McDonald’s corporate arm owns the prime real estate and core brand assets, which it then leases back to local franchisees via rents and licensing fees. By decoupling the underlying high-value assets from local operations, McDonald’s converts volatile operational income into stable, tax-efficient passive revenues.

For location-independent knowledge workers, developers, consultants, agency owners, and digital creators, your "real estate" is your intellectual property (IP). By applying this same structural logic globally, you can protect your assets, optimise your corporate footprint, and legally minimise your tax liabilities.

Phase 1: The Blueprint – Structuring Your IP

To execute this strategy, you must first separate the ownership of your ideas from the execution of your services.

Step 1: Split your identity into IP Co and Op Co

Instead of operating through a single entity that conducts business and holds your assets, establish a two-tier structure:

• IP Holding Company (IP Co): Located in an offshore or favourable tax jurisdiction. This entity owns your core intangibles: source code, trademarks, proprietary frameworks, domains, and brand assets.

• Operating Company (Op Co): A local entity set up where you deliver services or invoice local clients.

Your local Op Co bills the client, but it pays licensing or royalty fees to your IP Co for using your proprietary tools and brand. This moves profit out of high-tax operational jurisdictions and into your IP holding hub.

Step 2: Convert Active Service into Passive Capital

Selling your time directly subjects you to high marginal income tax rates and welfare contributions. Transform your active service model into distinct IP assets:

• Move from consulting to software: Turn custom workflows into a licensable SaaS platform.

• Move from agencies to methodologies: Package your execution frameworks into proprietary white-label tools.

This shift allows you to take advantage of Patent Box regimes or preferential IP tax rates globally, where IP income is often taxed at significantly lower rates than personal income.

Phase 2: Navigating Cross-Border Tax Rules (The Australian Example)

Tax authorities monitor cross-border profit shifting closely. For example, Australia imposes a standard 30% withholding tax on royalty payments sent to non-resident entities in non-treaty jurisdictions. Furthermore, under draft ATO ruling TR 2024/D1, the ATO broadly treats SaaS distribution, API access, and cloud arrangements as royalty-generating IP rights, frequently catching intercompany payments in the net.

To manage cross-border software and IP transactions under current guidance, global operators apply three primary approaches:

1. Leverage Double Tax Agreement (DTA) Treaty Networks

Under section 4(2) of the International Tax Agreements Act 1953, tax treaties override Australia's domestic tax definition of a royalty. Incorporating your IP Co in a DTA partner country (e.g., Singapore, the UK, or the US) drops the withholding rate from the 30% statutory rate down to 5% to 15% (or 0% in specific exemptions). The foreign IP Co must maintain genuine economic substance to prevent treaty benefit denials under anti-abuse rules.

Note on Singapore: Under the Australia-Singapore DTA, the capped royalty withholding tax rate is 10%. If an Australian Op Co pays a $10,000 royalty fee to a Singapore IP Co, it must withhold $1,000 for the ATO. The Singapore company can usually claim a foreign tax credit for this to avoid double taxation. The 10% paid to the ATO is usually a sunk cost. It becomes your total global tax rate on that transaction.

2. Direct Contracting / Merchant of Record (MoR) Models

Operators bypass intercompany friction by having the foreign IP Co contract directly with global clients as the Merchant of Record. The local entity is reduced to a service provider performing local R&D or support, billed as an arm's-length service fee (taxed as service income, not a royalty). Because there is no Australian corporate entity making an intercompany royalty payment to Singapore, no royalty withholding tax is triggered. (However, 10% GST still applies on sales made to Australian consumers if sales exceed the A$75,000 threshold).

3. Fair and Reasonable Contract Apportionment If a transaction bundles non-royalty elements (like pure hosting or technical support) with IP rights, the ATO threatens to tax the entire amount as a royalty under ATO TR 2024/D1 unless the contract explicitly splits the consideration. Operators structure agreements with verified market valuations to separate unbundled service fees from underlying IP rights.

Phase 3: The Singapore IP Co

A popular choice for establishing an IP Co is Singapore, governed by the Inland Revenue Authority of Singapore (IRAS). Does Singapore require tax to be paid on foreign-sourced IP income? The short answer is no, provided the income is not remitted into Singapore, or qualifies for specific exemptions if it is.

Understanding Singapore’s Territorial Tax System

• Unremitted Foreign Income: If your Singapore IP Co receives licensing fees or foreign income into a non-Singapore bank account and keeps it outside Singapore, IRAS charges 0% tax.

• Remitted Foreign Income: If foreign-sourced income is brought into a Singapore bank account, it is generally taxable at a flat 17% corporate rate, unless it qualifies for the Foreign-Sourced Income Exemption (FSIE) under Section 13(8) of the Income Tax Act.

Crucial Anti-Avoidance Guardrails

Relying purely on a foreign bank account is not a loophole.

1. Trade / Business Carried On in Singapore: If IRAS determines that the Singapore IP Co is conducting its core operations inside Singapore (e.g., local directors, staff, and management decisions), IRAS can rule that the income accrued in Singapore and tax it at 17%, regardless of where the bank account is located. You must maintain valid Economic Substance offshore.

2. Section 10L Rules: Effective 2024, if a Singapore entity disposes of or sells foreign intangible assets (like IP) and remits the capital gains to Singapore, those gains become taxable unless the company satisfies Economic Substance Requirements.

3. Section 13(8) Exemption Rules: If you do want to bring money into a Singapore bank account tax-free, the income must have been subject to tax in a foreign source country with a headline rate of at least 15%, and the Comptroller must be satisfied the exemption is beneficial.

Banking Execution: How to Hold and Spend Funds Tax-Free

To avoid IRAS tax, funds must be deposited and held in an offshore (foreign) bank account (e.g., multi-currency corporate accounts in Hong Kong, Switzerland, the US, or via global fintech platforms like Wise. Note: Do not use Airwallex!).

Under Section 10(25) of the Singapore Income Tax Act, foreign income is only deemed "received in Singapore" (and thus taxable) if it is transferred to a Singapore bank account (like DBS or OCBC), used to pay a business debt incurred inside Singapore, or used to buy physical assets brought into Singapore.

If your money lands in an offshore Wise account, you can spend it digitally via electronic transfers or card payments with 0% Singapore tax, provided the transactions remain outside Singapore. This includes paying global vendor expenses (AWS, Meta), offshore business travel, or buying offshore assets.

Distributions: Dividends vs. Director’s Fees

• Dividends: Singapore operates a One-Tier Corporate Tax System with 0% dividend withholding tax. The Singapore IP Co can pay dividends directly from its offshore Wise account to a non-Singapore shareholder's personal bank account overseas without triggering a remittance event.

• Director’s Fees: Under Singapore tax law, director's fees paid to a non-resident director are deemed sourced in Singapore and carry a statutory 24% withholding tax. Consequently, equity owners generally distribute profits as dividends.

Phase 4: Select Personal Tax Residency

While Singapore lets the dividend leave untaxed, the tax liability shifts entirely to where the shareholder personally resides. This is where many digital nomads fall into a trap, assuming that spending less than 183 days in any one country automatically makes them a tax resident of "nowhere."

How the ATO Views Nomads and Worldwide Income

Physical absence alone is rarely enough to break your Australian tax ties. The ATO evaluates residency using four statutory tests.

• The Domicile Test: If your domicile of origin is Australia, you remain an Australian tax resident unless you can prove your "permanent place of abode" is outside Australia. Living as a transient nomad moving between Airbnbs fails this test. The ATO explicitly states in ATO TR 2023/1 that a nomadic lifestyle without a fixed overseas home means your Australian residency remains intact.

• The Resides Test: Retaining Australian bank accounts, personal belongings, or Medicare while drifting abroad usually means you still "reside" in Australia according to ordinary concepts.

If the ATO determines you are still a resident, you are legally required to report Singapore dividends on your Australian tax return, taxing them at your marginal rate (up to 45% + Medicare levy). Foreign institutions (including Wise) automatically report account balances back to the ATO via the Common Reporting Standard (CRS).

The Two-Step Legal Fix

To receive dividends tax-free without being dragged back into the high-tax net, you must actively establish tax residency in a new jurisdiction rather than attempting to exist in a tax void.

