Australia - Victoria - Generative AI Guidelines

Overview

The Administrative Guideline for the safe and responsible use of Generative Artificial Intelligence in the Victorian Public Sector provides minimum whole-of-government direction for using generative AI in official Victoria Public Sector (VPS) work. It was endorsed by the Victorian Secretaries Board on 24 September 2024 and made by the Secretary, Department of Premier and Cabinet on 27 November 2024. The document adopts a principles-based approach aligned with Australia's AI Ethics Principles and the National AI Assurance Framework and distinguishes agency-approved tools from publicly-available tools, sets data sharing limits, requires training and monitoring, and reaffirms that personnel remain accountable for decisions and outputs when using generative AI.

Definitions

The Guideline defines key terms for consistent application across the VPS: "Generative AI" (models that generate text, images, code, audio or other data in response to prompts); "Agency-approved Generative AI tools" (tools assessed and authorised by an in-scope organisation after privacy, cybersecurity and legal review); "Publicly-available Generative AI tools" (third-party services not procured by government); "Official Work" (any tasks performed as part of VPS employment); "Publicly-available information" (data already public or approved for release); and "Personnel" (employees, contractors, consultants and volunteers who may access public sector information). These definitions are designed to be practically applied across procurement, information security and operational workflows.

Governance and Institutional Framework

The Guideline is issued within the Department of Premier and Cabinet (DPC) administrative framework and implementation support is led by the Department of Government Services (DGS). It requires each in-scope organisation (public service bodies and public entities under the Public Administration Act 2004) to: adopt local policies that meet or exceed the Guideline; establish approval processes to designate agency-approved tools; document roles and responsibilities for AI use; and put in place monitoring, recordkeeping and reporting mechanisms. It also mandates alignment with regulator guidance (for example from the Office of the Victorian Information Commissioner and the Victorian Public Sector Commission), and that Heads of agencies notify the Secretary, DPC if they intend to act inconsistently with the Guideline in accordance with s36A(3) Public Administration Act 2004.

Key Focus Areas

The Guideline concentrates on a set of risk and practice domains: (1) data protection and privacy — forbidding input of protected or non-public data into publicly-available tools and requiring protective marking controls for agency-approved solutions; (2) human rights and fairness — ensuring Generative AI use is compatible with the Victorian Charter of Human Rights and Responsibilities; (3) cybersecurity and model security — requiring cyber assessments as part of tool approval; (4) transparency and documentation — maintaining provenance, attribution and records of prompts and outputs incorporated into official work; (5) accountability and oversight — clarifying that personnel remain accountable for content and decisions; and (6) training, monitoring and recordkeeping to support safe adoption. The Guideline also explicitly warns against using generative AI as a substitute for validated decision-making, particularly where outcomes significantly impact rights, welfare, or legal status.

Implementation Framework

In-scope organisations must implement the Guideline through a practical plan that includes: a documented approval process for agency-approved tools (covering privacy, cyber, legal, commercial and IP review); protective marking and data-handling rules per tool; staff education and training modules (the Department of Government Services will supply adaptable modules); monitoring and audit controls to record usage and detect inappropriate input of sensitive information; and risk-assessment and assurance procedures aligned to the National AI Assurance Framework. The Guideline permits tailored, sector-specific measures where required (for example, Department of Education schools use school-specific guidance) and encourages adoption by special bodies where helpful. Practical implementation guidance is available at the complementary guidance page maintained by DGS (Guidance for the safe and responsible use of generative AI in the VPS).

Monitoring and Evaluation

Organisations are expected to monitor both agency-approved and publicly-available generative AI usage to ensure compliance and to inform continuous improvement. Monitoring must be carried out consistent with surveillance principles and privacy law, and should include logging prompts and outputs used in official work, periodic audits of compliance with protective marking and data-sharing rules, post-use quality checks and mechanisms for personnel to report incidents or near-misses. Evaluation is iterative: the Guideline will be reviewed periodically and material changes will be approved by the Victorian Secretaries Board; DGS will update the practical guidance and training materials concurrently.

Penalties, Liability, and Appeals

Although the Guideline itself is an administrative instrument rather than primary legislation, non-compliance may lead to breaches of VPS Codes of Conduct, disciplinary action, administrative directions under the Public Administration Act 2004, and potential statutory enforcement (for example, privacy investigations by OVIC where data breaches occur). The Guideline points to legal exposure related to privacy, health records, public records, human rights, and intellectual property, and suggests agencies involve legal counsel where necessary. Heads of in-scope organisations must provide written reasons to the Secretary, DPC under s36A(3) if operating inconsistently with the Guideline. Appeals and contestability processes for decisions materially affecting individuals remain available through existing administrative law and review mechanisms.

Relationship to Other Instruments

The Guideline is expressly intended to be read alongside several statutory and policy instruments: the Public Administration Act 2004 (scope and administrative mechanisms), Privacy and Data Protection Act 2014 and Health Records Act 2001 (data protection obligations), Public Records Act 1973 (recordkeeping duties), Freedom of Information Act 1982 (transparency obligations) and the VPS Codes of Conduct (standards of behaviour and accountability). It also references the national-level National AI Assurance Framework and Australia’s AI Ethics Principles, encouraging alignment with federal initiatives while retaining state-specific operational requirements.

International Alignment

The Guideline aligns Victoria’s approach with broader national and international AI governance trends by referencing Australia’s national AI Ethics Principles and the National AI Assurance Framework. It encourages practices consistent with international norms for safety, transparency, accountability and human-rights protection and aims to make procurement, risk assessment and assurance processes interoperable with standards likely to be adopted in other jurisdictions. Where cross-border data flows or foreign-operated tools are involved, the Guideline emphasises careful legal and privacy review, vendor due diligence, and attention to jurisdictional data storage and use terms.

Implementation Timeline

Sources and References