How to Buy AI in Government: Australian Compliance Guide

To buy AI in Australian government, an agency must meet five layers of obligation at once: security (IRAP, the ISM and the PSPF), the Digital Transformation Agency's policy for responsible AI use, procurement rules, federal and state privacy law, and records law. Suppliers have to evidence all five. This government AI buying guide explains each layer for buyers and the organisations selling to them.

How does Australian government buy AI?

Federal, state and local agencies buy AI through the same procurement frameworks as other ICT, with AI-specific checks layered on top. At the Commonwealth level, the Commonwealth Procurement Rules set value-for-money and process requirements, and the DTA's BuyICT platform hosts many ICT arrangements. States run their own procurement frameworks.

What makes AI different is the assessment before purchase. Under the DTA's Policy for the Responsible Use of AI in Government, a non-corporate Commonwealth entity must have accountable officials for AI, assess each use case for risk, and publish a transparency statement about its AI use. That assessment shapes what the agency can buy and what it asks suppliers to evidence.

For agency buyers, the practical sequence is:

1. Define the use case and the decision it supports.
2. Classify its risk (see the risk classes below).
3. Confirm the data classification and the hosting and IRAP requirements that follow.
4. Map privacy, records and state obligations.
5. Write those requirements into the approach to market, so suppliers respond to them directly.

What are the five compliance layers for government AI?

	Layer / What It Requires	Owner & Consequence If Missed	Impact
1. Security: IRAP / PSPF / ISM	Independent assessment against ISM controls; protective security policy; classification handling	ASD and the Attorney-General's Department. Systems handling OFFICIAL: Sensitive or higher need an assessed environment.	Mandatory
2. AI governance: DTA Policy for the Responsible Use of AI in Government	Accountable officials, transparency statements, use-case assessment, risk classification	Digital Transformation Agency. Binds non-corporate Commonwealth entities; suppliers must support buyer obligations.	Mandatory for federal
3. Procurement: CPRs, Indigenous Procurement Policy, approved arrangements	Eligibility to respond; value for money; IPP targets; any mandated buying arrangement	Department of Finance and state equivalents. A strong solution outside a mandated arrangement may not be buyable directly.	Gating
4. Privacy: Privacy Act 1988 and state laws	Australian Privacy Principles; NSW PPIPA and HRIPA; Victoria PDPA; Queensland IPA; breach notification	OAIC and state privacy commissioners. Breaches, penalties and contract termination.	Mandatory
5. Records: Archives Act 1983 and state public records laws	Records of decisions made by or with AI must be captured, kept and disposed of per schedule	National Archives and state archives. Poor records can undermine administrative decisions.	Often missed

The procurement layer is the most common surprise for suppliers: a technically excellent, IRAP-assessed solution may still not be buyable directly if the agency must use a particular arrangement. For the privacy layer, see our GDPR vs Privacy Act comparison.

What did Robodebt change for government AI?

The Royal Commission into the Robodebt Scheme (Final Report, July 2023) did not name AI as the cause, but its findings now shape how government evaluates algorithmic and AI-assisted systems. The scheme used automated income averaging to raise debts against welfare recipients, and the Royal Commission found it was unlawful and caused serious harm.

Buyers now look for specific evidence:

1. Representative testing. Evidence the system was tested on a population like the affected cohort. Generic accuracy figures are not enough.
2. Meaningful human review. Reviewers with the authority to override, the training to know when, and the time to do it.
3. A right of review. A documented appeal path for anyone affected by an automated or AI-assisted decision.
4. Plain-English transparency. What the system does, what data it uses and what it will not do.
5. Automation bias controls. Evidence reviewers are trained to disagree with the model and that disagreement is logged.

Overseas examples point the same way. In 2024, a New York City chatbot built to advise businesses gave answers that contradicted local law, a reminder that public-facing AI untested against its real users becomes a public incident quickly. Our AI agent governance guide covers the human override pattern that government treats as the price of admission.

What does the DTA AI policy require?

The Policy for the Responsible Use of AI in Government, first issued by the DTA in 2024 and since updated, is the Commonwealth baseline. Agencies implement it. Suppliers are expected to support and evidence the agency's obligations.

1. Accountable officials. Each entity nominates accountable officials for AI. Expect approval gates outside the project team.
2. Transparency statements. Agencies publish statements on how they use AI. Suppliers should accept that the existence and purpose of a system will be public.
3. Use-case assessment. Each use case is assessed before deployment. Suppliers provide system descriptions, data flows, model lineage and intended use boundaries in writing.
4. Risk classification. Higher-risk uses need deeper controls.
5. Public explanation where people are affected. Suppliers should be comfortable with their solution being described publicly and help draft that description.

Aligning supplier documentation to these obligations lifts bid quality markedly. Treating it as a late tick-box is a common way strong bids come apart. For the wider national guidance, the Department of Industry, Science and Resources published its Guidance for AI Adoption in October 2025, building on the earlier Voluntary AI Safety Standard.

What does IRAP mean for AI hosting?

The Infosec Registered Assessors Program (IRAP) is ASD's mechanism for independent assessment of systems against the Information Security Manual (ISM). Agencies use IRAP assessments to decide whether to accept the residual risk of a system handling OFFICIAL: Sensitive or higher information.

What surprises suppliers:

• IRAP is point-in-time, not certification. An assessor issues a report and the agency decides whether to accept the risk.
• Platform assessments do not cover your application. AWS, Microsoft Azure and Google Cloud hold IRAP assessments for specific services in Australian regions. Your workload built on top still needs its own assessment.
• Hosting rules apply too. The DTA's Hosting Certification Framework governs which providers can host certain government data.
• Time dominates. Plan in quarters, not weeks.

