The NSW AI Assessment Framework (AIAF) is the mandatory risk self-assessment that NSW Government agencies apply when they design, build, buy or use AI. Since 30 September 2026, every new AI use case must be registered and assessed on the AIAF Platform. High and critical risk use cases go to the NSW AI Review Committee. Suppliers are not bound directly, but agencies push the evidence requirements into contracts.
That change, confirmed by Digital NSW, sits under Department of Customer Service Circular DCS-2026-02, issued 30 July 2026, and the new NSW AI Operational Policy, which replaces the old NSW AI Ethics Policy.
This guide sets out what is mandatory, how risk bands and review thresholds work, what a supplier should have ready before the first procurement conversation, and how NSW sits alongside the Commonwealth policy.
Key takeaways
- The AIAF Platform is the mandatory channel for all new NSW AI registrations and assessments from 30 September 2026.
- Registration comes first and decides whether a full AI assessment framework review is needed. Routine drafting with approved tools usually does not need registering.
- High and critical risk use cases must be referred to the AI Review Committee within 5 business days of completing the AIAF.
- Suppliers are excluded from the policy itself, but contracts must let them disclose AI use and notify material changes. An evidence pack is the fastest way to win that conversation.
- The first signed agency attestation to NSW GovAI is due by 31 October 2027.
What is the NSW AI Assessment Framework?
The AIAF is a structured risk self-assessment for AI systems used by NSW Government agencies. It asks what the AI does, what data it uses, whom it affects and how humans oversee it, then assigns an intrinsic risk band that sets the minimum governance required.
NSW has had an AI assurance framework since 2022. The National framework for the assurance of AI in government records that the NSW framework was used as the baseline for the national one. What changed in 2026 is the operating model around it.
What changed in 2026?
In January 2026 the NSW Government announced a modernised framework, developed with CSIRO's Data61, that it said reduced assessment time from days to less than 30 minutes and aligned with the national framework and the EU AI Act. The NSW Secretaries Board approved the NSW AI Operational Policy (version 1.0) on 11 June 2026, version 1.1 followed on 31 August 2026, and Circular DCS-2026-02 made it mandatory, replacing the 2024 circular DCS-2024-04.
| Under DCS-2024-04 | Under DCS-2026-02 | |
|---|---|---|
| Mandatory ethics instrument | NSW AI Ethics Policy | NSW AI Operational Policy, adopting Australia's AI Ethics Principles |
| Assessment tool | AIAF as an Excel-based self-assessment | AIAF Platform, mandatory from 30 September 2026 |
| Time to complete an assessment | Days, by the NSW Government's account | Less than 30 minutes, per the January 2026 announcement |
| Review of high and critical risk | NSW AI Review Committee | NSW AI Review Committee, with medium risk referable by NSW GovAI |
What DCS-2026-02 requires of agencies
The mandatory requirements in the circular are short. Agencies must:
- Adhere to Australia's AI Ethics Principles when using, designing, developing, deploying and implementing AI systems
- Appoint an Accountable Official to oversee the policy and coordinate with NSW GovAI within Digital NSW
- Establish governance and assurance of AI, using existing functions where possible
- Register all AI use cases in the AIAF Platform and keep the records accurate through the lifecycle
- Apply the AIAF where registration determines an assessment is required
- Refer high-risk and critical-risk AI use cases to the AI Review Committee
- Align agency ICT Acceptable Use policies with the policy
- Make AI literacy and policy training available to relevant employees
The Accountable Official must be notified to NSW GovAI within three months of the policy being issued. The first signed annual attestation, endorsed by the Accountable Official and approved by the Agency Head, is due by 31 October 2027. An agency that cannot meet every requirement can request an extension with a time-bound remediation plan and interim controls.
Is the AIAF Platform a next generation AI-enabled assessment platform?
Some buyers search for the AIAF as a "next generation AI-enabled assessment platform". In practice, the AIAF Platform is the online system that replaced the Excel self-assessment. It runs rules-based triage questions at registration, sets the intrinsic risk band and lists the mandatory assurance activities for each use case.
The policy documents describe what the platform decides and records. They do not describe it as using AI to make the assessment. Treat it as a structured, auditable workflow where NSW GovAI can see each registered use case, including any with blank fields.
