An AI strategy under Australia's National AI Plan means turning the National AI Centre's six essential practices (the AI6) into decisions your organisation actually runs: where AI belongs, who is accountable, how risk is assessed, how systems are tested, and where people stay in control. The guidance is voluntary, so the work of making it operational sits with you.
Key takeaways
- The National AI Plan (December 2025) chose voluntary guidance over mandatory guardrails for the broad economy.
- The National AI Centre's Guidance for AI Adoption (October 2025) sets out six essential practices: accountability, impact, risk, transparency, testing and human control.
- Voluntary guidance still sets the benchmark regulators and courts will use to judge whether you acted reasonably.
- Some practices are already hardening into law, including Privacy Act transparency for certain automated decisions from 10 December 2026.
- Start with the weakest practice, usually accountability, and build a review rhythm that lasts beyond launch.
Why does voluntary AI guidance still matter?
In December 2025 the Australian Government released its National AI Plan. The headline most organisations took from it was that the mandatory AI guardrails proposed in 2024 would not go ahead. The government chose a voluntary path, anchored by the National AI Centre's Guidance for AI Adoption and backed by a new AI Safety Institute.
That reads like a reprieve. It is closer to a delegation. By declining to prescribe rules, the government has told organisations to govern their own AI, while making clear it will watch and step in where gaps appear. Guidance that regulators and courts can point to as the reasonable standard carries real weight, and it comes without an instruction manual.
That is where an AI strategy earns its keep. This guide translates the national reference point into something an operating organisation can use, and marks out where AI strategy advisory adds value and where it is overhead.
The framework tells you what, the strategy decides how The six essential practices describe outcomes. They deliberately do not say how to achieve them in your organisation. Turning the what into a how is the strategy work.
What does the National AI Plan ask of organisations?
The centre of gravity is the National AI Centre's Guidance for AI Adoption, published on 21 October 2025. It evolves the earlier Voluntary AI Safety Standard and its ten guardrails into six essential practices, often called the AI6.
- AccountabilityName who owns AI decisions and outcomes
- Understand impactAssess effects on people before deploying
- Manage riskMeasure and control risk across the lifecycle
- Be transparentTell affected people AI is being used
- Test and monitorVerify performance before and after go-live
- Human controlKeep meaningful human oversight in place
Read as a checklist, the AI6 looks like housekeeping. Read as a strategy input, each practice implies a question leadership should be able to answer about any AI it runs. Who is accountable if this gets it wrong? What is its effect on the people it touches? How do we know it works, and would we notice if it stopped? An organisation that can answer those questions across its AI has a strategy. One that cannot has a collection of tools.
Binding law is moving the same way. The transparency practice is already a legal requirement where personal information is involved: from 10 December 2026 the Privacy Act requires disclosure of certain AI-driven automated decisions. Treat the AI6 as the minimum.
Why do you need an AI strategy if the rules are voluntary?
No penalty attaches directly to skipping the AI6, so a busy leadership team can fairly ask why it should formalise something the law does not yet compel. The answer is that existing law already reaches AI conduct.
- Directors' duties. Care and diligence obligations under the Corporations Act 2001 apply to decisions about AI.
- Anti-discrimination law. It applies to automated screening of candidates or customers.
- Australian Consumer Law. It applies to automated conduct that misleads.
When an AI system causes harm, the question afterwards is whether the organisation acted reasonably. Freely available national guidance is exactly the benchmark that question gets measured against.
There is also a performance reason. The gap between organisations that deploy AI deliberately and those that bolt it on is widening. A strategy built on the AI6 is the discipline that separates AI that compounds value from AI that quietly creates rework and mistrust.
| File and forget | Turn it into strategy | Impact | |
|---|---|---|---|
| Accountability | No one clearly owns AI | Named executive owner and policy | Governed |
| Risk | Discovered after incidents | Assessed before deployment | Proactive |
| Adoption | Ad hoc tools per team | Prioritised, sequenced roadmap | Coherent |
| Defensibility | Cannot show reasonable care | Documented against national guidance | Evidenced |
How do you turn the AI6 into an operating strategy?
It comes down to four decisions, made deliberately:
- Where AI belongs. Not every process should be automated. A good strategy is as much about what you decline as what you pursue.
