Government AI procurement
We want to sell an AI solution to Queensland or NSW government agencies. What evidence will they ask us for?
Last updated
Expect to show where data is stored and processed, which model you use and what it was trained on, how a person oversees outputs, test and accuracy results, logging, your incident process and accessibility. Queensland agencies need this for a FAIRA assessment; NSW agencies need it for the AI Assessment Framework. Have it ready before the tender opens.
How to prepare the evidence pack
Describe the system plainly
One page on what the AI does, who uses it and what decisions it touches. FAIRA and the NSW framework both start here.
Map the data
Every data flow: what goes in, where it is stored and processed, how long it is kept and whether any of it trains a model.
Show the human in the loop
Who reviews outputs, what they can override and how a decision is explained to the person affected.
Publish test results
Accuracy on data like the agency's, known failure cases and how drift is watched after go-live.
Prove you can be audited
Sample logs, the incident and suspension process, and how the agency is told before a model changes. Version the pack with every release.
Evidence checklist for AI suppliers
| Evidence | What to have ready | Why the agency asks |
|---|---|---|
| Data location | Where data is stored, processed and backed up, named subprocessors, retention and deletion terms | Privacy law limits disclosing personal information outside Australia, and agencies must manage that risk |
| Model and training data | Which model and version you use, who provides it, what it was trained on, and whether agency data is ever used for training | FAIRA and the NSW framework both ask how data is lawfully used and how bias is identified |
| Human oversight | Who approves outputs, how they override them and how reasons are given | The NSW AI Ethics Policy and buy.nsw guidance expect human review in decision-making |
| Testing and accuracy | Accuracy, precision and error rates on representative data, fairness testing and drift monitoring | buy.nsw guidance suggests service levels for accuracy, robustness and reproducibility |
| Logging | What is logged, for how long, and how the agency can export logs for audit | Agencies need records across the AI lifecycle and audit rights for the contract term |
| Incident process | How issues are detected, reported and fixed, and how the system can be suspended without stopping core services | buy.nsw guidance asks for failsafe conditions and the ability to suspend the system |
| Accessibility | A WCAG conformance statement for every user interface, with known gaps and fix dates | Agencies must serve all members of the public and their own staff |
| Security and privacy assessments | Penetration test summary, threat and risk inputs and support for the agency's privacy impact assessment | Queensland's policy says a FAIRA does not replace these assessments |
Queensland and NSW specifics
Queensland: the Artificial intelligence governance policy v2.0.0 is mandated for departments and took effect in August 2026. Agencies must govern AI with regard to ISO/IEC 38507 and apply the Foundational AI Risk Assessment (FAIRA), or an agreed equivalent, when evaluating AI solutions, with FAIRA LITE for low-risk trials. The FAIRA framework v2.0.0, current from September 2026, analyses the system's components, design and human interaction, then assesses values in line with the National Framework for the Assurance of AI in Government (2024). A FAIRA does not replace privacy impact, threat and risk, or human rights impact assessments.
The Queensland Privacy Principles have applied to agencies since 1 July 2025, along with a mandatory data breach notification scheme. Agencies may have to bind a contracted service provider to the privacy principles as if it were the agency, so a supplier handling personal information should expect QPP clauses in the contract.
NSW: agencies must comply with the NSW AI Operational Policy (Circular DCS-2026-02) and register AI use cases on the AI Assessment Framework Platform, which is mandatory for new registrations and assessments from 30 September 2026. High or critical risk use cases go to the AI Review Committee. The buy.nsw AI procurement essentials, updated 6 May 2026, tell buyers to complete the self-assessment, assess each supplier's ability to manage the risks it identifies, and negotiate audit rights, notice of algorithm updates and failsafe conditions.
Limits and when not to use AI
Decisions about rights or entitlements
If the AI would effectively decide a person's eligibility, penalty or service, expect a high risk rating. Position it as preparing work for an officer.
Outputs you cannot explain
If you cannot show why the system produced an answer, the agency cannot give reasons for a decision. Choose a design that cites its sources.
Data you cannot keep onshore
If a subprocessor must handle personal information offshore and you cannot change that, the agency's privacy assessment may stop the procurement.
