Public-sector AI governance under DTA Policy 2.0 and the state frameworks.

The Digital Transformation Agency's Policy for Responsible Use of AI in Government (Version 2.0, effective 15 December 2025) requires designated accountable officials, published transparency statements, risk-based impact assessments using the DTA AI Impact Assessment Tool, and AI fundamentals training for all APS staff by December 2026. High-risk use cases involving security-relevant capabilities, critical infrastructure, or large-scale decision-making must be referred to the AI Review Committee.

The Robodebt scheme ended in a class action settlement after the Royal Commission found its automated decision-making unlawful. Recommendation 17.1 calls for a consistent framework that keeps ADM systems fit for purpose, lawful and fair, and protects human and legal rights. Every automated decision an agency makes has to meet the administrative law tests of lawfulness, procedural fairness, rationality and explainability.

NSW mandates its AI Assessment Framework through the NSW AI Operational Policy under Circular DCS-2026-02, and since 30 September 2026 every new AI use case is registered and assessed on the AIAF Platform. Assessments test community benefit, fairness, privacy and security, transparency and accountability, with AI Review Committee referral for High or Critical use cases. Victoria's Administrative Guideline applies under the Public Administration Act 2004 and requires Charter of Human Rights compatibility. Queensland was the first jurisdiction nationally to mandate ISO 38507 for public-sector AI governance, with the FAIRA risk assessment framework. Multi-jurisdictional organisations need unified strategies that satisfy all of them.

AI systems used in government decision-making are subject to FOI obligations and produce outputs that must be explained, documented, and disclosable. The Privacy and Other Legislation Amendment Bill 2024 requires entities to disclose the types of personal information used in automated decisions that have legal or similarly significant effect on individuals. The AI Model Clauses (Version 2.0, March 2025) require vendors to obtain prior written approval for AI use, ensure human oversight, provide transparency of outputs, and adopt ISO/IEC 42001 where risk assessments indicate heightened exposure. PSPF Directions 001/002 restrict certain products on security grounds.