1. Formal Tax Exit from Australia: Sell or lease out real property, minimise Australian bank accounts, cancel local subscriptions, and establish a clear intention of leaving indefinitely (aiming for a 2+ year continuous absence).

2. Establish "Tax Residency of Choice": Register as a formal tax resident in a low/zero-tax hub. Holding an official Tax Residency Certificate (e.g. Thai Form R.O. 22 Document) gives the ATO proof that your permanent place of abode is outside Australia, defeating the Domicile Test. Options include:

• UAE: Obtain a residency visa and spend 90 days a year there to secure a Tax Residency Certificate.

• Panama or Costa Rica: Territorial tax regimes where foreign-sourced dividends carry 0% local tax.

• Cyprus or Malta: Offer 0% tax on foreign dividend income for non-domiciled tax residents.

A Reality Check on Southeast Asian Visas

If you are looking at Southeast Asia, be aware that standard nomad visas do not equal zero tax. In Thailand, anyone spending 183+ days becomes a tax resident subject to progressive rates (0% to 35%) on foreign-sourced income brought into the country.

The popular Destination Thailand Visa (DTV) and Thai Privilege Visas do not grant tax exemptions. The only exception is the 10-year Long-Term Resident (LTR) Visa for Wealthy Pensioners (which requires a 50,000 THB application fee, annual passive income or pension of at least USD 80,000 or an annual passive income of at least USD 40,000 combined with a minimum investment of USD 250,000 in Thai government bonds, foreign direct investment, or Thai real estate, report to immigration once per year, no minimum days to keep visa), granting a 100% tax exemption on foreign-sourced income, regardless of whether it is remitted into Thailand.

By combining a hub like Singapore with a legally sound personal tax residency, global knowledge workers can build a compliant, location-independent operation modelled after the world's most successful multinational networks.

By training a grounded AI model on a founder or key executive's voice, writing style, and physical appearance, companies can generate hyper-realistic synthetic photos, blog posts, audio podcasts, and social media videos, all without the executive ever stepping foot in a recording studio.

The marketing efficiencies are undeniable. However, the tax strategies being pitched around these Digital Twins are leading many founders straight into a regulatory trap.

Part 1: The "Tax-Free" Digital Twin Strategy

On paper, the strategy proposed to many founders and key executives sounds like a masterclass in corporate structuring and IP law. It usually goes like this:

• The Setup: The company wants to use the founder's Digital Twin for marketing content.

• The Offshore Middleman: To generate the synthetic media, the company pays a subscription or generation fee to an overseas AI platform.

• The Licensing Agreement: The overseas platform then pays a "content usage fee" or "IP licensing fee" back to the founder's Discretionary Family Trust in exchange for the legal right to use the grounded AI model based on the founder's likeness.

• The "Tax Benefit": The company claims a tax deduction for the marketing expense (lowering corporate tax). Meanwhile, the Discretionary Trust receives the licensing income and distributes it to family members in lower tax brackets.

In this scenario, the founder supposedly generates a highly tax-effective new income stream while completely avoiding personal income tax at the top marginal rate.

There is only one problem: Under Australian law, this structure is entirely illegal.

The Reality Check: ATO Taxation Determination TD 2023/4

The Australian Taxation Office (ATO) is hyper-aware of high-profile individuals attempting to alienate income generated from their "fame" or public persona to related entities. To close this loophole, the ATO issued Taxation Determination TD 2023/4, which alters how image rights, likeness, and "fame" are taxed in Australia.

1. You Cannot Sub-License Your Face or Voice

The ATO's ruling explicitly states that income derived from the commercial exploitation of your name, image, likeness, identity, reputation, or signature must be assessed as your personal income. It does not matter if an overseas AI platform generates the synthetic output.

2. Australia Does Not Recognise "Property Rights" in Fame

In some jurisdictions, your "Right of Publicity" is recognised as a distinct, assignable property right. Australia does not recognise this. Because your likeness is not considered alienable property under Australian common law, any agreement where you "license" your Digital Twin to your Family Trust is viewed by the ATO as an ineffective tax avoidance scheme.

The Cross-Border Withholding Risk

Beyond the personal income tax trap, injecting an overseas AI supplier into the payment flow creates a secondary risk: Foreign Royalty Withholding Tax. If an Australian company pays an overseas supplier a fee that includes the right to use "intellectual property", the ATO may classify that payment as a royalty. Australian businesses are legally obligated to withhold tax on royalties paid overseas.

How to Structure Your Digital Twin Legally (While Alive)

While the "tax-free trust distribution" loophole is closed, your company can still legally and commercially benefit from using a Digital Twin:

• The Corporate Deduction: The company pays the overseas AI platform for the software service (SaaS) or the generation of the synthetic media. This remains a legitimate, deductible marketing expense for the company.

• The Personal Income Assessment: If the founder is to be remunerated for the use of their likeness or voice model, the company (or the platform) must pay the founder directly.

• Marginal Rates Apply: The founder must declare this usage fee on their individual tax return.

Part 2: The Posthumous Risk (What Happens When You Die?)

While we have established that a living founder cannot assign their likeness to a trust for tax purposes, an entirely different legal crisis emerges regarding a founder's Digital Twin after they pass away.

While Australia lacks a dedicated right of publicity, deceased individuals' estates are not entirely without legal weapons if a digital replica is used commercially. The Australian Consumer Law (ACL) and the common law tort of 'passing off' can sometimes be leveraged if an AI-generated likeness is used to falsely imply that the deceased person (or their estate) endorsed a product or service. However, this relies heavily on the deceased having an established business reputation or goodwill. Furthermore, if a deepfake is created simply to tarnish a deceased person’s reputation rather than to sell a product, the estate is largely powerless. Under Australian law, a cause of action for defamation dies with the person (actio personalis moritur cum persona).

The United States continues to aggressively widen this legal gap. In addition to state-based laws, the proposed federal NO FAKES Act, reintroduced to the US Congress in 2026, specifically targets unauthorised digital replicas. Under this proposed legislation, the right to control AI-generated visual or voice replicas survives an individual's death and can be enforced by their heirs or executors for up to 70 years post-mortem. This creates a concrete, monetizable, and highly protective legal framework for digital remains that Australia simply does not possess.

Recent developments in Australian copyright policy do, however, offer a glimmer of hope against unauthorised AI cloning. In late 2025, the Australian Government explicitly rejected calls from big tech companies to introduce a broad "Text and Data Mining" (TDM) exception for AI training. This means tech companies cannot legally scrape and ingest copyrighted works, such as your recorded voice, published videos, or written text, to train their generative AI models without permission and compensation.

The Solution: Estate Planning for Digital Twins

Beyond merely appointing a digital executor, creators and business owners are increasingly treating their potential "digital twin" as a distinct asset in their estate planning. Legal professionals are now drafting explicit post-mortem licensing clauses and 'AI directives' within wills. These clauses expressly state whether the deceased consents to their likeness, voice, or writing being used to train AI posthumously, and can explicitly assign the commercial rights of any digital exploitation to specific beneficiaries.

The Bottom Line for Business Owners

Innovation in AI offers incredible leverage for marketing, but it does not rewrite the Australian tax code or succession laws. If a tax strategy relies on moving the commercial value of your personal identity into a trust, it will fail an ATO audit. Likewise, if your will does not account for your digital remains, your estate may lose control of your likeness entirely.

If you are developing grounded AI models, licensing your likeness, or want to secure your digital footprint in your estate planning, the team at James Wan & Co. can ensure your commercial contracts and wills are robust and compliant. Contact us today to secure your digital future.

Increasingly, we are seeing Australian organisations bypass the friction of SWIFT banking networks by paying overseas suppliers directly in cryptocurrency.

But what happens when your organisation is a Co-operative registered with the Australian Charities and Not-for-profits Commission (ACNC)? How do you legally pay an overseas supplier in crypto for intangible assets? And most importantly, how do you legally distribute income back to your local co-op members without violating charity laws?

In this guide, we break down the legal mechanics, the Australian Taxation Office (ATO) record-keeping requirements, and the withholding tax traps of managing a cross-border, crypto-powered Co-operative.