- Who owns it. A named executive owner, a short AI policy and a route for escalating concerns.
- What comes first. A prioritised roadmap, because attempting every use case at once means none is done well.
- How it stays honest. A review discipline that continues for as long as the AI runs.
Sector context shapes the strategy, beyond the paperwork. A manufacturer in Adelaide's advanced manufacturing and defence supply chain weighs AI differently from a professional services firm, because its highest-value use cases sit in operations, quality and supply chain, and its data constraints are tighter. That is the logic behind our work with manufacturing and industrial operators, and why local context matters when organisations in Adelaide and other industrial centres plan AI adoption.
- Stage 1FrameDecide where AI belongs and where it does not
- Stage 2OwnName accountability and set a simple AI policy
- Stage 3SequencePrioritise use cases into a realistic roadmap
- Stage 4ReviewTest, monitor and revisit as the portfolio grows
For more depth on the roadmap, see our guide on how to build an AI strategy for an Australian business, and our explainer on what an AI strategy consulting engagement involves.
Where should you start when everything feels urgent?
Leadership teams often stall because every practice looks equally urgent. The right starting point is wherever the organisation is weakest, and a short diagnostic beats a long debate.
What is the biggest gap in how your organisation handles AI today?
- No one clearly owns AI decisionsStart with accountability: name an owner and a policy
- Tools are spreading with no planStart with a prioritised adoption roadmap
- You are unsure what AI you even runStart with an inventory and impact assessment
- Deployed AI but never checks it worksStart with testing and monitoring discipline
Starting narrow builds momentum. A team that names an accountable owner and writes a one-page AI policy in a fortnight has done more real strategy work than one that commissions a framework it never uses. The practices reinforce each other: accountability makes risk assessment happen, risk assessment shows what needs monitoring, and monitoring feeds the next roadmap decision.
Tool selection comes after this. A common mistake is comparing platforms before deciding what they are for. Fix accountability and priorities first, then choose tools against real use cases. Our comparison of Monday, Asana and ClickUp's AI features is a good example of a decision that should follow the strategy.
Which AI6 practice do organisations skip most often?
Testing and monitoring. Accountability and impact assessment happen at the start of a project, when attention is high. Testing and monitoring happen for the life of the system, which makes them the first casualty of a busy quarter.
AI systems degrade in ways traditional software does not. A model that performed well at launch can drift as the data it sees moves away from the data it was built on, and nothing announces that it is now less reliable. The guidance treats test and monitor as a lifecycle practice for exactly this reason.
Build the rhythm at design stage. For each use case, decide what good performance looks like, how often it is checked, and who acts when the numbers slip. Those decisions are cheap up front and expensive after an incident.
How does data sovereignty fit into an AI strategy?
The National AI Plan's emphasis on trusted adoption connects directly to where AI systems and their data sit. An organisation handling sensitive customer, health or operational data has to decide which AI to use, where it runs, and who can reach the data it processes.
This matters most where data cannot leave the country or the organisation for legal or contractual reasons: government-adjacent work, defence supply chains, health and parts of financial services. The right design may be AI that runs on your own infrastructure in Australia, in your cloud or on your own servers. Make that call at strategy stage, before procurement forces it. Our data sovereignty guide and private AI infrastructure page cover the options.
What does good AI advisory look like against this framework?
Because the guidance is voluntary, the market for help with it is unregulated and quality varies. The AI6 itself is a useful test. Good advisory leaves your organisation able to answer the six questions on its own. Poor advisory leaves a slide deck and a dependency.
- Clear accountability for every AI systemNo orphans
- A sequenced roadmap instead of scattered toolsFocus
- Documented reasonable care against national guidanceDefensible
- A repeatable review rhythm as AI scalesDurable
The other mark of quality is proportion. An organisation running two AI tools does not need the governance apparatus of a bank. The same six questions apply at any size, while the effort behind the answers should match your exposure.
How Solve8 can help
Our consultants help mid-sized and enterprise Australian and New Zealand organisations turn the AI6 into a working plan: an accountable owner, a prioritised roadmap and a review rhythm sized to your risk. See our AI strategy service, or talk to us about where to start. We work as fixed-fee phases, and you can stop after any phase.
