NSW AI Assessment Framework: Agencies and Suppliers

The Date That Changed the NSW AI Assessment Framework

On 30 September 2026 the NSW AI Assessment Framework (AIAF) stopped being a spreadsheet. From that date, every NSW Government agency must use the AIAF Platform for all new AI use case registrations and assessments, according to Digital NSW. The framework sits under a new instrument, Department of Customer Service Circular DCS-2026-02, issued on 30 July 2026, and a new NSW AI Operational Policy that replaces the old NSW AI Ethics Policy.

That matters to two groups. Agencies now have a register to populate, an Accountable Official to appoint and a signed annual attestation coming due. Suppliers selling AI-enabled software, analytics or managed services into NSW are not directly bound by the policy, but every buying team they deal with is, and the evidence an agency needs to complete its assessment has to come from somewhere.

The job market already shows the shift. In October 2026 a NSW agency was advertising an AI governance analyst role on SEEK with "AIAF activities" written into the duties. This guide sets out what is mandatory, how the risk self-assessment and review thresholds work, and what a supplier should have ready before the first procurement conversation. It also covers, briefly, how NSW sits alongside the Commonwealth's Policy for the responsible use of AI in government.

What is the NSW AI Assessment Framework? The AIAF is a mandatory risk self-assessment framework that NSW Government agencies apply when they design, develop, deploy, procure or use systems containing AI. Use cases are registered on the AIAF Platform, and any assessed as high or critical risk must be referred to the NSW AI Review Committee.

What Changed in 2026

NSW has had an AI assurance framework since 2022, and the National framework for the assurance of AI in government records that the NSW framework was used as the baseline for the national one. What changed this year is the operating model around it.

In January 2026 the NSW Government announced a modernised framework, developed with CSIRO's Data61, that it said reduced assessment time from days to less than 30 minutes and aligned with the Commonwealth's national framework and the EU AI Act. The NSW Secretaries Board then approved the NSW AI Operational Policy (version 1.0) on 11 June 2026, version 1.1 followed on 31 August 2026, and Circular DCS-2026-02 made it mandatory, replacing the 2024 circular DCS-2024-04.

The mandatory agency requirements in the circular are short enough to quote in full. Agencies must:

1. Adhere to Australia's AI Ethics Principles when using, designing, developing, deploying and implementing AI systems
2. Appoint an Accountable Official to oversee the policy and coordinate with NSW GovAI within Digital NSW
3. Establish governance and assurance of AI, using existing functions where possible
4. Register all AI use cases in the AIAF Platform and keep the records accurate through the lifecycle
5. Apply the AIAF where registration determines an assessment is required
6. Refer high-risk and critical-risk AI use cases to the AI Review Committee
7. Align agency ICT Acceptable Use policies with the policy
8. Make AI literacy and policy training available to relevant employees

The policy adds two dates. The Accountable Official must be notified to NSW GovAI within three months of the policy being issued, and the first signed annual attestation, endorsed by the Accountable Official and approved by the Agency Head, is due by 31 October 2027. An agency that cannot meet every requirement by then can request an extension with a time-bound remediation plan and interim controls.

How Registration, Risk Bands and Review Work

The new process starts with registration. That is the biggest practical change, because most AI use in an agency will never need a full AIAF assessment, and the registration step is what decides.

What has to be registered

Under section 10.3 of the NSW AI Operational Policy, AI use cases must be registered before use, and existing uses registered as soon as practicable. Registration is required where AI introduces elevated risk, significant operational reliance, affects people, decisions or services, or uses personal and sensitive information. The policy names four examples: AI that automates or materially influences consequential decisions, AI embedded in operational workflows or public-facing services, autonomous or semi-autonomous AI interactions, and use of highly sensitive or security-classified information beyond approved purposes.

Routine productivity, drafting, summarisation, coding support and exploratory use of approved agency AI tools do not generally require registration, provided meaningful human oversight is maintained. The policy also excludes standard automation that follows predefined logic, such as macros, scripts, deterministic rules and descriptive analytics. When in doubt, the policy says to take a precautionary approach and start registration.

