Australia

Global Access Annual Review - 2025 - Colin Biggers & Paisley.

Key Developments in 2025

The Australian market faces challenges and emerging risks similar to other jurisdictions. While the overall economy is relatively strong, inflation sensitive sectors such as construction, hospitality, and retail remain vulnerable, as evidenced by record-level insolvencies in the SME space, and the ongoing economic, social and political turbulence on a global scale still casts a shadow on our sunburnt country.

Cyber risk and privacy remain top of mind for companies, their leaders and insurers, with a survey

by CrowdStrike showing the Australia/New Zealand region as the third most targeted globally, with 78% of respondents experiencing at least one ransomware attack in the past year.

There have been changes in cyber law include the mandatory reporting of ransomware payments, and minimum-security standards for smart device security. From 10 December 2025 age-restricted social media platforms must take reasonable steps to prevent Australians under 16s from having accounts.

ASIC continues its focus on failures by companies to have adequate cyber security with prosecutions commenced against FIIG Securities and Fortnum Private Wealth.

There have also been significant developments in Australian privacy law this year, with a statutory tort for a serious intrusion into privacy commencing on 10 June 2025. This adds additional risk for companies and opens up the potential for class actions arising from any breach. The first civil penalty for the breach of privacy saw pathology provider Australian Clinical Labs ordered to pay $5.8m.

In the construction space, New South Wales has substantially unwound reforms enacted in 2004 which displaced joint and several liability. The proportionate liability regime is, in practical terms, at an end for construction professionals marking a return to the routine filing of contribution claims. This outcome increases the costs of managing disputes for builders, subcontractors, and professionals lacking delegation protection.

As to Victoria, the Building and Plumbing Commission has been established, combining the functions of various bodies that had regulated domestic building insurance, practitioner registration and dispute settlement divisions. The enabling legislation contemplates that this body will have certain powers to direct rectification works on buildings from 1 July 2026.

For institutional liability risks, the issues of vicarious liability, non-delegable duties of care, permanent stays in claims where the passage of time means witnesses are unavailable and evidence lost, and decisions to set aside prior deeds of settlement, continue to work their way through the courts and bring an element of uncertainty. While the High Court ruled on the issue of vicarious liability in the case of DP v Bird in late 2024, finding that there was not an employment relationship between the Diocese and the priest in question, the High Court is now considering a second matter in Diocese of Maitland-Newcastle v AA. The outcome is being closely watched, as the change in the interpretation of vicarious liability, together with legislative change foreshadowed in a number of States and Territories in 2026, will have wider implications than just historical abuse claims.

Scrutiny of the accountancy profession continues to increase, with rare regulatory moves now being made against top tier firms, including the notable successful action by the Tax Practitioners Board against PWC's former Australian Managing Partner.  ASIC has also stepped up its prosecution of tax promotion scheme advisors.

Australian D&O insurance and class action landscape is in a state of flux, with directors and officers continuing to face increasing levels of risks and regulation.

Corporate regulatory scrutiny and intervention also remains high, with the Australian Securities & Investments Commission  and the Australian Competition & Consumer Commission actively pursuing enforcement in the areas of ESG, greenwashing, cyber readiness and in general instances of general wrongdoing across the board.

Shareholder class action filings have slowed substantially due to landmark victories for defendants

and ongoing legal uncertainty. However, this current holding pattern may prove to be temporary

with appeals in Zonia Holdings Pty Ltd v Commonwealth Bank of Australia (CBA) and Crowley v Worley Ltd (Worley) on foot in the and plaintiffs are actively planning alternative paths to success. Meanwhile, filings in other class action areas - especially consumer and employment claims - are rising sharply, driven by plaintiff and funders shifting focus.

Private credit exposures continue to increase, highlighted by recent failures, industry warnings and

ASIC intervention. These traditional FI and PI risks present real challenges for directors and officers.

