Policy for the responsible use of AI in government (v2.0)

What it is

The Policy for the responsible use of AI in government is the Digital Transformation Agency’s (DTA) whole-of-government policy on how Australian Government agencies adopt and govern AI. Version 2.0 took effect on 15 December 2025 and replaced version 1.1, which had applied since 1 September 2024.

Version 2.0 adds new requirements. Agencies must set a strategic approach to AI, operationalise responsible AI use, designate accountability for each AI use case and take risk-based actions at the use case level, including an impact assessment. The policy is organised into three sections, strategy and oversight, preparedness and operations, and AI use case impact assessment, each with principles and mandatory requirements.

Who it applies to

All non-corporate Commonwealth entities, as defined by the Public Governance, Performance and Accountability Act 2013, must apply the policy. Corporate Commonwealth entities are encouraged to. It does not apply to the defence portfolio or the national intelligence community, which may adopt parts of it voluntarily.

For the policy, AI takes the OECD definition, and an AI use case is “a specific application of an AI system or systems to achieve certain objectives or perform certain tasks”. General-purpose tools such as Copilot can be treated as one complex use case at the highest risk level, or as separate use cases, each with its own owner and register entry.

What it requires

Strategy and oversight

• Publish an AI transparency statement under the DTA’s standard, review it at least annually and notify the DTA of changes.
• Develop and communicate a strategic position on AI adoption within six months.
• Designate accountable officials under the Standard for accountability and notify the DTA.
• Designate an accountable use case owner for each in-scope use case within 12 months.
• Create an internal register of in-scope use cases within 12 months, with the minimum fields the Standard for accountability lists, and share it with the DTA every six months.

Preparedness and operations

• Within 12 months, establish an approach to embed responsible AI. At minimum it covers a process for adopting use cases, a way to inform staff about Australia’s AI Ethics Principles, pathways for staff and the public to report AI safety concerns and a process for AI incidents aligned to ICT incident management.
• Within 12 months, implement mandatory training on responsible AI for all staff. The DTA’s AI fundamentals module can be used.
• Applying the AI technical standard and the AI procurement guidance is strongly recommended.

AI use case impact assessment

• Assess every new use case against the in-scope criteria in Appendix C during design, with use case assessments starting within 12 months.
• For in-scope use cases, start an impact assessment at design and finalise it, with agreed risk treatments, before deployment. Agencies use the DTA’s AI impact assessment tool or an internal process that integrates all its provisions.
• Add each in-scope use case to the internal register, then monitor it and revalidate the assessment when scope, usage or operation changes materially, including changes a vendor makes.
• For an inherent medium risk, consider governance by a designated board or senior executive.
• For an inherent high risk, report to the accountable official, govern through a board or senior executive, report to the DTA once deployment is decided and review the use case at least every 12 months.

A use case is in scope if any of these apply. Its use, misuse or failure could cause more than insignificant harm. It will materially influence administrative decisions. The public may interact with it, or be significantly affected by its outputs, without human review. It uses personal, sensitive or security classified data. Or the DTA has directed that it is elevated risk.

The impact assessment tool

The DTA’s AI impact assessment tool runs in 12 sections. It covers basic information, purpose and expected benefits, an inherent risk assessment and a threshold outcome. Then come sections on fairness, reliability and safety, privacy protection and security, transparency and explainability, contestability, human-centred values and accountability, ending with use case review and next steps. The tool rates inherent and residual risk, and its appendix gives risk rating guidance.

Key dates

Version 2.0 took effect on 15 December 2025. The strategic position was due by 15 June 2026. The 12-month requirements fall due on 15 December 2026. Existing use cases that have not been assessed must be scoped, with all relevant actions applied, by 30 April 2027. The DTA encourages agencies to meet each requirement earlier where they can.

How it relates to other frameworks

The policy is built on Australia’s AI Ethics Principles, and seven of the impact assessment tool’s sections are named after them. It sits within the national framework for the assurance of AI in government, which every Australian government has agreed. Agencies meet it alongside the Privacy Act ADM transparency rules, which apply to them from 10 December 2026. For organisations outside the Commonwealth, the Guidance for AI Adoption covers similar ground on a voluntary basis. State agencies follow their own frameworks, such as the NSW AI Assessment Framework.

Working with it in Aicura

The DTA framework is available in Aicura from the Essentials tier. An administrator enables it in Settings under Frameworks and chooses which governance policy reviews apply it under Reviews.

The AI Register can serve as the internal use case register. Each entry carries a Designated Owner, Executive Accountability and a Technical Contact, with ownership history, its stage (proposed, in development, testing or live) and the facts the in-scope criteria turn on, such as whether it processes personal information, whether it affects individuals and the level of human oversight. Registering an entry starts a risk assessment that draws on the DTA framework, and a material change runs it again. Governance policy reviews return recommendations on policies such as your AI Acceptable Use Policy and AI Incident Response Plan.

At the Pro tier, impact assessments are structured by the sections of the DTA’s AI impact assessment tool, and Training tracks who has completed which course. Whether an internal process integrates every provision of the DTA tool is the agency’s call to make and document. Aicura provides guidance and keeps dated, sealed snapshots of the work. It does not decide that an agency meets the policy.