Part 1: The ACNC Co-operative Reality Check (How to Legally "Distribute" Income)

Before executing overseas contracts, we must address the most common regulatory hurdle for ACNC-registered entities: The Private Benefit Rule.

By law, an ACNC-registered charity must operate on a not-for-profit (NFP) basis. This means the Co-operative cannot distribute surplus income or profits to its members as dividends or shareholder returns.

So, how does a member legally receive income from the Co-operative?

To distribute funds to members legally without losing ACNC status, the payments must be structured as arm's-length remuneration for services rendered or as distributions that directly advance the charity's purpose.

• Service Agreements: If a member provides tangible work to the Co-op (e.g., writing code, managing marketing, or providing professional consulting), the Co-op can pay them a commercial, market-rate contractor fee or salary.

• Sub-contracting: If the Co-op generates revenue by offering a service to the public, it can legally sub-contract that work to its members, paying them for their specific deliverables.

Legal Tip: Every payment to a member must be supported by a formal contractor agreement and valid tax invoices. If the ATO or ACNC audits the entity, you must prove the payment was for a genuine service at market value, not a disguised profit distribution.

Part 2: Paying the Overseas Supplier in Crypto

Assume your Co-operative needs to pay a software developer in Estonia for coding work, or pay a licensing fee to a digital artist in Brazil for the use of their IP. The supplier requests payment in cryptocurrency (like USDT, Bitcoin, or Ethereum) directly to their digital wallet, bypassing their local banking system entirely.

Under Australian law, this is perfectly legal. The ATO treats cryptocurrency as a legitimate form of property and a valid medium of exchange. The fact that the overseas supplier never touches a traditional bank account in their home country does not invalidate the commercial transaction in Australia.

However, the Co-operative must treat the crypto transaction with the exact same documentary rigour as a fiat bank transfer.

The ATO Record-Keeping Protocol

To claim the overseas payment as a legitimate business expense (and to prove the funds were not misappropriated), the ACNC Co-operative must maintain records for five years:

1. The Commercial Contract: A clear IP licensing agreement or contractor agreement outlining the scope of intangible work.

2. The Invoice: The overseas supplier must issue an invoice. Ideally, it should state the amount owed in fiat (e.g., $10,000 USD) and specify that it will be settled in a specific cryptocurrency.

3. AUD Timestamping: The ATO requires all crypto transactions to be reported in Australian Dollars (AUD). At the exact moment the Co-op transfers the crypto to the overseas wallet, you must record the AUD equivalent value using a reputable exchange rate.

4. On-Chain Proof: You must retain the transaction ID (TxID), the date/time of the transfer, and the recipient’s public wallet address.

Part 3: The Hidden Trap: Foreign Royalty Withholding Tax

The most dangerous compliance risk in this structure is failing to distinguish between paying for a service and paying for IP rights.

If your Co-operative pays an overseas supplier to build a custom website from scratch, that is generally classified as a payment for services.

However, if you pay an overseas supplier to use existing software, digital artwork, or patented technology, the ATO classifies this as a Royalty.

The Withholding Obligation

If the payment is a royalty, Australia requires the payer (your Co-op) to withhold tax from the payment and remit it to the ATO. The standard Foreign Royalty Withholding Tax rate is 30%, though this is often reduced (usually to 5% - 15%) if Australia has a Double Tax Agreement (DTA) with the supplier’s home country.

How do you withhold tax on a Crypto payment?

This is where the accounting gets highly technical. You cannot send crypto to the ATO. If you owe a $10,000 AUD equivalent royalty to an overseas supplier, and the withholding rate is 10%:

1. Withhold: You must withhold $1,000 AUD worth of the payment.

2. Remit: The Co-op pays $1,000 in AUD fiat directly to the ATO.

3. Transfer: The Co-op transfers the remaining $9,000 AUD equivalent in cryptocurrency to the supplier's overseas wallet.

4. Report: The Co-op provides a payment summary to the supplier and lodges a PAYG annual report with the ATO.

Even if the supplier operates entirely in Web3, refuses to use a bank, and wants the full amount in crypto, the Australian Co-operative bears the legal liability for the withholding tax. If you fail to withhold it, the ATO will force your Co-op to pay the tax out of its own pocket, plus penalties.

Standard off-site services attract a 0% withholding rate. An international supplier working entirely overseas is exempt from needing an ABN. These services include:

• Remote Software Development: A freelancer in India writing code for your app.

• Digital Marketing: A contractor in Europe managing your social media ads.

• Customer Support: A call centre in the Philippines handling your customer inquiries.

• Graphic Design: A studio in the US creating a new logo and branding assets for you.Virtual Assistance

• Paralegal support, accounting, and bookkeeping services performed entirely overseas qualify as standard off-site services, meaning no foreign resident withholding tax is required.

• If paying an offshore company for standard SaaS or API access solely for your own internal business operations, it is generally treated as a service rather than a royalty. Under the Australian Taxation Office (ATO) guidance on software and cloud transactions, this is classified as a standard commercial service rather than a royalty. Your co-operative is acting as a standard customer or end-user. You are paying the offshore vendor simply to use their live software application to process your own data, manage your internal tasks, or track your co-op records. Ensure your contract with the supplier states you are acquiring a non-exclusive, internal end-user licence to use the platform as designed. It must explicitly omit any rights to modify, copy, or commercially distribute the code. Check your SaaS/API agreement for an embedded "Gross-Up" clause. If the ATO audits your co-op and determines the fee was a royalty, a gross-up clause means you must pay the withholding tax out of your own pocket on top of what you already paid the foreign vendor.

Summary Checklist for Business Owners

If your ACNC Co-operative is entering the global, crypto-powered digital economy, ensure you have the following framework in place:

• Member Contracts: Ensure all "income distributions" to local members are legally structured as commercial service agreements or charitable grants, never as profit dividends.

• IP vs. Service Assessment: Clearly define whether the overseas payment is for a service or a royalty to determine your ATO withholding tax obligations.

• Fiat to Crypto Off-Ramp: Maintain a clear ledger showing the conversion of Co-op fiat into crypto, timestamped with the AUD value at the exact moment of the overseas transfer.

• Audit Trail: Keep the foreign invoice, the commercial agreement, and the blockchain TxID saved in your accounting software for a minimum of five years.

Need to Structure a Cross-Border Tech Entity?

Bridging the gap between Australian charity law, international IP licensing, and decentralised crypto payments requires a meticulous legal strategy.

At James Wan & Co., we help organisations build compliant, scalable legal architectures for the modern digital economy. Contact us today to ensure your co-operative’s cross-border payments and member agreements are commercially robust and legally secure.

If you provide professional services, website creation, strategic consulting, or digital assets (like cryptocurrency security), you are asking your clients to buy a promise. You are asking them to trust your competence before they ever see the final result.

In the service and digital economy, trust is a highly monetisable asset. While standard trade marks protect your specific brand name, there are two specialised, underutilised legal tools under the Trade Marks Act 1995 (Cth) designed specifically to turn industry trust into recurring revenue: Certification Trade Marks and Collective Trade Marks.

Here is a commercial guide to understanding these rare trade marks and how they can create a competitive moat around your intangible services.

1. The Collective Trade Mark

A collective trade mark is exclusively owned by an "association" (like an industry group, a co-operative, or a professional alliance). Its sole purpose is to tell the market: "The person providing this service is a member of our vetted group."

Unlike a standard trade mark, which distinguishes the services of one business from another, a collective mark distinguishes the services of members from non-members. And while a certification mark proves what you have achieved, a collective trade mark proves who you belong to. Its sole purpose is to tell the market: "The person providing this service is a vetted member of our elite group."

By law, a collective mark can only be owned by an "association". While associations can be unincorporated, running a commercial venture this way is risky. This is why many groups turn to the Co-operative structure to hold and monetise their collective mark.

Why a Co-operative?

Under the Co-operatives National Law (which applies across Australian states and territories), a co-operative is a distinct, incorporated legal entity governed by a board of directors. Because it is a legal entity, the co-operative can hold property, including trade marks, in its own name.

Setting up a Co-operative in Australia:

• Minimum Members: You must have a minimum of five (5) members to form a co-operative.

