Commonwealth and NSW agencies now have written AI obligations with names and dates attached. We help agencies find the AI they already run, assess it, and pilot new use cases with the evidence trail the policies ask for. We help suppliers give their government buyers that evidence.
The Digital Transformation Agency's Policy for the responsible use of AI in government, version 2.0, took effect on 15 December 2025 for non-corporate Commonwealth entities. It sets mandatory requirements for accountable officials, transparency statements, a strategic approach to AI adoption, operationalising responsible use, use case accountability, internal use case registers, staff training and AI use case impact assessment.
NSW went further on process. Under Circular DCS-2026-02, NSW agencies must comply with the NSW AI Operational Policy and apply the AI Assessment Framework when required. From 30 September 2026 the AIAF Platform is the mandatory channel for registering and assessing AI use cases, and anything assessed as high or critical risk goes to the AI Secretariat for review by the NSW AI Review Committee. Our NSW AI Assessment Framework guide walks through the registration, triage and referral steps.
Most of the effort goes into finding out where AI already runs: a vendor switched on a summarisation feature in the case management system, a team uses a public chatbot to draft letters, a Microsoft 365 tenant is about to get Copilot licences. A register is only as good as that inventory, and an impact assessment is only as good as the evidence behind it.
We qualify by the obligation or the problem in front of you, whatever the size of the agency.
An accountable official appointed, a transparency statement to keep current, and a register and impact assessments that need real content behind them.
A backlog of AI use cases to register on the AIAF Platform, with some likely to land in the high or critical bands.
Asset, planning and customer request data spread across systems that do not talk to each other, and pressure to use AI without a governance team.
An AI questionnaire from a buyer, a tender asking how your product uses AI, or a contract clause about notifying material changes.
Copilot licences planned for a tenant where nobody has reviewed who can open which SharePoint sites.
Submissions, correspondence, grant applications or permit files read and keyed by hand, with decisions that must stay with people.
Councils looking at maintenance and asset data should read our post on asset health AI for local councils. Suppliers should start with selling AI into Australian government and our tender compliance guide.
Interviews, licence and vendor reviews, and a look at network and SaaS logs where available, to find AI in use, including features vendors enabled inside systems you already own.
Register entries and draft use case impact assessments for your accountable owners to review, written against the DTA policy or the NSW AIAF depending on your jurisdiction.
A plain-language account of how the agency uses AI and what safeguards exist, drawn from the inventory so the published statement matches reality.
A permissions and sharing review before Copilot is switched on, through our Copilot readiness service. The DTA's own Copilot trial evaluation warned that the tool can magnify poor information management.
Document triage, correspondence drafting, submissions analysis or asset data work, built with a human decision point, logging and a rollback plan from day one.
For vendors: a documented account of where AI runs in the product, what data it touches, how model changes are notified and how a person can override it.
The Microsoft 365 work runs through our Copilot readiness assessment, and where content cannot leave your environment we design options under private AI infrastructure.
See what this would take in your business
A free 30-minute review on Microsoft Teams. Bring the process you want fixed and leave with a clear first step.
| Metric | NSW AI Operational Policy and AIAF | DTA policy v2.0 | Improvement |
|---|---|---|---|
| Applies to | NSW Government agencies | Non-corporate Commonwealth entities, with some exceptions | Check which binds you |
| Instrument | Circular DCS-2026-02 | Policy effective 15 December 2025 | Both mandatory |
| Inventory | Registration on the AIAF Platform | Internal use case register | Same source data |
| Risk assessment | AIAF self-assessment, high and critical referred to the Review Committee | AI use case impact assessment | One evidence pack serves both |
An agency that also runs critical infrastructure assets has a further layer, covered in our post on the SOCI Act and CIRMP. Organisations wanting a management system around all of this can map it to ISO 42001.
The scope is agreed in the first conversation. This is the usual shape.
Timing depends on how many business units hold AI use cases and how quickly owners respond, so we set dates after discovery.
Ongoing upkeep can sit with your team or with our managed AI services. Pilots that need data from several systems draw on our system integration and process automation work.
See what this would take in your business
A free 30-minute review on Microsoft Teams. Bring the process you want fixed and leave with a clear first step.
Councils and many state bodies handle personal information under their own state privacy laws, and Commonwealth agencies under the Privacy Act. Where AI informs decisions about people, the design question is the same: who decides, what record exists of how the recommendation was reached, and how does a person challenge it. Our post on automated decisions and the 2026 privacy rules covers the federal changes, and AI agent governance and human override covers the controls.
Where data is processed matters as much as where it is stored. Our data sovereignty explainer and the data sovereignty guide set out the hosting options, from Australian cloud regions to models that run inside your own network.
Solve8 is based in Brisbane. Agency work is mostly remote, with workshops in person where that helps. See our Canberra and Brisbane pages, or start with an AI strategy engagement if you have not yet decided where AI fits.
Book a 30-minute scoping call. Tell us which policy applies, what you know about current AI use and what deadline you are working to, and we will agree what the first phase should cover. Engagement options are on our pricing page.