DCS-2024-04 – Use of Artificial Intelligence by NSW Government Agencies (NSW circular making AI Ethics Policy and AIAF mandatory) - Australia | Regulations.AI - The Site on AI Laws and Regulations

Overview

DCS-2024-04 is a Department of Customer Service circular issued 1 July 2024 that makes compliance with the NSW Artificial Intelligence Ethics Policy and the NSW Artificial Intelligence Assessment Framework (AIAF) mandatory across NSW Government agencies. The circular situates AI assurance within the broader NSW Digital Assurance Framework and specifies that projects with budgets over AUD 5 million or funded by the Digital Restart Fund will be guided through additional assurance steps. The circular replaces the earlier DCS-2022-01 instrument and is intended to ensure consistent, ethics-aligned assessment and risk management of AI across the NSW public sector. Official documents and supporting resources can be found on the NSW ARP and Digital NSW sites such as DCS-2024-04 (ARP) and the AIAF hub at Digital.NSW AIAF.

Definitions

DCS-2024-04 uses consistent NSW definitions: "AI system" or "AI solution" refers to software or processes that use machine learning, statistical models or other computational techniques to produce outputs that inform, influence or automate decisions or actions. "Agency" covers departments, executive agencies, separate agencies, statutory bodies and State Owned Corporations listed in the circular. "AIAF" denotes the NSW Artificial Intelligence Assessment Framework (the risk self-assessment tool). "Digital Assurance Framework" indicates the all-of-government assurance process used to coordinate oversight for major digital investments. "High" and "Very High" residual risk are risk classifications within the AIAF that trigger external review by the NSW AI Review Committee.

Governance and Institutional Framework

The circular assigns governance roles across NSW entities: agency project sponsors, CIOs, Chief Data Officers and program governance bodies are responsible for ensuring AIAF completion and for integrating AI ethics into procurement and delivery processes. The Department of Customer Service is the issuing authority; Digital NSW operates as the policy owner and steward of the AIAF and related resources. Assurance mechanisms are operationalised through the NSW Digital Assurance Framework: for Projects >$5 million and Digital Restart Fund projects, Digital NSW will apply additional controls and direct when the AIAF must be used. The NSW AI Review Committee (an expert review body) provides cross-government subject matter scrutiny for residual high-risk systems; agencies may contact the AI Secretariat for escalation. Refer to the official circular for governance contacts: DCS-2024-04 (ARP) and the AIAF resource page at Digital.NSW AIAF.

Key Focus Areas

DCS-2024-04 concentrates on several priority areas: mandatory application of the AI Ethics Policy’s five principles (Community Benefit, Fairness, Privacy & Security, Transparency, and Accountability); lifecycle risk identification and mitigation using the AIAF; explicit controls for generative AI and contemporary model practices; integration with procurement and investment assurance for major projects; human-in-the-loop requirements and explainability/ transparency obligations where public-facing or consequential decisions are made; privacy and information security safeguards aligned with NSW privacy obligations; and robust documentation and audit trails to support review and redress. The circular also emphasises capacity building, cross-agency collaboration and continuous improvement to adapt to rapid changes in AI capability and risk profiles, and points agencies to practical AIAF tools and templates hosted by Digital NSW at Digital.NSW AI policy.

Implementation Framework

Implementation is operationalised through required steps: agencies must determine whether a planned or existing system uses AI, complete the AIAF self-assessment across the lifecycle, implement prescribed mitigations, and document residual risk and decisions. For projects >$5 million or Digital Restart Fund recipients, the Digital Assurance Framework will flag AI use and guide agencies through the assurance pathway. Where residual risk is high/very high, submissions to the NSW AI Review Committee are mandatory. The AIAF (available as Excel and PowerPoint tools) contains sectioned questions aligned to the ethics principles and produces a residual risk rating that drives mitigation or escalation; the AIAF resources are published at Digital.NSW AIAF.

Monitoring and Evaluation

DCS-2024-04 requires periodic reviews and continuous monitoring proportionate to the assessed risk. Agencies must schedule lifecycle reviews, update assessments after material changes (e.g., model retraining, new data inputs or changed operational context), and retain documentation for internal audit and external review. Digital NSW will coordinate reporting and sector-level oversight, and agencies are encouraged to include AI use disclosures in Agency Information Guides in line with transparency expectations. The AIAF supports recurrent review by providing checkpoints for operations and retirement phases; template tools and guidance are hosted at AIAF resources.

