Australia - Responsible AI Use Policy

Overview

The Policy for the responsible use of AI in government (Version 1.1) was published by the Digital Transformation Agency and took effect on 1 September 2024. The policy sets baseline mandatory expectations for all non-corporate Commonwealth entities to adopt a risk-based, transparent and accountable approach to AI, with targeted mandatory measures such as the designation of accountable official(s) and publication of AI transparency statements. The DTA frames the policy around three pillars—enable and prepare, engage responsibly, and evolve and integrate—to unify practice across agencies and build public trust. For the official policy text and PDF see Digital Transformation Agency — AI in government policy and the full policy PDF at Policy for the responsible use of AI in government (Version 1.1). This policy interoperates with other whole-of-government instruments including the National framework for the assurance of artificial intelligence in government and the Technical standard for government’s use of artificial intelligence, forming a practical baseline for accountability and transparency while higher‑order statutory regulation of AI is developed.

Definitions

The policy adopts the OECD definition of an "AI system" for operational consistency: machine-based systems that, for explicit or implicit objectives, infer from inputs how to generate outputs (predictions, content, recommendations, decisions) that can influence physical or virtual environments. It distinguishes levels of autonomy and adaptiveness and recommends agencies keep definitions under review as the policy and broader regulatory environment evolve. The policy also defines "high-risk use case" as those government AI uses that could significantly affect people’s rights, safety, wellbeing, or essential government services and requires agencies to notify the DTA where such cases are identified. "Accountable official(s)" are defined as named individual(s) or chairs of bodies responsible for implementing the policy in an agency context, and must be designated within 90 days of the policy taking effect.

Governance and Institutional Framework

The DTA is the primary steward of the policy, responsible for whole-of-government coordination, implementation guidance and maintaining standards. Agencies must designate accountable official(s) to implement the policy and to act as the contact point for whole-of-government coordination; responsibilities include notifying the DTA of new high-risk use cases and participating in cross‑agency forums. The policy is mandatory for non-corporate Commonwealth entities under the Public Governance, Performance and Accountability Act 2013 (as implemented by the DTA) and complements existing obligations such as the APS Code of Conduct, privacy and protective security frameworks. Implementation is supported by companion instruments published by the DTA: the Standard for accountable officials, the Standard for AI transparency statements, the Technical standard for government’s use of artificial intelligence, a risk matrix, and training guidance. Parliamentary and audit oversight is expected to be undertaken by bodies such as the Australian National Audit Office (ANAO), while privacy compliance is monitored by the Office of the Australian Information Commissioner (OAIC).

Key Focus Areas

The policy organizes requirements and recommended practice across three pillars. "Enable and prepare" focuses on organisational capability building: agencies must establish internal governance, define operational models, integrate AI considerations into procurement and data governance, and implement staff training (AI fundamentals for all staff within six months is strongly recommended). "Engage responsibly" emphasises a proportionate, risk-based approach to deployment: agencies must publish public AI transparency statements (within six months) describing purpose, classification of AI use, risk mitigation, monitoring measures and compliance with policy; identify high-risk use cases and notify the DTA; apply lifecycle-based technical assurance (testing for safety, robustness, conformance and unintended consequences); adopt explainability, contestability and human-centred design where relevant; protect privacy and data; and ensure cyber and model security measures. "Evolve and integrate" requires continuous improvement: agencies should adopt technical standards and the AI assurance framework, maintain documentation and records for auditability and reproducibility, apply version control and watermarking where appropriate, and participate in cross-government pilots to refine assurance practices. The policy explicitly excludes the Defence portfolio and the national intelligence community from mandatory application but encourages voluntary adoption where national security is not compromised.

Implementation Framework

Implementation is driven by mandatory deadlines and supported by operational guidance. Agencies must: designate accountable official(s) within 90 days (deadline: 30 November 2024) and publish AI transparency statements within six months (deadline: 28 February 2025). The DTA provides templates, a technical standard for lifecycle statements, a risk matrix (Attachment B in the policy) and a pilot AI assurance framework designed to be adapted to agency contexts. Agencies are expected to integrate AI checks into procurement and project governance, incorporate AI risk assessments in project scoping, and adopt lifecycle practices (pre‑work, design, train, evaluate, deploy, monitor, decommission) set out in the technical standard. Complementary activities include staff training, internal AI registers, and internal assurance or audit processes tailored to the agency’s risk profile.

Monitoring and Evaluation

Monitoring and evaluation are a central feature: agencies must monitor deployed AI systems for performance, reliability, safety and unintended consequences, and must keep transparency statements updated at least annually or sooner if material changes occur. The DTA runs a pilot AI assurance framework to help agencies operationalise monitoring, and the ANAO has signalled its intent to incorporate AI governance and assurance into its audit programs, providing parliamentary-level oversight. Agencies are expected to report new high-risk use cases to the DTA to allow whole-of-government visibility and development of further mitigation approaches. Internal mechanisms should include incident reporting, ongoing testing, metrics for performance and harm, and documented remediation pathways.

Penalties, Liability, and Appeals

The policy itself is an administrative, mandatory instrument for NCEs and does not create new criminal sanctions; compliance is enforced through existing governance and accountability mechanisms (agency internal controls, performance reporting, administrative action). Consequences for non-compliance may include administrative remediation, direction by responsible ministers or secretaries, negative findings in ANAO audits, reputational and parliamentary scrutiny, and referral to other regulators where statutory obligations (for example under the Privacy Act 1988) are breached. Privacy breaches and FOI obligations remain subject to the OAIC and FOI regime; agencies retain statutory liabilities under existing laws. The policy emphasises accountability and transparency to enable contestability and redress rather than prescriptive criminal penalties.

Relationship to Other Instruments

The policy is designed to complement and strengthen existing frameworks and should be read with the National framework for the assurance of artificial intelligence in government, the Technical standard for government’s use of artificial intelligence, the APS Code of Conduct, the Privacy Act 1988 and protective security policy. It aligns with ARM (assurance, risk, monitoring) activities and procurement rules coordinated by the Department of Finance and DTA's digital procurement instruments. The instrument references international standards (OECD definition of AI) and anticipates interoperability with proposed national mandatory guardrails and voluntary industry safety standards published elsewhere in the Australian Government ecosystem.

International Alignment

The policy intentionally aligns with international thinking and standards: it adopts the OECD AI system definition and references international regulatory developments that prioritise preventative, risk-based guardrails. The Australian Government’s approach positions government practice to be interoperable with international instruments and initiatives (for example OECD, G7/OECD discussions and other comparable national AI frameworks). The DTA and other agencies (DISR, OAIC) are engaged in international fora to help ensure the Australian approach remains compatible with global best practice while reflecting domestic legal and constitutional obligations.

Implementation Timeline

Sources and References