ACT's AI policy at one year: approval is not optional

One year after the Australian Capital Territory Artificial Intelligence Policy took effect on 29 October 2025, its requirements are established obligations—not preparations for a future deadline. For ACT Government teams, completing an AI risk assessment is only part of the job: projects also need central review and approval, human oversight and meaningful routes to challenge significant decisions.

What's changing

The Australian Capital Territory Artificial Intelligence Policy establishes a mandatory risk management and governance framework for government AI deployment. It has been in force throughout the past year, covering AI used in internal operations as well as public service delivery.

The central requirement is lifecycle risk management. Teams must assess risks using the ACT AI Assurance Framework tool across the system's lifecycle, rather than treating an assessment at the start as the end of their responsibilities. In practical terms, changes to an AI system's purpose, data or use should prompt teams to consider whether their assessment still reflects what the system actually does.

There is also a separate approval step. Completed self-assessments must go to the central AI Advisory Group, or AIAG, for formal review and approval before a project proceeds. A team's own conclusion that a system is acceptable does not provide an automatic green light. That distinction matters for project schedules: assessment and approval are different stages, and managers need to account for both.

The policy also requires human oversight, disclosure of AI involvement to the public, and compliance with territory privacy, cybersecurity and human rights laws. These obligations connect technical governance to the people using, operating or being affected by government services.

Where an AI-generated outcome significantly affects an individual, the policy requires a timely process for challenging or contesting that decision. A disclosure saying that AI was involved is therefore not enough by itself. People also need a usable route to question consequential outcomes.

The policy creates no standalone fines or penalties. That does not make its requirements optional: enforcement and liability depend on existing territory laws. Mishandling personal information through an AI tool can lead to enforcement under the Information Privacy Act 2014, while unfair or discriminatory outcomes remain subject to legal claims under the ACT Human Rights Act 2004.

Who is affected

The policy applies to all ACT Government directorates, departments and public service entities integrating AI into their work. Its scope includes both outward-facing services and internal operations. A system does not fall outside the framework simply because only public servants use it.

The stated coverage is not limited to a particular sector, directorate size or project budget. Government teams should not assume that a small pilot or an administrative tool is exempt merely because it looks less consequential than a public-facing decision system.

This is an ACT Government policy, not an Australia-wide requirement for every business using AI. Private organisations are not brought within its stated scope merely by operating in the territory. Suppliers supporting government AI projects should nevertheless understand their customer's assessment and approval obligations, because the government team may need information about the supplied system to meet them.

Three things to do this week

1. Check each AI project's assessment and approval status. Make a practical list of deployed systems and projects in progress, covering internal tools and public services. For each, locate the ACT AI Assurance Framework self-assessment and confirm whether the AIAG has formally reviewed and approved it. Do not treat a completed internal assessment as evidence of central approval. Where evidence is missing, establish the actual status before assuming the project can proceed.

2. Test oversight and disclosure against real use. Identify who exercises human oversight and how that person can intervene when an output is wrong or inappropriate. Review the public-facing explanations of AI involvement. Check that the assessment still matches the system's current purpose, data and operation, and involve the relevant privacy, cybersecurity and human rights specialists where concerns arise. These checks turn broad obligations into questions a project team can answer.

3. Walk through the challenge process. Choose a decision that could significantly affect an individual and test how someone would contest it. Can they find the route, understand what to submit and receive a timely response? Identify who handles the challenge and what information they need. The policy requires an actual process, not just an assurance that someone could contact the directorate.

Related context

For comparison, see the Northern Territory AI Assurance Framework, the New South Wales AI Assurance Framework and Australia's Policy for the responsible use of AI in government. These are separate instruments; teams should not assume that meeting another government's framework substitutes for ACT compliance.

At the first anniversary of its effective date, the ACT policy's practical message remains clear: assess risk throughout the lifecycle, secure AIAG approval, and make oversight and contestability work in practice.

Note: this article was drafted by AI - OpenAI GPT-6.1