Penalties, Liability, and Appeals

The circular itself sets mandatory administrative compliance requirements rather than new criminal sanctions. Penalties for non‑compliance are primarily administrative and governance-based: corrective directions, project suspension, funding denial, procurement remediation, and internal disciplinary or accountability processes. Liability for harms arising from AI deployment is still governed by existing statutory and common law regimes (including privacy, tort and contract law). Agencies retain responsibility for decisions taken using AI systems and for ensuring human oversight and redress mechanisms are available to affected individuals; the circular directs agencies to consult legal and privacy teams where liability or rights issues arise.

Relationship to Other Instruments

DCS-2024-04 expressly replaces DCS-2022-01 and operates alongside the NSW AI Strategy, the Digital Assurance Framework and the AI Ethics Policy. It also intersects with NSW privacy law and information access requirements, procurement directions, and the Government Information (Public Access) Act 2009 where transparency obligations apply. The AIAF references national cooperative instruments including the National Framework for the Assurance of Artificial Intelligence in Government and encourages agencies to align documentation and reporting with Commonwealth and interjurisdictional guidance (National Framework (Commonwealth)).

International Alignment

The circular and the AIAF are framed to be consistent with international best practice on AI assurance, referencing international approaches to risk‑based governance and human oversight. NSW’s model aligns with the cooperative Australian national framework and mirrors practices encouraged by OECD and other jurisdictions (risk-based assessment, mandatory ethics principles, review of high-risk systems). DCS-2024-04’s emphasis on transparency, privacy protection and external expert review supports comparability with emerging standards in Europe, North America and other Australian states and territories; agencies implementing cross-border services or third-party models should consider extra-jurisdictional data export and regulatory obligations.

Implementation Timeline

Milestone	Date / Trigger
Issuance of DCS-2024-04	2024-07-01
Integration into Digital Assurance Framework (Projects >$5m)	From issuance / ongoing (projects registered after 2024-07-01)
AIAF updated release (AIAF v3 resources)	July 2024 (published alongside circular)
Periodic review cadence (agency-level)	As per AIAF risk ratings; recommended annually or on material change

Compliance Checklist

Requirement	Check
Determine whether system uses AI	Complete 'Identifying AI' guidance
Complete the AIAF self-assessment	AIAF Excel/PowerPoint completed and stored
Implement required mitigations	Evidence of controls, testing and change logs
Escalate high/very high residual risk	Submit to NSW AI Review Committee
Integrate with Digital Assurance registration	Register project if >$5m or DRF funded
Document human oversight and redress	Policy and operational procedures recorded

Sources and References

Source	Type
DCS-2024-04 - Use of Artificial Intelligence by NSW Government Agencies (ARP)	Primary Source
NSW Artificial Intelligence Assessment Framework (Digital.NSW)	Primary Source
Artificial Intelligence Ethics Policy (Digital.NSW)	Primary Source
NSW media release — New AI Framework upholds safe use of transformative technology (1 July 2024)	Secondary/Primary
National Framework for the Assurance of Artificial Intelligence in government (Commonwealth)	Related Instrument

This new rule makes it mandatory for all New South Wales (NSW) Government agencies to follow an Artificial Intelligence (AI) Ethics Policy and use a specific AI Assessment Framework when developing or using AI systems.

The directive applies broadly to all NSW Government entities, including departments, executive agencies, statutory bodies, and State Owned Corporations. From July 1, 2024, these agencies must comply with the NSW Artificial Intelligence Ethics Policy, which outlines principles like community benefit, fairness, privacy, transparency, and accountability. A key obligation is the mandatory use of the NSW Artificial Intelligence Assessment Framework (AIAF), a self-assessment tool designed to identify and manage risks throughout an AI system's entire lifecycle, from design to retirement.

For AI projects with budgets exceeding AUD 5 million or those funded by the Digital Restart Fund, additional scrutiny applies under the broader NSW Digital Assurance Framework. Critically, any AI project assessed as having "High" or "Very High" residual risk must be escalated for review by the NSW AI Review Committee. Agencies are also required to ensure human oversight, transparency, and robust privacy and security safeguards for all AI systems, especially those making public-facing or consequential decisions. While this circular doesn't introduce new criminal penalties, non-compliance can lead to significant administrative consequences, including corrective directions, project suspension, funding denial, or internal disciplinary action. Agencies remain fully responsible and liable for any harms caused by their AI systems, underscoring the need for clear human oversight and redress mechanisms.

A practical pitfall for teams is the ongoing nature of compliance. The AIAF isn't a one-off checklist; agencies must continuously monitor their AI systems, update assessments after any material changes (like model retraining or new data inputs), and maintain thorough documentation and audit trails throughout the system's operational life.

Australia - New South Wales - AI Ethics Policy (DCS-2024-04)

Summary

Plain English