Policy for the responsible use of AI in government

Question

On 15 December 2025, version 2.0 of the Policy for the responsible use of AI in government (the policy) came into effect. A series of new requirements for most Commonwealth agencies and departments was imposed. Does the agency/department understand that it has obligations under the policy? If the agency/department believes it is captured by one of the exemptions specified by the policy, please identify which one. In response to a question on notice asked during SBE25-26 with portfolio question number F292, DTA advised that ""[a]gencies must update their [AI transparency] statement at least once a year, or sooner if there is a significant change to the agency's approach to AI or new factors that materially impact the existing statement's accuracy...If an agency has not updated its transparency statement since February 2025, it will need to do so in February 2026."" Given this, has the agency/department updated their AI transparency statement since it was published? If this was updated, what date/s did the agency/department update their AI transparency statement? If the agency/department did not update their AI transparency statement within the 12 month window as required, why not? Was the agency/department aware of this requirement? If not, why was the agency/department unaware of this requirement? If the agency/department believes it is captured by one of the exemptions specified by the policy, please identify which one. The policy specifies that the agency/department must develop a strategic position on AI adoption by 15 June 2026 to emphasise how AI opportunities can be identified and embraced by the agency/department. 1. Did the agency/department develop a strategic position on AI adoption by 15 June 2026? a. If not, why did the agency/department miss the deadline? b. Has the agency/department developed a strategy, to date? 2. If a strategic position has been developed, what is the agency's/department's strategy? a. Has this strategy been communicated with the agency's/department's staff? i. On what date, and how was it communicated? ii. If not, why not? If the agency/department believes it is captured by one of the exemptions specified by the policy, please identify which one. The policy requires accountable officials (AOs, appointed as part of the first version of the policy) to oversee the agency's/department's compliance with the policy. It requires AOs to respond to Digital Transformation Agency (DTA) requests for information and engage in whole-of-government AI forums and processes. Has the AO for the agency/department received any information requests from DTA? If yes, for each such information request, identify: 1. the information sought, 2. the date of the request, 3. the date the AO responded, 4. whether any follow-up was required (and, if so, the date that the request was considered by the AO to be complied with). If the agency/department believes it is captured by one of the exemptions specified by the policy, please identify which one. The policy requires accountable officials (AOs, appointed as part of the first version of the policy) to oversee the agency's/department's compliance with the policy. It requires AOs to respond to Digital Transformation Agency (DTA) requests for information and engage in whole-of-government AI forums and processes. Has the AO for the agency/department been invited to participate in any whole-of-government AI forums or processes? If yes, identify: 1. the date and subject of each such forum/process, 2. whether the AO engaged with the forum/process and, 3. if the AO did not engage with the forum/process, an explanation as to why not. If the agency/department believes it is captured by one of the exemptions specified by the policy, please identify which one. Under the policy, the agency/department must designate an accountable use case owner for each in-scope AI use case by 15 December 2026. AOs are to maintain a register of accountable use case owners. Has any work begun on this requirement? If yes, have any accountable use case owners been appointed? If so, identify the date they were appointed, use case they are responsible for and their position within the agency/department. If the agency/department believes it is captured by one of the exemptions specified by the policy, please identify which one. The agency/department must create a register of in-scope AI use cases to enable accountable official(s) to record accountable use case owners by 15 December 2026. For each of the below, is the agency/department now aware of each of the following elements, and is the agency/department on track to implement the elements by their respective deadlines? 1. The agency/department must establish an approach to embed responsible AI practices by 15 December 2026. 2. The agency/department must implement mandatory training for all staff on responsible AI use by 15 December 2026. 3. The agency/department must assess all new AI use cases against the in-scope criteria (Appendix C of version 2.0 of the policy) to determine if they are in scope of the policy by 15 December 2026. The assessment must be documented and take place during the design phase while developing requirements. For existing use cases not yet assessed, agencies must determine whether they are in scope of this policy and apply all relevant policy actions by 30 April 2027. 4. For AI use cases that are in-scope, the agency/department must conduct an AI use case impact assessment. 5. If the agency/department determines that an in-scope AI use case has an inherent high-risk rating when completing an AI use case impact assessment, they must: a. report the use case to the agency/department AO with the reasons for the inherent high-risk rating, proposed mitigations and residual risks b. govern the use case through a designated board or a senior executive, whichever is appropriate for the size and scope of the agency/department c. report the use case to the DTA through the AO d. establish a system to regularly review the use case every 12 months at a minimum. If the agency/department believes it is captured by one of the exemptions specified by the policy, please identify which one. For each of the below, is the agency/department now aware of each of the following elements, and is the agency/department on track to implement the elements by their respective deadlines? 1. The agency/department must create a register of in-scope AI use cases to enable accountable official(s) to record accountable use case owners by 15 December 2026. 2. The agency/department must establish an approach to embed responsible AI practices by 15 December 2026. 3. The agency/department must implement mandatory training for all staff on responsible AI use by 15 December 2026. 4. The agency/department must assess all new AI use cases against the in-scope criteria (Appendix C of version 2.0 of the policy) to determine if they are in scope of the policy by 15 December 2026. The assessment must be documented and take place during the design phase while developing requirements. For existing use cases not yet assessed, agencies must determine whether they are in scope of this policy and apply all relevant policy actions by 30 April 2027. 5. For AI use cases that are in-scope, the agency/department must conduct an AI use case impact assessment. 6. If the agency/department determines that an in-scope AI use case has an inherent high-risk rating when completing an AI use case impact assessment, they must: a. report the use case to the agency/department AO with the reasons for the inherent high-risk rating, proposed mitigations and residual risks b. govern the use case through a designated board or a senior executive, whichever is appropriate for the size and scope of the agency/department c. report the use case to the DTA through the AO d. establish a system to regularly review the use case every 12 months at a minimum. If the agency/department believes it is captured by one of the exemptions specified by the policy, please identify which one. Since 15 December 2025, has the agency/department had any communication with the DTA regarding noncompliance with requirements introduced by the policy? If so, identify the date/s of the communication/s, the element/s of the policy not complied with and the date that the noncompliance was resolved. If the agency/department believes it is captured by one of the exemptions specified by the policy, please identify which one.

Answer

Please see attached answer.

Documents

• Question with answer (PDF) (opens in a new tab)
• Q961-968.pdf (opens in a new tab)