How do registration, risk bands and review work?
The process starts with registration. Most AI use in an agency will never need a full AIAF assessment, and the registration step decides.
- RegisterAgency, Accountable Owner and use case details on the AIAF Platform
- TriageRules-based questions decide if an AIAF assessment is required
- AssessPlatform sets the intrinsic risk band and mandatory assurance activities
- MitigateRespond to focus areas, which may include privacy, human rights or cyber review
- ReferHigh or critical risk goes to the AI Secretariat for AI Review Committee advice
- ReassessRepeat when purpose, data, decision context or risk materially changes
What has to be registered?
Under section 10.3 of the NSW AI Operational Policy, AI use cases must be registered before use, and existing uses registered as soon as practicable. Registration is required where AI introduces elevated risk or significant operational reliance, affects people, decisions or services, or uses personal and sensitive information. The policy gives four examples:
- AI that automates or materially influences consequential decisions
- AI embedded in operational workflows or public-facing services
- Autonomous or semi-autonomous AI interactions
- Use of highly sensitive or security-classified information beyond approved purposes
Routine productivity, drafting, summarisation, coding support and exploratory use of approved agency AI tools do not generally require registration, provided meaningful human oversight is maintained. The policy also excludes standard automation that follows predefined logic, such as macros, scripts, deterministic rules and descriptive analytics. When in doubt, the policy says to start registration.
How is the AI being used?
- Drafting, summarising or coding with an approved agency tool, human checks everythingGenerally no registration required
- Macros, scripts, deterministic rules or descriptive dashboardsOut of scope: not AI under the policy
- Embedded in a workflow, service or public-facing channelRegister; the platform decides if an AIAF assessment follows
- Automates or materially influences decisions about peopleRegister and expect a full AIAF assessment
- Assessment returns high or critical intrinsic riskRefer to the AI Review Committee via the AI Secretariat
Intrinsic risk and the review threshold
The AIAF uses an intrinsic risk approach: risk is a function of what the use case involves and how it is intended to be used, before mitigation. The band sets the minimum governance and oversight. For suppliers, strong product controls leave the recorded band where it is. Their value is in helping the agency show the obligations attached to that band are met.
Agencies must refer high-risk and critical-risk use cases to the NSW AI Review Committee, made up of academia, industry and NSW Government experts. Referral goes to the AI Secretariat within 5 business days of completing the AIAF. NSW GovAI may also refer medium-risk use cases with higher risk characteristics. The Committee advises on mitigation. Subject matter expert review does not approve or reject a use case, certify legal compliance or authorise deployment. Those decisions stay with the agency.
Digital NSW also states that projects with a budget over $5 million, or funded through the Digital Restart Fund, receive additional central oversight under the NSW Digital Assurance Framework.
What is NSW GovAI's role?
NSW GovAI sits within Digital NSW. It receives Accountable Official notifications, can see registered use cases on the AIAF Platform, may refer medium-risk cases to the AI Review Committee, and receives each agency's annual attestation. For agencies, NSW GovAI is the central contact for AIAF questions. Suppliers rarely deal with it directly.
What does the AIAF mean for suppliers?
The policy says it "is not mandatory for local government, universities or third-party suppliers", and registration does not apply to suppliers that use AI as part of services they provide to government. Those arrangements are "managed through procurement, contracting, and supplier assurance processes."
In practice the obligation moves to the buyer, who pushes it down the contract. The Accountable Official must ensure third-party supplier risks are managed, and "contractual arrangements must support transparency, including mechanisms for suppliers to disclose AI use and notify the agency of material changes over time." The NSW Government's AI procurement essentials guidance tells buying teams to complete AIAF triage in the plan stage, assess each supplier's ability to manage the risks during sourcing, and write contract levers for ongoing assessment, algorithm updates and failsafe conditions.
The same guidance lists four procurement types that pull AI into scope. The one suppliers miss is adding AI features to an existing product or contract. A vendor that switches on a generative feature in a system an agency already runs has created a change the agency must register and possibly reassess.