• The Rules: The co-operative must draft a constitution (its rules) and an initial disclosure statement.

• Incorporation: Once the rules are approved by the members at a formation meeting, the co-op is officially registered with the relevant state authority (such as NSW Fair Trading).

Managing Members: Joining and Expulsion

Co-operatives operate on the principle of "active membership".

• To join: A new service provider applies to the board, agrees to abide by the rules, and pays a joining fee, or purchases share capital.

• To be removed: If a member produces sloppy work, damages the brand, or fails to maintain their active membership requirements, the board can use the dispute resolution and disciplinary procedures outlined in the co-op’s rules to expel them. Once expelled, the member automatically loses the legal right to use the collective trade mark.

How it generates income

Unlike a certification mark, the co-operative's rules do not need to be approved by the ACCC. The collective uses the mark to generate revenue that funds the group and provides returns to the members:

1. Membership Fees and Share Capital: Members pay annual dues for the right to use the mark. If it is a "distributing co-operative," members can buy shares to fund the organisation's growth.

2. Pooled Marketing ROI: The co-operative uses the membership fees to market the collective trade mark to the public aggressively. Clients learn to look for the mark, driving highly qualified leads directly to the members.

3. Profit Sharing: In a distributing co-operative, surplus funds generated from membership fees or lead-generation commissions can be distributed back to the members as dividends.

How it Works for businesses

Imagine you and twenty other elite freelance software developers form an incorporated association. You want to distinguish yourselves from cheap, overseas coding farms. You register a collective trade mark, perhaps a specific logo denoting "The Australian Clean Code Alliance."

• No complex licensing: Any member of your association can use the logo on their website, proposals, and LinkedIn profiles without needing to sign a formal, individual intellectual property licence agreement.

• Internal governance: If a member produces sloppy code, the association relies on its internal rules to revoke their membership, thereby stripping their right to use the mark. The Australian Competition and Consumer Commission (ACCC) does not need to approve these internal rules.

• Group enforcement: If an outsider illegally slaps your collective mark on their website, a claim for financial relief can take into account the damage suffered by each individual member of your association.

The Trade-Off: Collective trade marks cannot be sold, assigned, or transmitted to another party. They are forever tied to the association. Because of this, they are incredibly rare, accounting for only a few hundred of the nearly 800,000 registered trade marks in Australia.

How it works for a crypto business

A group of freelance Web3 developers create a Decentralised Autonomous Organisation (DAO). However, a DAO is not a recognised legal entity in Australia. To commercialise their brand, they formally incorporate as a distributing co-operative: "The Genesis Developer Co-op."

The Co-op registers a collective trade mark. As crypto clients are notoriously fearful of being scammed by anonymous freelancers, they learn that hiring someone with the "Genesis" mark guarantees a vetted, highly skilled professional. The Co-op generates income by charging independent developers a $2,000 annual membership fee to use the mark, plus a 5% commission on contracts sourced through the Co-op's marketing engine.

2. The Certification Trade Mark

A certification trade mark does not distinguish your business from another; it guarantees that a service or product meets a highly specific, verifiable standard.

Legally, the owner of a certification mark acts as an independent gatekeeper. You cannot use the mark on your own services. Instead, you create the standard, and you allow others to display your mark—if they pass your tests. Because it acts as a public guarantee, the Australian Competition and Consumer Commission (ACCC) must approve the rules governing the standard before IP Australia will register the mark.

How it Generates income

Operating a certification mark turns your business into a regulatory body for your niche. Income is generated through the compliance lifecycle:

1. Application and Auditing Fees: You charge businesses a premium fee to test or audit their services against your standard.

2. Annual Licensing Dues: Once a business passes, they must pay a recurring annual fee to retain the legal right to display your certification mark on their marketing materials.

3. Accreditation and Training: You can mandate (and sell) proprietary training courses that professionals must complete before they can apply for certification.

How it works for businesses

If your consultancy provides data privacy audits, you might create a proprietary "Zero-Risk Data Framework." If you register a certification trade mark for this framework, you are creating a new industry standard.

Other IT consultants can apply to you to have their services audited. If they pass, they are allowed to display your certification mark on their marketing materials.

• The ultimate authority: As the owner of the certification mark, you act as the gatekeeper of quality.

• The separation of powers: Legally, the owner of a certification mark cannot use the mark on their own services. You are the certifier, not the certified.

• ACCC oversight: Because a certification mark is a public guarantee of quality, you must submit a strict set of rules governing how the standard is tested and enforced. In Australia, IP Australia will not register the mark until the ACCC approves your rules to ensure they are fair and not anti-competitive.

How it works for a crypto business

Imagine a cybersecurity firm specialising in blockchain technology. They register a certification trade mark for a standard they invent: the "Zero-Exploit Verified" seal.

They do not use this seal on their own software. Instead, they operate as the auditor. When a new Decentralised Finance (DeFi) crypto platform wants to launch, they desperately need to prove to investors that their smart contracts won't be hacked. The DeFi platform pays the cybersecurity firm a $30,000 auditing fee. If the code passes the strict rules approved by the ACCC, the DeFi platform pays a $5,000 annual licensing fee to display the "Zero-Exploit Verified" mark on their website, instantly earning investor trust.

Collective vs. Certification Marks: At a Glance

If you are considering uniting your industry or establishing a gold standard for your profession, here is how the two compare:

Why Should a Business Care?

Building a brand in the intangible space is notoriously difficult. Clients cannot objectively measure the "quality" of your strategic advice or your website design until long after the invoice is paid. Building a brand in the intangible space requires more than just good marketing; it requires legal strategy. By leveraging Certification and Collective Trade Marks, you can establish the gold standard in your industry, create enforceable barriers to entry, and unlock entirely new, recurring revenue streams. You can achieve three powerful commercial outcomes:

1. Premium Pricing: Clients will pay a premium for a service that carries a verified stamp of quality or exclusive membership, effectively removing you from the race-to-the-bottom price wars.

2. Instant Authority: Whether you are building an industry guild (Collective) or establishing a rigorous training standard (Certification), you position your organisation as the definitive leader in your niche.

3. Market Differentiation: In a sea of consultants claiming to be "experts," a federally registered Collective or Certification mark acts as a legally enforceable proof of competence.

Are you ready to establish the standard in your industry?

Whether you are an industry association looking to protect your members, forming a commercial co-operative to protect your freelance network or developing a new certification standard for your industry, or an innovator wanting to certify a new professional standard, the IP team at James Wan & Co. can guide you through the complexities of non-standard trade mark applications. Contact us today to discuss your strategy.

According to global financial studies, intangible assets, ranging from brand names and software code to proprietary processes and creative works, account for up to 90% of the market value of S&P 500 companies.

Despite this, many business owners still view Intellectual Property (IP) as an abstract legal concept rather than what it truly is: income-generating capital.

In this guide, we break down the core types of intangible assets in plain business English, explore their financial and tax treatments (from Australia’s AASB 138 to Singapore’s groundbreaking Intangibles Disclosure Framework), and close with a fascinating real-world case study: why the Amazon marketplace is flooded with bizarre, "keyboard-smash" trademark names.

Part 1: Income-Generating Intangible Assets

Intangible assets generate income through several main channels:

• Licensing fees: Permitting third parties to use your IP in exchange for recurring payments.

• Royalties: Earning a percentage of sales generated from your IP.

• Usage/Subscription fees: Charging users to access your platform, code, or content.

• Capital appreciation: Selling the asset outright or leveraging it to increase your business valuation during a capital raise or exit.

Here is a breakdown of the primary intangible property types every business owner should understand:

Copyright (Books, Music, Art, Software)

• Creation vs. Registration: In Australia and most International Financial Reporting Standards (IFRS) jurisdictions, copyright arises automatically upon creation. You do not pay a government filing fee to acquire copyright; your primary cost is the cost to create (e.g., author fees, graphic designer rates, or software engineer salaries).

• Cost to Create vs. Income Potential: Software code might cost $100,000 to develop, but if distributed as a SaaS product, it can generate millions in recurring subscription revenue at near-zero marginal cost. Similarly, a single musical composition or book can generate decades of passive royalty checks across streaming services, publishing houses, and global syndication deals.

