Australia - New South Wales - AI Assessment Framework (DCS-2024-04)

Overview

The NSW Artificial Intelligence Assessment Framework (AIAF) is the New South Wales Government’s mandatory, risk‑based self‑assessment instrument to guide the ethical design, procurement, deployment and operation of AI systems across NSW agencies. First commenced as an assessment approach in 2022 and substantially updated and reissued alongside Department of Customer Service Circular DCS-2024-04 on 1 July 2024, the AIAF has been embedded within the broader NSW Digital Assurance Framework to provide consistent assurance for projects (notably those with budgets over AUD 5 million or funded via the Digital Restart Fund). The Framework is available as downloadable guidance and practical tools (AIAF Excel and PowerPoint) through Digital.NSW and is explicitly aligned with the mandatory NSW AI Ethics Policy and the NSW AI Strategy. The AIAF focuses on establishing residual risk ratings mapped to the five Ethics Principles and sets clear escalation pathways (including referral to the AI Review Committee) for high and very high residual risks.

Definitions

The AIAF adopts practical, policy‑oriented definitions to support consistent identification and treatment of AI solutions. Artificial Intelligence is described in functional terms (systems that perform tasks requiring human‑like intelligence such as learning, reasoning, prediction or decision‑making). "AI system" refers to any software, service, model or pipeline that includes AI components. "Residual risk" means the level of harm or likelihood remaining after application of mitigation controls. "Project registration" refers to the requirement to register projects under the NSW Digital Assurance Framework when a project exceeds the financial thresholds or is Digital Restart Fund‑funded. The Framework recognises distinctions between custom/training applications and widely available commercial off‑the‑shelf products, and requires agencies to document any decision not to apply the AIAF.

Governance and Institutional Framework

The AIAF is issued under the authority of the Secretary, Department of Customer Service (see Circular DCS-2024-04, 1 July 2024) and is operationalised by Digital NSW. It sits alongside the NSW AI Strategy and the mandatory AI Ethics Policy and is integrated into the NSW Digital Assurance Framework so that higher‑value or higher‑impact projects receive additional assurance. Primary institutional features include mandatory agency use of the AIAF (with senior officer approval of completed assessments), the establishment of the AI Review Committee for expert review of high‑residual‑risk systems, and an AI Secretariat function to coordinate submissions and queries. Governance responsibilities flow to project sponsors, technical leads, data governance officers and agency executives who must ensure assessments are completed, mitigations implemented and records maintained.

Key Focus Areas

The AIAF is structured around the NSW AI Ethics Principles and concentrates on five interlocking risk areas: (1) Community Benefit — ensuring use of AI produces demonstrable public value; (2) Fairness — identifying and mitigating bias and inequality in training data, model outputs and operational use; (3) Privacy & Security — applying privacy impact assessments and robust cyber controls; (4) Transparency — documenting model purpose, capabilities, limitations and public‑facing disclosures where appropriate; and (5) Accountability — defining ownership, approval gates, monitoring and escalation processes. Practically, the AIAF requires agencies to identify data provenance and quality controls, run model testing and evaluation plans (including validation, performance metrics and stress testing), implement access controls and monitoring, ensure interpretability and user communication where decisions materially affect individuals, and prepare redress pathways. The Framework contains explicit guidance on generative AI, encourages rigorous testing for safety and hallucination mitigation, and requires teams to consider socio‑technical implications including impacts on vulnerable cohorts and possible disparate outcomes. If mitigation controls cannot reduce residual risk to acceptable levels, the Framework requires pausing or halting the project and, for high/very high residual risk, submission to the AI Review Committee for external expert advice.

Implementation Framework

Implementation of the AIAF is operationalised via downloadable tools (AIAF Excel and PowerPoint) which map assessment questions to mitigation actions and residual risk scoring. Agencies must apply the Framework across the AI lifecycle — from planning and design, through procurement and development, to deployment, monitoring and retirement. For projects exceeding AUD 5 million or funded by the Digital Restart Fund, the AIAF is used within the NSW Digital Assurance Framework registration and review process. The AIAF includes provisions for senior officer sign‑off, documentation retention in agency record systems, and contact points for the AI Secretariat to submit high‑risk assessments. The Framework promotes capability building (training for project sponsors, data stewards, and technical teams), integrates privacy and security impact assessments into the assessment flow, and calls for logging, version control and change management for models and data pipelines.

Monitoring and Evaluation

Monitoring under the AIAF requires agencies to maintain logs, performance metrics and incident registers for operational AI systems, and to conduct periodic reassessments proportionate to the potential for harm. The AIAF’s residual risk scoring must be reviewed when changes occur (new data sources, model retraining, expanded operational use). The Department of Customer Service and Digital NSW will monitor uptake and compliance through internal assurance functions and by integrating AIAF application into the Digital Assurance Framework; the Audit Office of NSW has already reviewed application of the AIAF in agency projects and will continue to assess governance adherence. The Framework is explicitly described as a living instrument and will be updated to reflect evolving best practice, external standards and learnings from escalated reviews.

Penalties, Liability, and Appeals

The AIAF itself is an administrative framework enforced through mandatory compliance with DCS‑2024‑04; penalties are primarily administrative and governance‑oriented. Remedies for non‑compliance include directions to remediate assessments and controls, requirement to pause or cease projects, registration and additional oversight under the Digital Assurance Framework, withdrawal of funding, and internal disciplinary actions where appropriate. Agencies remain subject to general statutory liability (civil liability, privacy law breaches, discrimination and human rights obligations) where AI systems cause harm. The AIAF and the issuing circular set out escalation and appeals pathways via agency governance channels and the AI Review Committee for contested technical judgements, while legal liability and judicial remedies remain available under broader law.

Relationship to Other Instruments

The AIAF is explicitly linked to the NSW AI Ethics Policy (mandatory) and the NSW AI Strategy and is embedded in the NSW Digital Assurance Framework for higher‑value projects. The issuing circular (DCS‑2024‑04) supersedes earlier departmental guidance (DCS‑2022‑01) and attaches the updated AIAF material. The Framework also references Commonwealth guidance such as the Pilot Australian Government Artificial Intelligence Assurance Framework and interoperates conceptually with national policy instruments including the Australian Policy for Responsible Use of AI (Digital Transformation Agency) and sectoral privacy legislation. Agencies are instructed to consult subject matter experts and to apply agency‑specific policies in conjunction with the AIAF.

International Alignment

The AIAF is framed to align with international norms and evolving standards (including OECD AI Principles, EU AI Act concepts such as risk‑based assessment and prohibitions for certain uses, and emerging assurance frameworks being piloted by the Australian Government). The Framework’s focus on transparency, risk management, documentation and external expert review supports cross‑jurisdictional interoperability and facilitates integration with national and international standards and guidance. Where global best practice evolves (e.g., conformity assessment or certification mechanisms), the AIAF is designed to be updated to incorporate those developments and maintain alignment with both domestic and international governance expectations.

Implementation Timeline

Sources and References