Agency
NSW public entities covered by the circular.
How the laws define this
Regulators across these instruments agree that an agency is an entity charged with specific statutory responsibilities, compliance obligations, or administrative functions. The core divergence lies in whether the term represents a broad class of regulated entities or a single, specifically named authority. Policies such as DCS-2024-04, the Queensland Government policy, and the Standard for accountable officials apply the term to a wide set of public sector bodies required to implement AI rules, while the Privacy Act 2020 expands this category further to encompass private organisations alongside public bodies. Conversely, other instruments use the term to identify a single statutory or autonomous body tasked with centralized oversight or execution. Under Royal Decree 729/2023, the term denotes the Spanish Agency for AI Supervision (AESIA); under Decreto Supremo N° 285, it refers to the Agencia Nacional de Ciberseguridad (ANCI); and under the Agency to Innovate Act 2023, it establishes the autonomous statutory body named a2i.
Synthesised from the 7 statutory definitions below. Each one is quoted in full, with its source.
How jurisdictions differ
What is distinctive in each definition, binding law in force first.
| Jurisdiction | Instrument | Status | What is distinctive |
|---|---|---|---|
| Bangladesh | Agency to Innovate (a2i) Bill / Agency to Innovate Act 2023 | In Force | Defines a single autonomous statutory body with specific functions like managing funds, protecting IP, and forming companies to drive public-sector innovation. |
| New Zealand | Privacy Act 2020 | In Force | Broadly covers both public bodies and private organisations that handle personal information, imposing compliance with Information Privacy Principles. |
| Chile | Supreme Decree No. 285 (Regulation) — Qualification Procedure for Vital Importance Operators under the Cybersecurity Framework Law (Law 21.663) | In Force | Limits to the national cybersecurity authority ANCI, focused on qualifying Operators of Vital Importance and maintaining related records. |
| Spain | Royal Decree 729/2023 approving the Statute of the Spanish Agency for AI Supervision (Agencia Española de Supervisión de la Inteligencia Artificial - AESIA) | In Force | Specifies an autonomous public agency attached to a ministry, tasked with AI supervision, inspection, advising, training, and EU coordination. |
| Australia | Standard for accountable officials (Policy for responsible use of AI in government) | In Force | Covers APS agencies and non‑corporate Commonwealth entities subject to the Policy for the responsible use of AI in government and its supporting instruments. |
| Queensland, Australia | Artificial intelligence governance policy (Queensland Government) | In Force | Limits to Queensland Government departments and statutory bodies under specific acts and standards, needing to implement AI governance policy. |
| New South Wales, Australia | DCS-2024-04 – Use of Artificial Intelligence by NSW Government Agencies | Superseded | Explicitly lists NSW departments, executive agencies, separate agencies, statutory bodies, and State Owned Corporations responsible for AIAF compliance. |
What it triggers
- Under the Privacy Act 2020 in New Zealand, agencies must comply with the Information Privacy Principles and other obligations.
- In Australia, the Standard for accountable officials covers APS agencies and non‑corporate Commonwealth entities subject to the Policy for the responsible use of AI in government.source
- Under DCS-2024-04 in New South Wales, Australia, agencies were required until it was superseded to complete the AIAF, implement mitigations, and meet the circular’s mandatory requirements.source
- Under the Artificial intelligence governance policy in Queensland, Australia, agencies cover Queensland Government departments and statutory bodies in scope under the Financial and Performance Management Standard 2019.source
Definitions (7)
An 'Agency' under the circular means departments, executive agencies, separate agencies, statutory bodies and State Owned Corporations listed in the instrument; these entities are responsible for completing the AIAF, implementing mitigations and meeting the circular’s mandatory requirements.
Queensland Government departments as defined by the Public Sector Act 2022 and statutory bodies in scope under the Financial and Performance Management Standard 2019; entities required to adopt and implement the QGEA AI governance policy and supporting materials.
The Agency to Innovate (a2i) is the autonomous statutory body created by the Act to institutionalise the a2i programme and to plan, implement and manage technology-driven public‑sector innovation programmes, steward flagship digital platforms, mobilise and manage funds, protect IP arising from public research, and form companies where necessary to fulfil its statutory objectives.
A broad statutory term covering any person or entity that collects, holds, manages, or uses personal information under the Act, including public bodies and private organisations; the definition determines who must comply with the Information Privacy Principles and other obligations in the Act.
Refers to the Agencia Nacional de Ciberseguridad (ANCI), the national authority charged with initiating, directing and deciding the qualification processes for Operators of Vital Importance, coordinating with sectoral regulators, and maintaining the administrative records supporting each decision.
Refers to Australian Public Service (APS) agencies and other non‑corporate Commonwealth entities that are subject to the Policy for the responsible use of AI in government and its supporting instruments. Agencies are required to designate AOs, maintain AI use case inventories, and comply with mandatory policy actions within specified timelines.
The Agencia Española de Supervisión de la Inteligencia Artificial (AESIA) is an autonomous public agency attached to the Ministry of Economic Affairs and Digital Transformation, established to supervise, inspect, advise, raise awareness and provide training in relation to AI systems in Spain, and to act as the national contact point with EU AI governance bodies.
Not to be confused with
Responsible entity is any public authority charged with delivering a measure, while agency specifically denotes public entities with defined compliance or governance roles in these instruments.
Questions and answers
What obligations do agencies have under the Privacy Act 2020?
Agencies in New Zealand must comply with the Information Privacy Principles and other obligations when collecting, holding, managing, or using personal information. This applies to both public bodies and private organisations.
Which entities count as agencies in NSW AI circular DCS-2024-04?
Agencies include departments, executive agencies, separate agencies, statutory bodies and State Owned Corporations listed in the instrument. They were responsible for completing the AIAF and implementing mitigations until the circular was superseded.
What does the term agency cover in Australian AI standards?
In the Standard for accountable officials, it refers to APS agencies and non-corporate Commonwealth entities subject to the Policy for the responsible use of AI in government. In Queensland, it covers government departments and statutory bodies implementing AI governance.
Related Terms
responsible entity
Public authority or institution charged with delivering a measure....
Digital security agency / council
Designated national body responsible for digital security governance and enforcement....
company
Subsidiary company the agency may form....
digital security agency/council
Designated national body for coordinating digital security and enforcement....
Business actor
Commercial entities classified under KBLI for AI activities....