Part 2: Creation Cost vs. Income & Accounting Standards

From an economic perspective, intangibles offer immense leverage. Unlike a delivery truck, which can only be in one place at one time and depreciates with wear and tear, a piece of software, a trademark, or a digital artwork can be licensed to thousands of people simultaneously without degrading the core asset.

However, accounting for these assets requires adherence to financial standards.

                  ┌─────────────────────────────────────────┐
                  │      INTANGIBLE ASSET RECOGNITION       │
                  └────────────────────┬────────────────────┘
                                       │
                   Is it internally generated R&D?
                                       │
                    ┌──────────────────┴──────────────────┐
                    ▼                                     ▼
         [ Research Phase ]                    [ Development Phase ]
     Expense immediately to P&L              Capitalise as Intangible
   (e.g., exploratory testing)              Asset under AASB 138 / IFRS
                                            (if 6 criteria met)

AASB 138 & ATO Treatment in Australia

In Australia, AASB 138 Intangible Assets governs how businesses recognise, measure, and amortise intangible property.

Under AASB 138, an intangible asset must be:

1. Identifiable (capable of being separated/sold, or arising from legal rights).

2. Controlled by the entity (ability to obtain future economic benefits and restrict others).

3. Expected to generate future economic benefits.

Capitalisation vs. Expensing (The R&D Distinction)

AASB 138 forces businesses to separate internal asset creation into a Research Phase and a Development Phase:

• Research Costs: Must be written off immediately as an operating expense in your Profit & Loss statement.

• Development Costs: Can be capitalised onto your Balance Sheet as an asset if you can demonstrate technical feasibility, intention to complete, ability to use/sell, and probability of future economic inflow.

ATO Tax Treatment: The Australian Taxation Office (ATO) differentiates between revenue expenses (deductible immediately) and capital expenditure. Capitalised intangible assets (such as in-house software or acquired patents) are generally written off over their effective economic life under tax depreciation rules (Capital Allowances).

The Global Advantage: IFRS vs. US GAAP

If your business operates under International Financial Reporting Standards (IFRS), which Australia (AASB), the United Kingdom, and the European Union use, you enjoy significantly more flexibility than companies subject to US GAAP.

• Under US GAAP: Rules are highly conservative. Almost all internally generated R&D and intangible asset development must be expensed immediately, preventing companies from showing these valuable assets on their balance sheet.

• Under IFRS / AASB 138: Once a project hits the development milestone, those costs can be capitalised, boosting your balance sheet equity, improving debt-to-equity ratios, and presenting a far truer picture of company value to investors.

Singapore’s Pioneering Framework (FRS 38 / SFRS(I) 38 & IDF)

Singapore has taken intangible asset commercialisation a step further. Alongside its SFRS(I) 38 standard (fully aligned with IFRS), Singapore introduced the Intangibles Disclosure Framework (IDF).

The IDF provides a standardised blueprint built on four pillars, Strategy, Identification, Measurement, and Management (SIMM), allowing companies to clearly communicate the value of their IP to banks, venture capitalists, and auditors. This framework enables businesses to use their IP portfolios to secure direct bank debt and equity financing.

Part 3: The E-Commerce Case Study: Amazon Brand Registry & The "Gibberish" Trademark Phenomenon

To see the practical intersection of trademark law, asset creation, and modern commercial strategy, we look at a curious phenomenon dominating global marketplaces like Amazon.

If you have ever searched Amazon for a phone charger, a garlic press, or a set of cable ties, you have likely encountered brand names that look like complete keyboard mashes: "QWOPR", "XINXIN", "ZESZICAN", or "TRONJIK".

Why are sellers choosing unpronounceable nonsense over memorable brand names? The answer lies in Amazon Brand Registry and trademark examination rules.

                     TRADITIONAL BRANDING vs. AMAZON "GIBBERISH" STRATEGY
                     
  [ Traditional Brand Strategy ]               [ Amazon "Keyboard Smash" Strategy ]
  • Months spent naming & testing              • Random, meaningless letter combo
  • Focus: Emotional connection & loyalty      • Focus: Fast trademark approval
  • High risk of "Descriptiveness" rejection   • 0% chance of "Descriptiveness" rejection
  • High risk of prior trademark conflict      • Almost 0% chance of prior conflict
  • Long-term enterprise brand equity          • Instant access to Amazon Brand Registry

The Amazon Incentive

To unlock Amazon’s most powerful seller tools, A+ content, dedicated Brand Stores, protection against listing hijackers, and advanced advertising, sellers must enrol in Amazon Brand Registry. The prerequisite to enrol? A pending or active registered trademark.

The E-Commerce Seller’s Dilemma

Many cross-border sellers and white-label manufacturers sell commoditised items. Their end customers don't care about brand affinity; they care about price, fast shipping, and 5-star reviews.

If a seller tries to register a sensible, descriptive name like "Super Soft Towels" or "QuickCharge Cable", trade mark offices (like IP Australia or the USPTO) will reject the application under Descriptiveness rules. If they pick a common real word, they run a high risk of getting rejected due to a Likelihood of Confusion with existing registered trademarks.

The "Keyboard Smash" Legal Hack

To bypass months of legal back-and-forth and avoid rejection, these manufacturers deliberately invent completely meaningless "fanciful" words:

1. Zero Descriptiveness Risk: A word like "QWOPR" describes nothing, so trade mark examiners cannot refuse it on descriptiveness grounds.

2. Zero Conflict Risk: It is practically impossible that another company has registered the same gibberish letter sequence.

3. Speed to Registry: The trademark breezes through the examination stage with zero office actions, allowing the seller to enrol in Amazon Brand Registry in record time.

For these sellers, the trademark is not an asset built for long-term customer loyalty. It is simply a regulatory key designed to unlock Amazon’s search algorithms, secure buy-box protection, and start generating immediate sales.

Whether you are a fast-moving e-commerce brand securing trademarks to dominate online marketplaces, a software company capitalising R&D under AASB 138, or an established enterprise looking to structure licensing and royalty agreements, your intangible assets require a clear strategy.

At James Wan & Co., we bridge the gap between legal protection, commercial strategy, and financial reality. We help Australian and international businesses:

• Audit and identify unrecognised intangible property.

• Draft robust licensing, royalty, and distribution agreements.

• Register and defend national and international trademarks, designs, and patents.

• Structure IP portfolios to maximise company valuation during capital raises or exits.

Ready to turn your intangible property into an income-generating machine? Contact the team at James Wan & Co. today to schedule a strategic IP consultation.

Obsidian is an incredibly powerful tool for organising your thoughts, projects, and daily notes. However, because Obsidian stores files directly on your computer rather than in the cloud, getting your notes to sync to your Android phone can feel a bit tricky at first.

While Obsidian offers a premium paid sync service (or pay for the recurring Obsidian Sync - Standard service 1GB = US$28.80 for 1 year with education discount), you can easily set up a completely free, automated sync using Google Drive. Here is the exact, step-by-step method to get your desktop and mobile notes talking to each other.

Step 1: Create a new dedicated "Notes" Google Account

To keep your vault secure and prevent your personal or work files from getting mixed up, we highly recommend creating a brand-new, free Google account dedicated solely to your Obsidian notes. Google provides 15 GB free.

• Pro-Tip: Make it easy to remember by mirroring your current email address and adding ".notes" to it.

• Example: If your normal email is john.doe@gmail.com, create your new account as john.doe.notes@gmail.com.

Step 2: Install the DriveSync App on your phone

Since the official Google Drive app on Android doesn't let Obsidian read your files directly, we need a "bridge" app to do the heavy lifting in the background.

1. On your Android phone, download the free DriveSync app (also known as AutoSync for Google Drive) from the Google Play Store.

2. Open the app and Allow it the storage permissions it asks for.

3. Tap Connect to Google Drive and log in using the new john.doe.notes@gmail.com account you just created.

Step 3: Configure Your Sync Settings

Now we need to tell DriveSync exactly which folders to connect.

1. In the app, choose to set up a Synced Folder (also called a Folderpair).

2. For the Sync Method, strictly select Two-way. This ensures that notes you write on your phone go to your PC, and notes you write on your PC go to your phone.

