsuit and an IT tool’s bad week

This week Canberra said the biggest AI companies will have to follow safety rules. ASIC took CommBank to court over business banking fees. A tool many IT providers use to run their clients’ computers had 33 flaws posted online. Google warned that a new safety bill could put age checks on your inbox. And Google started shuffling search rankings in the Black Friday run-up. Here are five stories worth taking into next week.

1. Big AI companies will have to follow Australian safety rules

The government said on 10 November that it will legislate mandatory safety and security rules for “frontier AI” companies. Those are the makers of the most advanced models. It will propose a new regulator to enforce them, with what the government calls significant penalties.

Companies would have to let independent evaluators test their models, report incidents to the government rapidly and publish their safety frameworks. The push follows an OpenAI research agent that got into a Medicare statistics portal in June. The government has accepted all 18 recommendations of its review into that incident.

So what: nothing changes yet for people and businesses using AI tools. The rules fall on the companies that build the models. There’s no bill, start date or penalty amount yet.

Read what AI companies will have to do.

2. ASIC sues CommBank over hidden CommBiz fees

ASIC has started civil penalty proceedings against Commonwealth Bank over CommBiz, its online banking platform for businesses. It alleges customers paid an extra, undisclosed fee for the matching movement of money out of or into their own CommBiz account.

ASIC alleges about 42,000 customers were overcharged about $8.5 million between November 2020 and 31 May 2025. CBA has already paid more than $26.4 million in remediation to about 93,000 CommBiz customers, ASIC says. SmartCompany reports that CBA disputed some of ASIC’s claims, and a court hasn’t ruled on the allegations.

So what: if you used CommBiz for pay runs or direct debits, think you were affected and haven’t been paid back, ASIC says to contact CBA.

Read how to check your statements.

3. Your IT provider’s remote-control tool had a very bad week

A researcher published 33 flaws in N-able’s N-central, with no fix available. IT providers use it to patch and take control of every computer they look after. Huntress reports that N-able took its hosted servers offline on 9 November. N-able released a critical fix, build 2026.4.1.26, the next day.

N-able told customers it saw scanning linked to the published attack code, but no evidence that any customer was successfully hacked, Huntress reports.

So what: if someone else looks after your computers, ask them one question. Do they use N-central, and are the server and every agent on your machines on build 2026.4.1.26 or later?

Read what your IT provider should do.

4. Google warns the safety bill could put age checks on email

The Digital Duty of Care bill passed the House of Representatives on 28 October. Google told the Senate inquiry that one section could force email, messaging and file storage services to check users’ ages. They would also have to screen what under-18s can reach.

The bill as passed also leaves privacy out of the test for whether safety steps are appropriate. The small business council COSBOA wants low-risk small business websites spared the yearly risk assessments.

So what: the committee reports on 20 November, and its report will show which changes it recommends. If your site lets users post reviews, comments or uploads, note those features now.

Read what the bill asks of online services.

5. Google’s core update lands in the Black Friday run-up

Google started its November 2026 core update at 2:06am on 11 November, Perth time. It applies in every country and language, and may take up to two weeks. That could run to 25 November in Perth, two days before Black Friday.

Google says most sites don’t need to worry, and small ranking drops don’t call for drastic changes.

So what: don’t rewrite pages mid-sale. Google says to wait until the rollout ends, plus at least a week, before comparing your traffic in Search Console.

Read Google’s advice on what to do.

Win of the week

From 2027, no NSW public primary school will require families to buy a laptop or tablet for class. Students will use school-supplied technology where screens are used. “There is no need for parents to fork out over a thousand dollars,” said Education Minister Prue Car. Read what changes in class.

Facepalm of the week

Microsoft is adding fair-use limits to more of the free Copilot Chat, but won’t say what they are. Admins can’t see or change them either. Staff who hit one usually see an option to upgrade, and Microsoft told resellers it “creates a natural opening” for a sales chat. Read what to set before staff start buying.

Dates to watch

Date	What happens
20 November 2026	The Senate committee is due to report on the Digital Duty of Care bill.
25 November 2026	Latest likely finish of Google’s November core update in Perth, if it takes the full two weeks.
27 November 2026	Black Friday.
4 December 2026	Submissions on the ACMA’s proposed SMS sender ID fee close at 5pm AEDT (2pm in Perth).
31 December 2026	Last day to order Microsoft 365 Copilot Business at its first-year discount of A$26.91 a user a month (before GST, paid yearly).
1 January 2027	Microsoft’s next local-currency price update is due. Whether Australian prices move isn’t known yet.
27 January 2027	Comments close on the draft Best Practice Guide on the Adoption of AI in the Workplace.
30 June 2027	Last day to pay the ATO directly by credit card.