Intrinsic risk and the review threshold

The AIAF uses an intrinsic risk approach. The policy describes intrinsic risk as a function of what the use case involves and how it is intended to be used, rather than how it may later be managed or mitigated. The intrinsic risk band sets the minimum governance and oversight. That has a consequence suppliers should understand: strong controls in your product leave the recorded band where it is, and their value is in helping the agency show that the obligations attached to that band are met.

Agencies must refer high-risk and critical-risk use cases to the NSW AI Review Committee, which the circular describes as comprising academia, industry and NSW Government experts. Referral goes to the AI Secretariat within 5 business days of completing the AIAF. NSW GovAI may also refer medium-risk use cases where higher risk characteristics are present. The Committee provides advice on risk mitigation. Separately, the policy notes that subject matter expert review under the AIAF does not approve or reject a use case, certify legal compliance, authorise deployment or accept organisational risk. Those decisions stay with the agency.

There is one more layer. Digital NSW states that projects with a budget over $5 million, or funded through the Digital Restart Fund, receive additional central oversight under the NSW Digital Assurance Framework to confirm AIAF compliance.

What It Means for Suppliers

The policy is explicit that it "is not mandatory for local government, universities or third-party suppliers", and that the registration requirement does not apply to suppliers that use AI as part of services they provide to government. The policy says those arrangements are "managed through procurement, contracting, and supplier assurance processes."

In practice the obligation moves to the buyer, who then pushes it down the contract. The agency's Accountable Official must ensure third-party supplier risks are identified and managed, and the policy requires that "contractual arrangements must support transparency, including mechanisms for suppliers to disclose AI use and notify the agency of material changes over time." The NSW Government's AI procurement essentials guidance (last updated May 2026, before the Operational Policy replaced the Ethics Policy) already tells buying teams to complete AIAF triage in the plan stage, assess each supplier's ability to manage the risks the AIAF identifies during sourcing, and write contract levers for ongoing assessment, algorithm updates and failsafe conditions.

The same guidance lists four procurement types that pull AI into scope, and the last is the one suppliers miss: adding AI features to an existing product or contract. A vendor that switches on a generative feature in a system an agency already runs has created a change the agency must register and possibly reassess. The policy separately tells employees not to activate AI features, plugins or integrations in agency systems unless explicitly approved.

Consider a supplier of case management software adding an AI triage feature that ranks incoming applications. Under the policy's examples, that materially influences consequential decisions and is embedded in an operational workflow, so the agency would register it and almost certainly complete a full assessment. Whether the supplier can answer the assessment questions quickly and in writing will shape how long that takes.

Each item in that pack maps to something the agency is already required to do: disclose and explain AI use, keep human oversight for decisions affecting people, retain AI outputs and metadata where they inform decisions, and reassess on material change. A supplier that hands this over in the first meeting removes the slowest part of the agency's assessment.

In my experience on data platform and reporting programs at BHP, Rio Tinto and Senex Energy, delivered while working for previous consulting employers, assurance gates were rarely slowed by the technology itself. They stalled on missing evidence: lineage nobody had written down, a change process nobody owned, a vendor who could not say which version was in production. The AIAF platform will expose the same gap, because a registered use case with blank fields is visible to NSW GovAI.

How NSW Sits Alongside the Commonwealth

Suppliers that sell into both Canberra and Macquarie Street will meet two parallel regimes built on the same foundation. The national framework, agreed by the Data and Digital Ministers Meeting on 21 June 2024, applies Australia's AI Ethics Principles through five cornerstones: governance, data governance, a risk-based approach, standards and procurement. Its procurement cornerstone asks governments to consider ethics principles, clear accountabilities, transparency of data, access to information assets and proof of performance testing throughout the life cycle.

The Commonwealth Policy for the responsible use of AI in government, version 2.0, is published by the Digital Transformation Agency. Its mandatory requirements cover accountable officials, transparency statements, a strategic approach to AI adoption, operationalising responsible use, use case accountability, internal registers, staff training and use case impact assessment. The vocabulary differs, but the evidence a supplier needs is close to identical. One well-maintained evidence pack can serve both.

A Practical Timeline

For an agency, the sequence over the next year is straightforward to describe and harder to do. Confirm the Accountable Official. Inventory the AI already running, including AI features vendors have switched on inside existing systems. Register what the policy captures, starting with anything that touches decisions about people. Assess, refer high and critical risk within five business days, and build the evidence trail the attestation template will ask for.

