NSW AI Assessment Framework (AIAF)

What it is

The NSW AI Assessment Framework (AIAF) is a risk self-assessment that helps NSW government agencies design, develop, deploy, procure and use AI responsibly. It guides agencies through identifying, documenting and mitigating AI-specific risks. It also requires them to show how each project aligns with Australia’s AI Ethics Principles. NSW first mandated an AI assurance framework in 2022, which the national assurance framework describes as a world first.

The framework now sits inside a wider NSW structure set by Circular DCS-2026-02, issued on 30 July 2026 by the Secretary of the Department of Customer Service. That structure has four parts. The NSW AI Strategy sets direction. The NSW AI Operational Policy sets mandatory requirements. The AIAF is the step-by-step assessment. The AI Review Committee gives expert advice on higher-risk use cases. DCS-2026-02 replaced Circular DCS-2024-04, and the Operational Policy replaced the NSW AI Ethics Policy.

Who it applies to

All NSW government agencies, including departments, executive agencies, statutory bodies, state owned corporations and other entities the circular lists. It applies to every AI use case throughout its lifecycle, whether or not it is part of a formal project. Local councils and universities are not on the circular’s list, and the policy itself sets out which entities are covered.

The framework is designed for project and executive sponsors, technical leads and data governance leads.

What it requires

The NSW AI Operational Policy sets these mandatory agency requirements.

• Adhere to Australia’s AI Ethics Principles when using, designing, developing, deploying and implementing AI.
• Appoint an accountable official to oversee the policy and coordinate with NSW GovAI in Digital NSW.
• Establish governance and assurance of AI, using existing functions where possible.
• Register every AI use case on the AIAF Platform and keep the records accurate through the lifecycle.
• Apply the AIAF where registration says an assessment is required.
• Refer high and critical risk use cases to the AI Review Committee.
• Align agency ICT acceptable use policies with the policy.
• Make AI literacy and policy training available to staff who use AI.

How the assessment works

The process on the AIAF Platform has four steps.

1. Register the use case. Provide the agency, the responsible officer and the use case details, so the use of AI is visible and traceable.
2. Complete an assessment where required. The registration answers decide whether a full AIAF assessment is needed. If it is, the platform uses the answers to set an overall risk level and identify mandatory assurance activities, which may include privacy, human rights or cyber security review.
3. Address the focus areas. Respond to the additional questions and controls the platform presents for the risks identified.
4. Record decisions and keep the assessment current. Complete the governance actions, keep supporting evidence in agency records and reassess when the use case changes materially.

Agencies must reassess from inception to retirement, and whenever a change to risk, context or functionality could affect outcomes or oversight. Periodic reviews are set by the potential for harm the AIAF identifies.

Risk levels and review

Digital NSW refers to medium, high and critical risk. Use cases assessed as high or critical must be referred to the NSW AI Review Committee, through the AI Secretariat, within five business days of completing the AIAF. NSW GovAI may also refer medium risk use cases where higher-risk characteristics are present. The committee draws on academia, industry and NSW government experts and gives recommendations to strengthen risk management. It advises rather than approves.

Projects with a budget above A$5 million, or funded through the Digital Restart Fund, receive additional central oversight through the NSW Digital Assurance Framework to confirm AIAF compliance.

Key dates

Circular DCS-2024-04 was issued on 1 July 2024. It was replaced by DCS-2026-02, issued on 30 July 2026 and updated on 1 September 2026. The AIAF Platform became mandatory on 30 September 2026, and from that date the Excel-based assessment is used only where an agency has not yet moved to the platform. Agencies give NSW GovAI a signed attestation for the previous financial year by 31 October each year, with the first due by 31 October 2027.

How it relates to other frameworks

The AIAF puts Australia’s AI Ethics Principles into practice for NSW and is integrated into the NSW Digital Assurance Framework. The national framework for the assurance of AI in government cites it as an example of a self-assessment model. Commonwealth agencies follow the DTA policy instead, Queensland agencies the FAIRA and WA agencies the WA AI Assurance Framework. Private organisations outside government often borrow its structure, alongside the Guidance for AI Adoption.

Working with it in Aicura

The NSW AI Assessment Framework is available in Aicura from the Essentials tier. An administrator enables it in Settings under Frameworks and chooses which governance policy reviews apply it under Reviews.

Once enabled, each risk assessment suggests a draft AIAF risk level with its reasoning, alongside Aicura’s overall rating, rated risk items and suggested controls. The Risk Assessment report carries the AIAF level, narrative, risks and controls in one document. The AI Register records each use case with a named owner and the facts an assessment draws on, and a material change reruns the assessment. Governance policy reviews of your AI Risk Assessment Policy return recommendations against the framework.

For a NSW agency, the AIAF Platform remains the required record. Aicura provides guidance that helps prepare and keep the answers current. It does not submit to the platform or decide your risk level for NSW purposes.