What to look out for in 2026

While many of the risks that have been on the agenda in 2025 remain top of mind, risks continuing to emerge further in 2026 including climate reporting, AI and privacy, modern slavery, forever chemicals and workplace matters, to name just a few issues of note.

The second tranche of the changes to Privacy Act is still awaited, which is anticipated to include the removal of small business exemption and employee records exemption. The introduction of requirements for disclosure of automated decision making in privacy policies will become effective on 10 December 2026. The rules for minimum security standards for the "Internet of Things" comes into effect on 4 March 2026.

AI presents both significant opportunities and risks for businesses and insurers. While adoption can drive efficiency, recent incidents highlight the dangers of misaligned AI-generated material, which have resulted in regulatory admonishment and reputational harm. Organisations should ensure that AI outputs meet government, regulatory, and social expectations to avoid professional negligence and potential class actions. Added to these risks is enhanced regulatory scrutiny, particularly where companies overstate their AI preparedness or capability - a practice increasingly referred to as “AI-washing.”

Mandatory climate reporting ramps up in 2026, as the second phase of the roll out makes a larger number of companies eligible. With directors being required to sign off on sustainability reports, this opens up another potential avenue of risk for this cohort and for the professional services firms who assist in the data that goes into the reports where misleading or overstated claims are detected. While ASIC are for now taking a pragmatic and proportional approach, this grace period will expire.

Consumer protection will continue to be a focus for the ACCC. The proceedings against Mercer and Vanguard for greenwashing signal a continued focus on consumer protection, including within financial services, retail, aviation and essential services. These sits alongside the ACCC implementing a new mandatory merger regime from 2026. Crypto regulation has advanced, with ASIC issuing detailed guidance on digital assets and custody obligations, supported by a sector-wide transition period to mid-2026.

The construction industry is facing major legislative and regulatory reforms in NSW and Victoria in 2026. Building Bill 2024, currently before the NSW State Parliament proposes the largest overhaul of building and construction industry regulation in 40 years, by consolidating nine pieces of legislation into one, and implementing better controls and safeguards across a number of areas from licencing to regulatory powers. The Bill is at the final review stage and, to date, has not been introduced to the Parliament of New South Wales.

In Victoria, the Building and Plumbing Commission is consolidating the Victorian Building Authority, Domestic Building Dispute Resolution Victoria and the statutory domestic building insurance scheme, to provide greater a more streamlined service for building practitioners and greater protections for consumers.

Those active in the D&O and class action space is eagerly anticipating appeals and other developments in this space in 2026 which will shape what happens next. In CBA, following the Full Federal Court's part overturning of the trial judge's findings, but denying damages due to failure to prove causation and loss, the High Court will hear the applicant's Special Leave application on 12 February 2026. In Worley, the appeal focused on causation and quantification of loss following the trial court’s dismissal of claims. A decision is expected to clarify whether market-based causation theories will gain traction, which could reshape the viability of future shareholder actions.

With these complex issues on the table, plaintiffs and funders are now considering split trials, separating liability from quantum, to overcome issues associated with establishing loss. This approach has advantages for all parties, including reduction of up-front costs, the ability to test questions of liability and provide a better understanding of exposure once liability has been determined, and has even had support from the bench, with Justice Lee of the Federal Court describing a split trial as maybe "desirable and efficient".

With the stalling of the shareholder class action market, there is the potential for derivative actions to become the new class action. Derivative actions allow shareholders to bring proceedings on behalf of the company for wrongs done to the company itself, rather than seeking compensation for individual shareholder loss, overcoming some of the evidentiary and causation hurdles that are plaguing shareholder class actions. Derivative actions also align with broader governance trends, including heightened regulatory scrutiny of board conduct and ESG compliance. As ASIC and the courts continue to emphasise directors’ duties and corporate governance standards, we expect derivative actions to gain traction - particularly in cases involving systemic governance failures, cyber breaches and climate-related disclosure obligations.