For a supplier, the work is narrower. Map your product against the registration questions so you can tell a buyer in advance whether your feature is likely to trigger a full assessment. Build the evidence pack. Write a change notification commitment into your standard terms before an agency asks for it. If your product includes autonomous or agentic behaviour, read Digital NSW's guidance on AI agents, because the policy calls for strict controls where AI can plan, decide or act on its own.

Getting Started

If you are an agency team facing a registration backlog, or a supplier who has just been sent an AIAF questionnaire, the first step is the same: an honest inventory of where AI actually runs and what evidence exists for each use. Solve8's AI strategy service includes governance work of this kind, and our government sector page covers how we approach public sector engagements more broadly. The governance groundwork overlaps with an ISO 42001 AI management system, and suppliers covered by the Privacy Act face the automated decision transparency obligations that commence on 10 December 2026.

Your next steps this week:

1. List every AI feature in systems you run or sell into NSW, including ones switched on by default
2. Run each through the four registration questions: approved tool, consequential decisions, elevated risk, experimental use
3. Book a 30-minute scoping call or contact our team to work out which use cases need assessment first

Common Questions

Is the NSW AI Assessment Framework mandatory?

Yes, for NSW Government agencies. Circular DCS-2026-02 makes the NSW AI Operational Policy mandatory, and the policy requires agencies to register AI use cases on the AIAF Platform and complete an AIAF assessment wherever registration determines one is required. From 30 September 2026 the platform is the mandatory channel for new registrations and assessments.

Does the NSW AI Operational Policy apply to suppliers and local councils?

The policy states it is not mandatory for local government, universities or third-party suppliers. Suppliers are still affected indirectly, because agencies must manage third-party AI risks through procurement, contracting and supplier assurance, and contracts must include ways for suppliers to disclose AI use and notify material changes.

When does an AI use case go to the NSW AI Review Committee?

Agencies must refer use cases assessed as high or critical risk to the AI Review Committee, through the AI Secretariat, within 5 business days of completing the AIAF. NSW GovAI may also refer medium-risk use cases that show higher risk characteristics. The Committee gives advice on risk mitigation and does not approve deployment.

Do staff need to register every use of ChatGPT or Copilot?

Generally not. The policy says routine productivity, drafting, summarisation, coding support and exploratory use of approved agency AI tools do not usually require registration where meaningful human oversight is maintained. Registration is required when AI is embedded in workflows or services, influences consequential decisions, acts autonomously or uses highly sensitive information.

What is the difference between the NSW AIAF and the Commonwealth AI policy?

They apply to different governments but rest on the same national framework and Australia's AI Ethics Principles. NSW uses the AIAF Platform and an intrinsic risk band with AI Review Committee referral. The Commonwealth policy version 2.0 requires internal use case registers, use case impact assessments and published transparency statements. The supplier evidence needed for both is largely the same.

When is the first NSW agency AI attestation due?

Agencies must submit a signed annual attestation to NSW GovAI by 31 October each year, with the first due by 31 October 2027. It is endorsed by the Accountable Official and approved by the Agency Head, and an agency can request an extension for the first period with a time-bound remediation plan.

Related Reading:

• Selling AI Into Australian Government - The wider set of federal and state obligations suppliers meet when tendering AI into government.
• ISO 42001: Australia's AI Management Standard - How a certifiable AI management system produces the evidence an AIAF assessment asks for.
• AI Automated Decisions: 2026 Privacy Rules - The Privacy Act transparency duties that apply to automated decisions about people.
• AI Agent Governance: Privacy and Human Override - Practical controls for agentic AI, relevant to the policy's rules on autonomous systems.

Sources: Circular DCS-2026-02, Department of Customer Service (issued 30 July 2026, updated 1 September 2026); NSW AI Operational Policy, version 1.1 (2026); Digital NSW, NSW AI Assessment Framework page (accessed October 2026); NSW Government media release, 27 January 2026; buy.nsw AI procurement essentials (updated 6 May 2026); Digital Transformation Agency, Policy for the responsible use of AI in government v2.0 (effective 15 December 2025); National framework for the assurance of AI in government, version 1.0 (21 June 2024).