Accuracy you have not measured
A claim without test results on representative data will not survive evaluation. Run a pilot alongside officers before quoting figures.
Who should own it
Supplier product lead
Owns the evidence pack, the model and data description and the release notes that keep it current.
Supplier bid manager
Maps the pack to each tender's questions and tracks which version was submitted.
Supplier privacy and security lead
Supports the agency's privacy impact assessment and threat and risk assessment.
Agency IT or procurement officer
Runs the FAIRA or AI Assessment Framework self-assessment, records the risk rating and writes the agreed controls into the contract.
Agency business owner
Accepts the residual risk and owns how officers use the outputs after go-live.
Related work
- Government AI solutionsSovereign AI built inside an agency's own environment in Australia, with logging and human approval.
- Australian AI rules and deadlinesA dated tracker of every Australian AI law, policy and guideline, checked against official sources.
- NSW AI Assessment FrameworkWhat the NSW platform means for agencies and the suppliers who sell to them.
- Selling AI into Australian governmentIRAP, the DTA policy, the PSPF and procurement for AI vendors.
Sources
Queensland Government, Artificial intelligence governance policy v2.0.0: https://www.forgov.qld.gov.au/information-and-communication-technology/qgea-policies-standards-and-guidelines/artificial-intelligence-governance-policy
Queensland Government, Foundational artificial intelligence risk assessment (FAIRA) framework v2.0.0: https://www.forgov.qld.gov.au/information-and-communication-technology/qgea-policies-standards-and-guidelines/faira-framework
Office of the Information Commissioner Queensland, Queensland Privacy Principles: https://www.oic.qld.gov.au/government/privacy/queensland-privacy-principles
Digital NSW, NSW Artificial Intelligence Assessment Framework: https://www.digital.nsw.gov.au/nsw-artificial-intelligence-assurance-framework
buy.nsw, Artificial intelligence (AI) procurement essentials: https://www.info.buy.nsw.gov.au/resources/artificial-intelligence-ai-procurement-essentials
Questions
What is a FAIRA assessment in Queensland?
FAIRA is the Foundational Artificial Intelligence Risk Assessment. Under the Queensland AI governance policy v2.0.0, departments must apply FAIRA, or an agreed equivalent, when evaluating an AI solution. It describes the system's components, design and human interaction, then assesses risks against Australia's AI Ethics Principles. FAIRA LITE covers low-risk trials and proofs of concept.
Does a supplier have to complete the NSW AI Assessment Framework?
The duty sits with the NSW agency, which registers the use case on the AI Assessment Framework Platform and completes the self-assessment. In practice the agency cannot answer many questions without the supplier, and buy.nsw guidance has buyers assess each supplier's ability to manage the identified risks. A supplier should expect to supply data, testing and oversight details.
Will a Queensland agency contract bind an AI supplier to the QPPs?
Often, yes. The Queensland Privacy Principles have applied to agencies since 1 July 2025, and an agency may have to bind a contracted service provider to them as if the provider were the agency. An AI supplier that collects, stores or processes personal information for a Queensland agency should expect QPP obligations written into the contract.
Can an AI product hosted overseas be sold to Queensland or NSW agencies?
It is not automatically excluded, but it is harder. Queensland and NSW privacy law limits disclosing personal information outside Australia, so the agency must assess and justify any offshore processing. A product that stores and processes data in Australia, with named subprocessors and no training on agency data, answers the question before it is asked.
What accuracy figures should an AI supplier give a government agency?
Give accuracy, precision and error rates measured on data similar to the agency's, plus the cases where the system fails and how drift is monitored after go-live. buy.nsw guidance suggests agencies set service levels on these measures. Figures from a pilot run alongside officers carry more weight than results on a vendor's own test set.
Will ISO 42001 certification satisfy Queensland or NSW agencies?
It helps but does not replace the agency's own assessment. Queensland's AI governance policy lists ISO 42001 as supporting guidance, and certification shows a supplier manages AI systematically. The agency must still complete a FAIRA in Queensland, or the AI Assessment Framework in NSW, for the specific use case it is buying.
Preparing an AI bid for government?
A 30-minute review with a senior consultant. You leave with a written one-page summary you can share internally.
Fixed-fee phases, agreed before we start. Stop after any phase.