Australia - Queensland - AI Governance Policy (2024)

Overview

The Queensland Government Artificial Intelligence Governance Policy (issued September 2024) is a mandated Queensland Government Enterprise Architecture (QGEA) policy requiring departments and specified statutory bodies to adopt consistent, evidence-based approaches when planning, procuring, and using AI systems. The policy has two core mandatory requirements: (1) agencies must use a comprehensive, consistent and evidence-based process that incorporates an ethical framework to evaluate transparency, accountability and risk across the AI lifecycle; and (2) agencies must establish AI governance arrangements aligned to the current version of ISO 38507. The policy is published on the Queensland ForGov portal (Artificial intelligence governance policy) and is supported by the Foundational Artificial Intelligence Risk Assessment (FAIRA) framework and guideline to assist agencies with ethical risk assessment and assurance.

Definitions

Key terms used in the policy follow common public-sector and standards-based meanings: "AI" refers to systems that use data-driven or rule-based techniques to perform tasks that ordinarily require human intelligence; "AI lifecycle" covers planning, procurement, development/configuration, testing/validation, deployment, monitoring and decommissioning; "ethical framework" denotes a structured set of principles and procedures used to identify and mitigate ethical risks such as fairness, explainability, privacy and accountability; "agency" means Queensland Government departments (per the Public Sector Act 2022) and statutory bodies in scope under the Financial and Performance Management Standard 2019. The policy also cross-references the FAIRA materials for more granular risk taxonomy and assessment terminology.

Governance and Institutional Framework

The policy positions the Department of Customer Services, Open Data and Small and Family Business (CDSB) as the administering authority for QGEA AI directions, with agencies accountable for implementing governance and controls locally. It directs agencies to embed AI governance within existing structures — for example, ICT governance committees, enterprise risk committees and ISMS governance — and to align AI governance with ISO 38507. This alignment requires clear assignment of roles and responsibilities (executive sponsor, accountable officer, program/system owner), documented decision rights, investment gate approvals and integrated reporting to enterprise risk and investment boards. The policy also mandates that agencies satisfy reporting requirements in the QGEA ICT profiling standard, which supports whole-of-government visibility. For practical support, CDSB provides FAIRA materials and guidance and coordinates cross-agency advice; independent oversight, assurance and audit activity may be provided by the Queensland Audit Office (QAO report) and internal audit functions.

Key Focus Areas

The policy highlights multiple focus areas to manage benefit and harm: (1) risk assessment and proportionate governance — agencies must undertake comprehensive risk assessments before deploying AI and select evaluation approaches proportional to system risk; (2) ethical considerations — agencies must apply an ethical framework (FAIRA or equivalent where justified) addressing fairness, bias mitigation, non-discrimination, human oversight and explainability; (3) data protection and privacy — data handling, de-identification and privacy impact assessment obligations must be observed in line with privacy law and QGEA guidance; (4) information security — the policy requires integration with ISMS and cybersecurity controls to mitigate model and data security risks; (5) transparency and documentation — agencies must maintain documentation of assessment outcomes, decision rationale and model provenance to support accountability and future assurance; and (6) monitoring, evaluation and continuous assurance — agencies must plan for post-deployment surveillance, performance monitoring, and periodic reassessment. These areas draw on international standards and national frameworks to support consistent, auditable practice across the Queensland public sector.

Implementation Framework

Operationalisation of the policy is supported by the FAIRA framework and guideline, which provide step-by-step assessment processes, risk taxonomies and example controls. Agencies are expected to integrate AI evaluation with existing project and investment governance processes, use the ICT profiling standard for reporting, and adopt ISO 38507-informed governance arrangements. The policy permits proportionate approaches where lower-risk AI may use simplified assessment processes, but agencies must document and justify any deviation from FAIRA. Procurement and contract terms should require suppliers to provide evidence of model documentation, testing, and security controls. Training, capability building and access to evaluation tools are included in the implementation roadmap to ensure agencies can meet the policy's expectations.

Monitoring and Evaluation

Monitoring mechanisms include required reporting under the QGEA ICT profiling standard and periodic assurance activities. CDSB collects agency reports and offers guidance; the Queensland Audit Office and internal audit functions provide independent evaluation of policy adherence and ethical risk management. The QAO has already recommended that CDSB implement a formal evaluation plan to assess the effectiveness of the AI governance policy and supporting tools. Agencies are expected to maintain records that enable post-deployment performance monitoring, incident reporting and continuous improvement across the AI lifecycle.

Penalties, Liability, and Appeals

The policy itself does not create new criminal sanctions. Compliance and enforcement are delivered through administrative and governance mechanisms (requirement to meet QGEA standards, internal remediation, audit findings and reporting). Non-compliance can lead to remedial action, removal or suspension of AI deployments, internal performance or disciplinary consequences, and potential civil or regulatory liability under existing laws (privacy, discrimination, administrative law). Agencies should incorporate redress mechanisms and review paths into their governance arrangements and ensure individuals impacted by automated decisions have accessible appeal or review pathways consistent with legal obligations.

Relationship to Other Instruments

The policy is explicitly linked to the QGEA ICT profiling standard (reporting), the Financial and Performance Management Standard 2019 (scope for statutory bodies), the Public Sector Act 2022 (agency definitions and accountable officers), and the FAIRA framework/guideline (operational risk assessment). It also references international and national standards such as ISO 38507 and suggests agencies consider ISO 42001/ISO 22989 where relevant. The policy complements Queensland guidance on generative AI and other AI-specific guidance documents already published by the Queensland Government.

International Alignment

The policy requires alignment with ISO 38507 and cross-references national developments, positioning Queensland to align with Australian Government voluntary AI safety instruments and emerging international good practice. By referencing ISO standards and the FAIRA materials (which incorporate international ethical principles), the policy supports compatibility with cross-jurisdictional assurance regimes and facilitates information-sharing and mutual recognition of governance approaches in federated or multinational contexts.

Implementation Timeline

Milestone	Date
Issue and approval	September 2024
Policy effective from	2024-09-01
FAIRA framework & guideline published	September 2024
QAO audit referencing policy	2025 (QAO report published)
Latest page update (ForGov)	2025-08-08

Compliance Checklist

Requirement	Action
Structured, evidence-based evaluation	Adopt FAIRA or documented alternative; complete risk assessment pre-deployment
ISO 38507-aligned governance	Map roles, committees and reporting lines; update governance charters
Documentation and reporting	Record assessments, decisions, testing results and maintain ICT profiling reports
Privacy & Security	Complete privacy impact assessments; integrate with ISMS
Monitoring & review	Establish post-deployment monitoring and incident response processes

Sources and References

Source	Type
Artificial intelligence governance policy (QGEA)	Primary Source
Foundational artificial intelligence risk assessment guideline (FAIRA)	Primary Source
Queensland Audit Office — Managing the ethical risks of artificial intelligence	Primary Source