3. Filter out the junk: To keep your sync lightning-fast, you want to ignore background system files. Check the box for "Select files by name".

4. You will be asked to configure inclusion/exclusion patterns. You can find the exact text you need to copy and paste on this DriveSync Ultimate – Obsidian Inclusion/Exclusion Name Patterns GitHub page.

Step 4: The Home Screen Shortcut

Once your setup is complete, DriveSync will quietly work in the background. However, if you want total control to force a sync before you open Obsidian on your phone, there is a great shortcut!

• Go to your Android phone's home screen.

• Long-press on an empty space and open your Widgets menu.

• Find the DriveSync widget and drag it to your home screen. Now, you can trigger a manual sync with a single tap, without ever having to open the app itself. Its a green icon with a circular white arrow.

How to bring your existing knowledge into Obsdian

Go to Google Takeout https://takeout.google.com/

click "Create Export"

Use a Python script to convert the JSON and HTML files to .md format for Obsidian.

To avoid costly litigation and business interruptions, it's important to understand the liabilities associated with data scraping and how to govern your data collection practices.

How is data collected?

Understanding how data is collected is the first step in risk management.

In this case, the defendants deployed internet browser extensions (named "UpVoice" and "Ads Feed") via the Google Chrome Store to silently extract data from users' sessions on platforms like Facebook and Instagram. By using users' browsers as proxies, the defendants sent unauthorised, automated commands to Facebook's servers to harvest both public and non-public data.

Commercial and legal risks

If your business uses or profits from unauthorised data scraping, you expose your operations to significant legal actions. The salient risks demonstrated in this case include:

Binding Terms of Service: Simply creating an account or a business page on a platform binds your business to its Terms of Service. Facebook and Instagram’s policies expressly prohibit accessing or collecting data using automated means without prior permission.

Breach of Contract: By using automated scripts to bypass platform rules and harvest user profiles, ad preferences, and engagement metrics, the defendants committed a direct breach of contract.

Unjust Enrichment: Packaging and selling unauthorised scraped data as "marketing intelligence" or "competitive insights" exposes your business to unjust enrichment claims. Platforms will aggressively protect their proprietary data ecosystems.

Severe Financial Penalties: The financial exposure in these lawsuits extends far beyond standard compensatory damages. Plaintiffs can demand an accounting and "disgorgement" of profits, meaning your business could be legally forced to surrender all revenue generated from the illicit data harvesting.

Destruction of Business Assets: Courts can issue permanent injunctions requiring a business to identify and permanently delete all data obtained through unauthorised means, effectively crippling business models that rely on that data.

Managing your risk

To protect your business, please proactively audit your data acquisition strategies. You must verify that any data collection tools, browser extensions, or third-party data vendors your business relies on strictly comply with the target platforms' Terms of Service. Relying on unauthorised "dark" marketing intelligence or scraping techniques carries an unacceptable risk of immediate technical enforcement, account termination, and crippling civil litigation.

To protect your business and stay compliant, it is important to understand the penalties and how to manage these risks.

The Financial and Legal Consequences

If your business incorrectly treats an employee as an independent contractor, you risk receiving several severe penalties and charges. These include:

PAYG Withholding Penalties: Your business can incur a PAYG withholding penalty for failing to deduct tax from worker payments and send it to the ATO.

Super Guarantee Charge (SGC): You may be liable for the SGC, which ultimately costs more than the superannuation that would have been paid had the worker been classified correctly from the start. The SGC comprises a super guarantee shortfall amount, nominal interest, and an administration fee.

Additional Superannuation Penalties: Beyond the SGC, you may face additional super guarantee penalties. This includes the Part 7 penalty amount, which can be up to 200% of the SGC under the Superannuation Guarantee (Administration) Act 1992.

Sham Contracting Contraventions: Incorrectly classifying an employee as an independent contractor when they are actually an employee is known as sham contracting, which is a contravention under the Fair Work Act 2009. Courts have the authority to impose penalties on a business or an individual for this conduct.

Risk of Public Reporting

The risk of discovery is high. If anyone knows or suspects that your business is incorrectly treating an employee as an independent contractor, they can report your business directly to the ATO by making a tip-off.

Mitigating Your Commercial Risk

To protect your business, please proactively assess your workforce arrangements. You must correctly determine whether a worker is an employee or an independent contractor before engaging them. Additionally, if a worker requests to be treated as an independent contractor, you must be aware of the specific legal steps and implications involved.

Ensure you are relying on accurate information for the correct financial year before making any commercial decisions based on worker classification.

What the Tribunal clarified

1) Facial recognition is “biometric information” and therefore “sensitive information”

The Tribunal confirmed that facial images used for automated matching and the biometric templates derived from them constitute biometric information. Under the Privacy Act, biometric information used for automated biometric verification or identification is treated as sensitive information and attracts higher protections. Even if the system deletes non-matching data quickly, the Tribunal treated the processing as a “collection” step for Privacy Act purposes.

2) Collection without consent can be lawful in a “permitted general situation,” but only on evidence

The most important aspect for businesses is the Tribunal’s acceptance that biometric collection without consent may be lawful where an organisation can rely on the “permitted general situation” exception (often described in practice as an unlawful-activity/safety-risk exception). The test is whether the organisation reasonably believes the collection is necessary to prevent or respond to serious unlawful activity or safety risks.

Two practical points flow from the Tribunal’s approach:

• The organisation does not need to prove that facial recognition was the only option available, but it must show that the belief was objectively supportable.

• The analysis must be evidence-based. Assertions of “safety” or “theft prevention” without an incident history and a clear rationale for necessity are unlikely to be sufficient.

Why Bunnings succeeded on the “permitted exception” point (and why this is not a blanket approval)

The Tribunal accepted Bunnings’ security justification based on the record before it: serious repeat offending, evidence of violence and abuse towards staff, the limits of alternative controls, and system features designed to reduce privacy impact (including rapid deletion of non-matches and restricted access to watchlists).

The Tribunal made it clear that this was a fact-specific outcome and not a general endorsement of retail facial recognition. Businesses should treat the decision as guidance on what a defensible necessity case looks like, not as permission to deploy FRT as a standard loss-prevention tool.

The warning: “lawful collection” is not the end of the compliance task

Even though Bunnings succeeded on the threshold question of whether consent was required in those circumstances, the Tribunal still upheld breaches relating to notice, privacy governance, and privacy policy disclosures.

Key failings included:

• generic “video surveillance” signage that did not adequately inform individuals about biometric collection and automated matching

• insufficient transparency in privacy policy settings about the use of FRT

• weak privacy governance at rollout, including the absence of a robust privacy impact assessment and supporting documentation that would normally be expected for biometrics.

How this decision fits with recent OAIC enforcement activity

This decision aligns with a clear enforcement pattern in Australia: regulators focus heavily on notice, consent, proportionality, and demonstrable governance in biometric deployments.

• Kmart: In September 2025, the Privacy Commissioner found Kmart’s use of FRT to tackle refund fraud unlawful, including for collecting biometric information without consent and failing to meet notification requirements. See the OAIC's decision here.

• 7-Eleven: The OAIC has also addressed governance failures in biometric deployments, including an incident in which a service provider inadvertently re-enabled FRT functionality, which remained active for approximately 12 months before detection and deactivation. See the OAIC's decision here.

The lesson is consistent: even when a security or business objective is legitimate, organisations materially increase breach and enforcement risk by under-resourcing the transparency, control environment, and documentary record, particularly for biometrics.

Practical takeaways for business decision-makers

1. Assume FRT is sensitive biometric collection
   Treat facial recognition deployments as high-risk from the outset, even if biometric data is held briefly or deleted for non-matches. Design and governance should assume APP obligations will apply.

2. If relying on a permitted exception, “show your working”
   If you intend to collect biometrics without consent, you need an evidence-based necessity case: incident data, an explanation of why less intrusive measures are insufficient, and an explanation of why the proposed design is proportionate. The safest way to structure this is to complete a privacy impact assessment as part of the decision-making process, not after deployment.

3. Build proportionality and safeguards into system design from day one
   Examples of safeguards that supported Bunnings’ case included limited watchlists, restricted access, and rapid deletion of non-matches. Organisations should adopt a “minimise impact” design approach and document how each control reduces privacy risk.

