AI governance in the Australian public sector.

The Policy for the responsible use of AI in government (Version 2.0, effective 15 December 2025) is mandatory for non-corporate Commonwealth entities. Agencies must set a strategic approach to AI, operationalise responsible use, designate accountability for every use case and take risk-based actions. An accountable official must be named and must notify the DTA of new high-risk use cases and engage in whole-of-government coordination.

Under the DTA Standard for AI transparency statements, agencies had to publish a public AI transparency statement by 28 February 2025 and keep it current. The statement must explain why the agency uses AI, how it complies with the AI policy, and how it meets applicable law. Statements must sit on the public-facing website so citizens can understand and compare how the public service adopts AI.

The NSW AI Assessment Framework is mandatory for all NSW Government agencies across the full AI lifecycle, from design and procurement to deployment. Teams must self-assess each use case to determine a risk level, record sign-off in an audit record and register high or critical use cases in the agency AI register. High and critical cases must be referred to the AI Review Committee before proceeding.

When AI assists or makes administrative decisions, agencies remain bound by administrative law. The Commonwealth Ombudsman Automated Decision-Making Better Practice Guide (March 2025) sets expectations that decisions be authorised by law, procedurally fair, transparent and supported by reasons, with a human able to review and correct outcomes. The Robodebt scheme shows the legal and financial cost of ignoring these duties.

The Privacy Act 1988 and the 13 Australian Privacy Principles bind Commonwealth agencies handling personal information across collection, use, disclosure, quality, security and access. Any AI system that ingests personal data must have a lawful basis, honour the notice and purpose limits in APP 3 to APP 6, and keep information accurate and secure. The OAIC regulates and can investigate agency handling of personal information.

From 10 December 2026 the Privacy and Other Legislation Amendment Act 2024 adds a new APP 1 duty. Where a computer program uses personal information to make, or substantially help make, a decision that could reasonably be expected to significantly affect an individual, the entity must describe in its privacy policy the kinds of decisions and personal information involved. Agencies should map automated decisions now and update privacy policies.

State and territory agencies fall under their own privacy laws, not the Commonwealth Act. In NSW the Privacy and Personal Information Protection Act 1998 imposes information protection principles on public sector agencies covering lawful collection, use, disclosure, accuracy and security. Before an AI tool uses personal information an agency must confirm it does not breach these principles, and Victorian agencies face equivalent principles under the Privacy and Data Protection Act 2014.

Public sector transparency and recordkeeping laws reach AI outputs. The NSW Government Information (Public Access) Act 2009 gives an enforceable right to government information and requires proactive release of open access information unless an overriding public interest against disclosure applies. Records tied to AI-assisted decisions, including prompts, models and outputs, may be releasable and must be kept, so agencies should design AI systems to be documentable and auditable.

The National AI Centre Guidance for AI Adoption (October 2025) distils the Voluntary AI Safety Standard into six essential practices covering accountability and governance, risk management, data and cybersecurity, testing and monitoring, human oversight and transparency. Though voluntary, it is the reference benchmark regulators and the public expect, and agencies use it to evidence a mature, human-centred AI management system alongside the mandatory public sector rules.

Name an accountable official for AI and register the agency approach under the DTA policy Version 2.0 or the relevant state equivalent.

Run every AI use case through the NSW AI Assessment Framework or your jurisdiction assurance process, and register high or critical cases before deployment.

Publish and maintain a public AI transparency statement covering purpose, compliance and applicable law.

Inventory every automated or AI-assisted decision that affects individuals and confirm lawful authority, procedural fairness and a human review path.

Map personal information flowing into AI tools against the PPIP Act, PDP Act or Privacy Act principles before go-live.

Update privacy policies before 10 December 2026 to describe significant automated decisions and the personal information they use.

Design AI systems for recordkeeping and public access so prompts, models and outputs can be documented, retained and released.