⚡ Quick Summary
Published by the Digital Transformation Agency, this policy sets the mandatory requirements for how Australian Government agencies adopt and use artificial intelligence. Version 2.0 takes effect on 15 December 2025, replacing v1.1, and the introduction describes a December 2025 update that adds measures on AI governance.
The policy applies to all non-corporate Commonwealth entities as defined by the Public Governance, Performance and Accountability Act 2013, with carveouts for the defence portfolio and the national intelligence community. It is organised into three parts — strategy and oversight, preparedness and operations, and AI use case impact assessment — each with principles and mandatory requirements. Agencies must publish an AI transparency statement, develop a strategic position on AI adoption within 6 months, designate accountable officials, appoint accountable use case owners and build an internal AI use case register within 12 months, and share that register with the DTA every 6 months. They must operationalise responsible AI and deliver mandatory staff training within 12 months.
In-scope AI use cases are defined by criteria in Appendix C. Agencies must run an impact assessment using the Australian Government AI impact assessment tool or an equivalent internal process, report high-risk use cases to the DTA and review them at least every 12 months. Appendix B adopts the OECD definition of an AI system and defines AI use case and AI incident.
🧩 What’s Covered
The parts of the policy, in the order presented.
- Policy introduction and aims: frames government AI adoption and sets three aims — embrace the opportunity, strengthen public trust, adapt to change — and states the intent to complement and strengthen, not duplicate, existing APS frameworks.
- Implementation: application to non-corporate Commonwealth entities, the defence and national intelligence community carveouts with the named NIC agencies, how the policy sits alongside existing frameworks and laws, definitions, implementation timeframes, and what counts as an in-scope AI use case.
- Strategy and oversight: principles on accountability and transparency, plus mandatory requirements for an AI transparency statement, a strategic position on AI adoption within 6 months, accountable officials, accountable use case owners within 12 months, and an internal AI use case register shared with the DTA every 6 months.
- Preparedness and operations: requirements to operationalise responsible AI within 12 months — processes for adopting use cases, informing staff about Australia's AI Ethics Principles, internal and public pathways to report AI safety concerns, and AI incident processes aligned to ICT incident management — plus mandatory staff training, and the recommended AI technical standard and AI procurement guidance.
- AI use case impact assessment: assessment of new use cases against the Appendix C criteria from the design phase, finalised impact assessments before deployment, the option of an internal process delivering the same or higher risk outcome, register updates, ongoing monitoring and re-validation, and differentiated treatment of medium-risk and high-risk use cases, including DTA reporting and 12-monthly reviews.
- Appendix A: a non-exhaustive list of related frameworks covering artificial intelligence, automated decision-making, and data and digital.
- Appendix B: the OECD definition of an AI system, the definition of an AI use case with two options for general-purpose AI solutions such as Microsoft Copilot, and an AI incident definition adapted from the OECD's draft definition.
- Appendix C: the five in-scope criteria, seven areas warranting careful consideration from recruitment to critical infrastructure, and the carve-out for early-stage experimentation.
💡 Why it matters?
For agencies inside its scope, the policy converts general responsible-AI commitments into dated obligations: a published transparency statement, a named accountable official and use case owners, a use case register shared with the DTA every 6 months, and an impact assessment completed before deployment. Risk, assurance and audit functions gain a defined escalation path, because inherent high-risk use cases must be reported to the accountable official and later to the DTA, governed by a board or senior executive, and reviewed at least every 12 months. The Appendix C criteria give teams a workable test for whether a use case is caught, and the experimentation carve-out tells them when it is not.
❓ What’s Missing
The document does not reproduce the instruments it relies on. The Standard for transparency statements, the Standard for accountability, the AI technical standard, the AI procurement guidance, the AI fundamentals training module and the Australian Government AI impact assessment tool are all named but not included, so minimum register fields, risk-rating scales and assessment templates must be obtained elsewhere. Timeframes are stated without consequences for non-compliance. The AI incident definition is described as adapted from the OECD's draft definition, and the policy notes that the definition is still being considered globally, leaving a moving reference point.
👥 Best For
Australian Government agency leaders, accountable officials and accountable use case owners who must implement the policy; governance, risk and assurance staff building use case registers and impact assessment processes; and legal, privacy and procurement teams that need the in-scope criteria and the deadlines for DTA notifications, training and high-risk use case reviews.
📄 Source Details
Policy for the responsible use of AI in government, Version 2.0, published by the Digital Transformation Agency, Commonwealth of Australia. No individual authors are named. The policy is effective 15 December 2025 and replaces v1.1, which came into effect 1 September 2024; the imprint carries the notice "© Commonwealth of Australia (Digital Transformation Agency) 2025". The document runs 22 pages with three appendices, and gives the contact address ai@dta.gov.au. No URL for the document itself is printed. The full text of all 22 pages was available.