4. Do not treat notice and privacy policy updates as administrative tasks
   The Tribunal’s findings underscore that transparency failures can lead to breach findings even when the underlying collection is accepted. Signage, front-of-house notices, and privacy policy disclosures must clearly address biometric collection and automated matching, not just general CCTV.

5. Treat vendor/device controls as a compliance risk
   The 7-Eleven incident demonstrates how vendor maintenance actions can inadvertently reintroduce biometric processing. Contracts, device configuration controls, auditability, and monitoring should be designed to detect and prevent unauthorised reactivation or configuration drift.

Bottom line

This Tribunal decision indicates that FRT can be deployed lawfully in Australia in narrow, well-justified security settings. But it also sets a stricter practical standard: businesses should assume that biometric programs will fail Privacy Act scrutiny unless necessity, proportionality, governance, and transparency are established and evidenced before rollout, not retrofitted after issues arise.

At the same time, enterprise adoption continues to outpace governance maturity. McKinsey’s 2025 global survey reported 88% of respondents said their organisations were using AI in at least one business function. As AI use expands into customer interactions, credit and pricing, HR decision support, and safety-critical or regulated settings, legal teams need to help the business make defensible decisions about risk appetite, controls, and accountability.

Below are five practical priorities for 2026, framed for decision support.

1) Move from principles to a documented AI risk program

In 2026, “we have AI principles” is unlikely to be sufficient where AI affects customers, employees, or regulated operations. The compliance direction in multiple jurisdictions is towards risk-based classification, pre-deployment assessment, monitoring, and incident response.

• EU AI Act timeline: The European Commission’s public timeline confirms the AI Act entered into force on 1 August 2024 and becomes fully applicable on 2 August 2026, with staged obligations and some extended transition periods (including for certain high-risk systems embedded in regulated products).

• Vietnam AI Law: Vietnam enacted a standalone AI law in December 2025, effective 1 March 2026, with a risk-based structure that includes system classification and assessment expectations for higher-risk systems.

• Colorado AI Act (US): Colorado’s SB24-205 imposes obligations on deployers of “high-risk” AI systems and includes effective dates beginning 1 February 2026 for key deployer duties.

What in-house legal should drive internally in 2026:

• A clear definition of what counts as an “AI system” for internal governance (including third-party embedded AI).

• A classification method (low/medium/high impact) that ties to controls and approval pathways.

• A repeatable pre-deployment review for higher-impact use cases (legal, privacy, security, model governance, human oversight, and testing requirements).

• Ongoing monitoring, change control (model updates, prompt changes, retraining), and incident response playbooks.

2) Make transparency obligations operational, not just policy statements

Transparency is becoming a consistent regulatory requirement: people should understand when they are dealing with AI, and organisations should be able to explain the role AI played in significant outcomes.

• The EU AI Act includes staged transparency obligations and related requirements across categories of AI systems and models.

• South Korea’s AI Basic Act took effect on 22 January 2026 and includes transparency measures (including labelling expectations for AI outputs) and requirements addressing “high-impact” AI.

• In Australia, privacy reforms introduce a new transparency requirement for automated decision-making disclosures in privacy policies, effective from 10 December 2026 (applicable where personal information is used to make, or substantially influence, decisions that could reasonably be expected to significantly affect an individual’s rights or interests).

Decision support actions for legal teams:

• Require product and procurement teams to document where AI is user-facing, and what disclosures are triggered by geography and use case.

• Ensure external statements (marketing, customer support scripts, product documentation) align with how the system actually behaves and its limitations.

• For high-impact decision pathways (credit, pricing/eligibility, employment), ensure there is a documented explanation framework, logging, and a human escalation path.

3) Treat safety, bias, and vulnerable-user risk as core compliance themes

In 2026, regulators are increasingly focused on foreseeable and preventable harms: discriminatory outcomes, unsafe content experiences (especially for children), and failures to control high-impact applications.

• The Colorado AI Act explicitly targets “algorithmic discrimination” risks for high-risk systems and sets out compliance expectations for deployers.

• In the EU, high-risk categories include employment and access to essential services, where bias and explainability are central.

Practical steps:

• Require bias and performance testing proportional to the decision's impact, not the model's novelty.

• Ensure a defined owner for “harm prevention” controls (content safety, vulnerable cohorts, complaint handling, rapid rollback).

• Build a clear escalation route for situations where AI outputs could raise safety concerns, coercion, or discrimination.

4) Converge AI governance with privacy and cybersecurity programs

For most organisations, the biggest AI risk is not “the model” in isolation; it is how the model is connected to data, internal systems, identity/access controls, and external channels.

• NIST released a preliminary Cyber AI Profile on 16 December 2025, designed to integrate AI considerations into established cybersecurity governance and risk management practices.

• Australia’s forthcoming privacy transparency requirements for automated decision-making will raise the compliance bar for mapping decision flows and the use of personal information by December 2026.

Decision support actions:

• Treat AI systems as “sensitive assets” in your security and third-party risk registers (access, logging, incident response, and monitoring).

• Align procurement requirements so vendors provide usable information on training data practices, security controls, incident notification, and audit support.

• Ensure “AI-enabled” cyber risks are covered: prompt injection, data leakage pathways, model misuse, and tool access abuse.

5) Copyright and training data provenance remain live commercial risks

Copyright and training data issues will continue to drive litigation, regulatory attention, and contractual disputes. For deploying organisations, the practical risk is less academic infringement theory and more whether you can justify your use of tools and outputs in a way that withstands challenge.

A defensible posture generally requires:

• clarity on what tools are used and in what contexts (internal use vs external publication)

• contractual protections (warranties/indemnities where feasible, limitations understood)

• output controls for high-risk use cases (brand, advertising, product content, customer communications)

• a documented escalation process for takedown requests and claims

What a “2026-ready” legal plan looks like

A pragmatic legal work program for 2026 usually includes:

1. Inventory: where AI is used (including shadow AI and embedded vendor tools).

2. Classification: impact-based tiers with clear control requirements.

3. Controls: pre-deployment assessment, human oversight design, testing standards, logging, and change management.

4. Contracts: vendor due diligence, risk allocation, incident reporting, audit rights, and data handling terms.

5. Transparency: disclosures, privacy policy alignment, customer-facing communications controls.

6. Response: incident playbooks for safety, privacy, cyber, and legal claims.

The goal is not to slow adoption. It is to ensure the organisation can demonstrate, with evidence, that it identified foreseeable risks, implemented proportionate controls, and responded quickly when issues arise.

Reforms introduced by the Privacy and Other Legislation Amendment Act 2024 (Cth) add new transparency obligations to the Australian Privacy Principles (APPs) that commence on 10 December 2026.

This is not a theoretical compliance exercise. The Office of the Australian Information Commissioner (OAIC) announced it will begin 2026 with its first privacy compliance sweep, reviewing selected businesses’ privacy policies for compliance with existing transparency requirements.

For in-house counsel and business leaders, the immediate decision-support question is: what processes in the organisation are “automated decision making” for Privacy Act purposes, and what must be disclosed in the privacy policy by December 2026?

What is automated decision-making

An automated decision-making (ADM) system is a computerised process that assists or replaces human judgment in making decisions. ADM systems range from simple rule-based scoring (e.g., thresholds and eligibility criteria) to machine-learning and AI systems that infer risk, propensity, or likely outcomes from large datasets.

In practice, ADM is used to:

• approve, refuse or route applications and requests (credit, services, access, refunds)

• set pricing, eligibility or prioritisation (including differential pricing)

• triage, escalate or close customer complaints and service interactions

• detect fraud or non-compliance and trigger downstream actions

• support HR processes (screening, ranking, performance flags, workforce analytics)

The privacy implications depend on the personal information used, the impact on individuals, and the level of human involvement.

Why ADM creates specific privacy risk

ADM systems often rely on personal information and may aggregate data from multiple sources. Key risk areas include:

• Transparency risk: individuals may not understand that a decision was driven or materially shaped by a computer program, or what information was used.