For example, a supplier of case management software adds an AI triage feature that ranks incoming applications. That materially influences consequential decisions and sits inside an operational workflow, so the agency would register it and almost certainly complete a full assessment. How quickly the supplier can answer in writing will shape how long that takes.
- Where AI is used in the product, and which features can be switched offAI use disclosure
- Model provider, hosting location and whether inputs are retained or used for trainingData handling
- Performance testing method, known limitations and bias testing resultsTesting evidence
- How a human reviews, overrides or appeals an outputHuman oversight
- Logging of outputs and metadata that agencies can keep as State recordsRecordkeeping
- Advance notice of model, feature or data changesChange notification
Each item maps to something the agency must already do: disclose and explain AI use, keep human oversight for decisions affecting people, retain AI outputs where they inform decisions, and reassess on material change.
Across our consultants' careers on data platform and reporting programs at BHP, Rio Tinto and Senex Energy, assurance gates rarely stalled on technology. They stalled on missing evidence: lineage nobody had written down, a change process nobody owned, a vendor who could not say which version was in production. The AIAF Platform will expose the same gap.
How does the NSW AIAF compare with the Commonwealth AI policy?
Suppliers selling into both Canberra and Macquarie Street meet two regimes built on the same foundation. The national framework, agreed by the Data and Digital Ministers Meeting on 21 June 2024, applies Australia's AI Ethics Principles through five cornerstones: governance, data governance, a risk-based approach, standards and procurement.
| NSW AI Operational Policy | Commonwealth Policy v2.0 | |
|---|---|---|
| Who it binds | NSW Government sector agencies and statutory bodies | Non-corporate Commonwealth entities, with some exceptions |
| In force | Circular DCS-2026-02, issued 30 July 2026 | Effective 15 December 2025 |
| Named accountability | Accountable Official and Accountable Owner | Accountable officials and use case accountability |
| Inventory | AIAF Platform registration | Internal AI use case register |
| Risk assessment | AIAF intrinsic risk band | AI use case impact assessment |
| Public facing duty | Disclose and explain AI use to the public | Published AI transparency statement |
The Commonwealth Policy for the responsible use of AI in government, version 2.0, is published by the Digital Transformation Agency. The vocabulary differs, but the evidence a supplier needs is close to identical. One well-maintained evidence pack can serve both. Our Canberra AI automation guide covers the Commonwealth side for suppliers.
What are the key AIAF dates?
- 21 Jun 2024National framework agreedData and Digital Ministers release the national assurance framework
- 15 Dec 2025Commonwealth policy v2.0DTA policy update takes effect for Commonwealth entities
- 30 Jul 2026Circular DCS-2026-02NSW AI Operational Policy becomes mandatory, replacing DCS-2024-04
- 30 Sep 2026AIAF Platform mandatoryAll new registrations and assessments go through the platform
- 31 Oct 2027First attestationSigned agency attestation for 2026-27 due to NSW GovAI
For agencies: confirm the Accountable Official. Inventory the AI already running, including features vendors have switched on inside existing systems. Register what the policy captures, starting with anything touching decisions about people. Assess, refer high and critical risk within five business days, and build the evidence trail the attestation will ask for.
For suppliers: map your product against the registration questions so you can tell a buyer whether your feature is likely to trigger a full assessment. Build the evidence pack. Write a change notification commitment into your standard terms. If your product includes agentic behaviour, read Digital NSW's guidance on AI agents.
The governance groundwork overlaps with an ISO 42001 AI management system, and organisations covered by the Privacy Act face the automated decision transparency obligations commencing 10 December 2026.
How Solve8 can help
We help agencies and suppliers inventory where AI runs, map it against the AIAF and build the evidence pack before the first questionnaire lands. See our AI strategy service and government solutions, or contact us to work out which use cases need assessment first.
Sources: Circular DCS-2026-02, Department of Customer Service (issued 30 July 2026); NSW AI Operational Policy, version 1.1 (2026); Digital NSW, NSW AI Assessment Framework page (accessed October 2026); NSW Government media release, 27 January 2026; buy.nsw AI procurement essentials (updated May 2026); DTA, Policy for the responsible use of AI in government v2.0 (effective 15 December 2025); National framework for the assurance of AI in government, version 1.0 (21 June 2024).