1. Months 0 to 2Gap analysisMap current controls against the ISM. Define the assessment boundary, data flows, integrations and classification target.
2. Months 2 to 6RemediationImplement missing controls. Build the System Security Plan, risk management plan, incident response plan and procedures.
3. Months 6 to 9Engage an IRAP assessorSelect an endorsed assessor. Scoping and pre-assessment workshops.
4. Months 9 to 12Assessment fieldworkEvidence review, interviews, technical testing, findings and remediation.
5. Months 12 to 15Final assessment reportAssessor issues the report. Supplier and agency agree residual-risk treatment.
6. Months 15 to 18Agency acceptanceThe agency accepts or declines the residual risk. System cleared for use at the assessed level.

Reassessment is generally expected periodically and after material change. PROTECTED and above means a deeper assessment and longer remediation. For where the data lives, see our data sovereignty guide.

How do state government AI requirements differ?

Each state runs its own framework on top of, or instead of, the federal stack.

	Key frameworks	What it means in practice	Impact
NSW	NSW AI Assessment Framework, NSW Cyber Security Policy, PPIPA, HRIPA	The most mature state AI regime, with assessment required for AI projects. See our NSW AIAF guide.	High maturity
Victoria	Privacy and Data Protection Act 2014, Victorian Protective Data Security Standards, OVIC guidance	Strong privacy and protective data security expectations set by OVIC.	Strong on privacy
Queensland	Information Privacy Act 2009, Queensland Government information security policy	Security aligned with the ISM; privacy reforms commenced from July 2025.	Aligned to ISM
Western Australia	WA Government Cyber Security Policy, Privacy and Responsible Information Sharing Act 2024	Public sector privacy principles commenced on 1 July 2026 (WA Government, 2026). Check which obligations apply to your agency.	Changing
South Australia	SA Cyber Security Framework, Information Privacy Principles Instruction	Privacy set by administrative instruction rather than statute.	Administrative privacy

An IRAP-assessed system is necessary but not sufficient at state level. Selling into NSW Health means engaging with the NSW AI Assessment Framework and NSW privacy law. Victorian agencies bring VPDSS and OVIC. Plan for state-specific assurance on top of the federal baseline.

What AI risk classes do government buyers assess?

The DTA policy, the NSW framework and national guidance converge on a similar risk model. A supplier who can self-classify is far easier to buy from.

	What it means	Control Expectations	Impact
Low: internal productivity (meeting summaries, drafting non-decision documents)	Minimal external effect. No automated decisions about people.	Acceptable use policy, data classification, no personal information unless cleared, staff training.	Light touch
Medium: internal decision support (triage suggestions, ranked recommendations)	Output influences but does not make a decision about a person.	Model lineage, accuracy monitoring, override logging, bias review, periodic revalidation.	Documented oversight
High: external-facing or affecting individuals (public guidance, eligibility screening, fraud flags)	Output reaches the public or directly informs a decision about a person.	Impact assessment, transparency statement, meaningful human review, audit trail, right of review, bias monitoring.	Robodebt-grade controls
Critical: automated decisions on rights, benefits or safety	AI materially determines outcomes affecting statutory rights or safety.	Avoid by default. If pursued: legal basis review, rigorous testing, senior sign-off, statutory review path, real-time monitoring, kill switch.	Avoid by default

Classify every component of a proposed solution against this table. If any component is Critical, the response should lead with controls, not features. We will not build AI that makes a decision the law says a person must make.

Is a supplier ready to bid on a government AI tender?

Is this supplier ready to bid on this Australian government AI tender?

• No IRAP assessment for the data classification involved (and the tender requires it)Do not bid this round. Start the IRAP path and target a later opportunity.
• IRAP in place but not eligible under the buying arrangement the agency must useSubcontract through an eligible supplier or wait for the arrangement to reopen. Do not assume waivers.
• High or Critical risk use case without evidence of human review, appeal path and representative testingNot ready. Re-scope to lower-risk components or do the assurance work first.
• Hosting outside Australia (and the tender requires onshore)Re-architect onto an IRAP-assessed Australian environment before bidding.
• All four resolved: IRAP, eligibility, risk controls evidenced, onshore hostingBid-ready. Work through the 12-question checklist.

What should be on a 12-question pre-bid checklist?

1. Have we identified every buying arrangement the agency must use, and confirmed eligibility or a subcontracting path?
2. Do we hold a current IRAP assessment matching the data classification and workload scope?
3. Have we classified the use case (Low, Medium, High, Critical) and can we evidence matching controls?
4. Can we name the Australian region where every part of the workload, including inference and retraining, runs?
5. Do we have a documented human review design, appeal path and audit log that survives scrutiny?
6. Have we mapped data flows against the APPs and the relevant state privacy law?
7. Are Archives Act or state records obligations addressed in the architecture?
8. Do our people hold the security clearances required, or is there a credible plan?
9. Have we addressed any Indigenous Procurement Policy requirements?
10. Can we provide a plain-English transparency statement the agency could publish?
11. Is our incident response plan tested in the last 12 months and aligned to the ISM?
12. Have we costed ongoing compliance, not just delivery, into the response?

A "no" on items 1 to 4 should pause the bid decision. Agency buyers can use the same list as an evaluation guide.

How Solve8 can help

Our consultants and engineers help agencies and their suppliers design AI with the human review, audit logging and Australian hosting that government buyers assess, and prepare for IRAP assessment (we do not perform assessments). See our government work and AI strategy service, or talk to us.