• Integrity and fairness risk: historical datasets can embed bias or under-representation, which can produce systematically unfair outcomes (for example, persistent disadvantage to a cohort because past data reflects older structural inequities).

• Data minimisation and retention risk: ADM projects often expand the volume and variety of data collected and may retain data longer than necessary, as it is perceived as useful for “model improvement” or future analysis.

• Accountability risk: without clear logs and governance, it can be difficult to explain or challenge an outcome, even internally.

These are not only ethical issues. They are operational and regulatory risks, particularly where decisions affect access to services, employment opportunities, education, healthcare, or financial outcomes.

Existing transparency obligations under APP 1

APP 1 requires APP entities to manage personal information openly and transparently. This includes maintaining a clearly expressed, up-to-date privacy policy, available free of charge and in an appropriate format, that describes how personal information is managed (including categories of information collected, purposes, and disclosures).

APP 1 also requires practices, procedures and systems that support compliance with the APPs. In practical terms, that implies an ongoing program of review and maintenance rather than a “set and forget” privacy policy.

The new ADM transparency requirements commencing 10 December 2026

From 10 December 2026, APP 1 will include new requirements (APP 1.7 to 1.9) that require privacy policies to include specified information about the organisation’s use of ADM in certain circumstances.

Which decisions are in scope

The new transparency requirements cover decisions:

• made entirely by a computer program, and

• decisions that are substantially made or influenced by a computer program (including where there is a human involved, if the program has a substantial and direct role in making or influencing the decision).

This is important for governance: a “human in the loop” does not automatically remove a process from scope. Conversely, not every use of software in a decision will be captured; the focus is on whether the program is materially shaping the decision.

What must be disclosed in the privacy policy

Where the requirements apply, the privacy policy must include information about:

• the types of personal information used in the operation of the ADM system

• the types of decisions made solely by the ADM system

• the types of decisions for which a thing that is substantially and directly related to making the decision is made by the operation of the ADM system

The OAIC also notes that privacy policies are not expected to include every operational detail, and that a layered approach can be used to present information clearly and accessibly.

Increased regulatory scrutiny in 2026

OAIC privacy policy compliance sweep

The OAIC announced its first privacy compliance sweep will begin in the first week of January 2026, involving a targeted review of selected businesses’ privacy policies, focusing on sectors that collect personal information in person (for example, real estate/rental and property, car rental and car dealerships, chemists and pharmacists).

Transparency is a regulator priority

On 21 January 2026, the Australian Information Commissioner published a report reviewing how transparently Australian Government agencies describe their use of ADM on their websites. While that review relates to government and FOI settings, it reinforces the OAIC’s emphasis on transparency as a compliance theme for 2026.

Practical preparation steps for organisations

A defensible approach to the 2026 ADM transparency requirements usually involves four workstreams.

1. Identify in-scope decision processes

   • Map decisions that affect individuals (customers, staff, students, patients, members).

   • Identify where computer programs materially influence outcomes (scoring, ranking, recommendations, triage, auto-closures, eligibility gates).

2. Map personal information flows

   • What personal information is used?

   • Where does it come from (internal systems, third parties, inferred or derived fields)?

   • Who can access it, and how is it secured?

3. Assess risk and control design

   • What are the foreseeable failure modes (errors, bias, drift, over-collection)?

   • What controls exist (review points, thresholds, exception handling, logging, auditability)?

   • Are there clear accountabilities for model changes and rule updates?

4. Update privacy policy and supporting governance

   • Draft clear disclosures that meet the requirements of APP 1.8.

   • Ensure the policy is readable, navigable and consistent with actual practice.

   • Implement a maintenance process to ensure disclosures remain accurate as systems evolve.

The role of in-house counsel

In-house counsel is central to making this work practical and credible, because the task is not only legal drafting. It is organisational discovery and risk management.

In-house counsel can add the most value by:

• ensuring ADM uses are identified early (including in procurement and product design)

• distinguishing “decision support” tools from systems that materially influence decisions

• aligning privacy policy wording with actual system behaviour and operational controls

• driving internal accountability: who owns the system, who approves changes, who handles complaints or challenges

• keeping disclosures clear and usable, consistent with OAIC expectations for transparent privacy policies

Bottom line

By December 2026, many organisations will need to publicly explain in their privacy policies how automated decision-making uses personal information and materially influences decisions about individuals.

Given the OAIC’s early-2026 privacy policy sweep and broader transparency focus, the sensible approach is to treat 2026 as a preparation year: identify where ADM is already operating, assess what is in scope, and ensure privacy policy disclosures match reality.

A memorandum of understanding (MOU) is often used to record the key terms of a proposed transaction when:

• the parties are broadly aligned but still working through detail, or

• one or both parties are not ready to sign a full-form contract, but want a written record of current intent.

MOUs can also reduce wasted negotiation effort by confirming alignment before committing time and cost to drafting and negotiating definitive agreements.

The risk issue is that parties sometimes begin work, share information, or make operational decisions in reliance on an MOU. If negotiations later break down, disputes often turn on whether a promise in the MOU was legally enforceable. At that point, the key question becomes whether the MOU is a binding contract (in whole or in part) or a non-binding statement of intent.

What the law looks at

Whether an MOU is binding is determined by an objective assessment of whether the parties intended to create legal relations. Courts look at:

• the language used in the document (including any “subject to contract” wording)

• the commercial context

• the conduct of the parties at and after signing (for example, whether they commenced performance)

• the nature of the relationship and the transaction

MOUs are most contested where they contemplate the later execution of a formal contract. In that setting, the High Court decision in Masters v Cameron (1954) 91 CLR 353 is the starting point. Where the parties’ arrangement is “subject to contract”, it may fall into one of three categories:

1. Immediately binding, with later formalisation
   The parties intend to be bound immediately, and the later contract is intended to restate the terms more fully or precisely.

2. Binding bargain, but performance conditional on a later contract
   The parties have agreed on their deal and do not intend to depart from it, but they make performance of one or more obligations conditional on executing the formal contract.

3. Not binding unless and until a formal contract is executed
   The parties do not intend to be bound at all until the definitive agreement is signed.

If the arrangement falls into category 1 or 2, a binding contract exists, and contractual remedies (including damages) may be available for non-performance. If it falls into category 3, there is no contract and therefore no contractual claim for failure to proceed.

Which category applies depends on an objective assessment of what a reasonable person would understand the parties’ intention to be, taking into account the document and the surrounding circumstances.

Practical implications for deal management and risk

If you do not want the MOU to be binding

If it is not in your interests to be legally bound at that stage, do not rely on the title (“non-binding MOU”) alone. Use clear drafting that states the MOU is not intended to create legal relations, while dealing explicitly with any provisions you do want to be binding.

Common examples of provisions parties often want to be binding even where the commercial terms are non-binding include:

• confidentiality and restrictions on use/disclosure of information

• exclusivity / non-solicitation / standstill (if commercially required)

• costs allocation

• governing law and dispute resolution for the binding provisions

• return or destruction of information

If you want a genuine category 3 outcome (no binding agreement until definitive documents are executed), align the drafting and the parties’ conduct with that position. Commencement of substantive performance, issuance of directions, or treatment of the MOU as operationally effective may undermine its non-binding intent.

If you want the MOU to be binding

If the purpose is to secure a binding deal early (in whole or in part), include an express statement that the parties intend to be legally bound. You should also ensure the basic requirements for contract formation are satisfied, including:

• certainty of terms (the obligations must be sufficiently clear to be enforceable)

• consideration (or another recognised basis for enforceability, depending on structure)

• scope clarity (what is binding now, what is deferred to later documentation, and what is conditional)

If the MOU is intended to operate as a binding interim arrangement, address the transition to the final contract. For example:

• specify key conditions that must be satisfied before a definitive agreement is executed

• include an express right to terminate the interim arrangement if the formal contract is not agreed by a defined date

• clarify what happens to work-in-progress, deliverables, and costs if the definitive agreement is not finalised

Bottom line

The binding effect of an MOU is driven by objective intention and context, not by the label on the front page. From a decision-support perspective, the key is to be explicit about (1) whether the parties intend legal enforceability now, (2) which provisions are binding and which are not, and (3) how the parties should behave between signing the MOU and signing the definitive agreement.