Queensland AI governance policy and FAIRA

What it is

The Queensland Government’s Artificial Intelligence governance policy is part of the Queensland Government Enterprise Architecture (QGEA). It makes sure agency planning for AI follows a structured, consistent approach to evaluating AI for transparency, accountability and risk. Version 2.0.0 is mandated and took effect in August 2026, replacing the first version.

The policy’s main assessment instrument is the Foundational AI Risk Assessment, or FAIRA, explained in a companion QGEA guideline, also at version 2.0.0 from August 2026. The FAIRA is described as a transparency, accountability and risk identification tool. It is “foundational” because it describes an AI solution in terms of its technical, system, business, values and governance components as a basis for action in existing risk and compliance processes.

Who it applies to

All Queensland Government departments as defined by the Public Sector Act 2022. It also applies to accountable officers and statutory bodies under the Financial and Performance Management Standard 2019, in the context of internal controls, financial information management systems and risk management. It covers all services agencies deliver.

What it requires

The policy sets two requirements.

1. Establish AI governance with regard to ISO/IEC 38507. Agencies must set AI governance arrangements with regard to the current version of ISO/IEC 38507, the standard on the governance implications of AI for organisations. AI governance should be consistent with existing structures such as ICT governance, risk governance or information security management.
2. Align to Australia’s AI Ethics Principles by applying the FAIRA. When evaluating AI solutions, agencies must prepare a FAIRA, or an agreed equivalent, as evidence of a structured risk assessment across the lifecycle. A FAIRA LITE can be prepared for low-risk use cases, including proofs of concept, trials or exploratory activities.

Reporting follows the QGEA ICT profiling standard.

How the FAIRA works

The FAIRA framework has three parts.

• Part A, AI component analysis. Describes the solution’s components and their associated impacts.
• Part B, values assessment. Assesses the solution’s impact on values, the step through which the policy asks agencies to align with Australia’s AI Ethics Principles.
• Part C, common controls. A list of controls that responsible officers can use to identify actions that reduce the risks found.

Agencies apply a FAIRA or FAIRA LITE when an IT solution meets the definition of AI. That means it meets the OECD definition used in the national framework, is classified as AI under ISO/IEC 22989 or the QGEA technology classification, or is described or perceived as using AI. A FAIRA is prepared or updated whenever an AI system enters a new lifecycle phase. It should be reviewed when a risk is realised, when the likelihood or consequence of a risk changes, when new risks are found or when organisational values or priorities change.

The guideline expects both periodic and trigger-based reviews. It suggests annual review of critical ICT systems, biannual reviews with continuous performance data for higher-risk systems and quarterly reviews of platform-based AI. Assessments should involve business, finance, security, continuity, legal and IT stakeholders, and the business owners of the systems at sign-off. The FAIRA complements agency risk frameworks, which are usually based on ISO 31000. It does not replace them.

FAIRA LITE for trials

FAIRA LITE lets agencies govern and manage the risk of a low-risk proof of concept, trial or exploration of an AI system, to inform a decision on whether to deploy it. The name describes the conditions. The use is Limited, Informed, Tested and Excludes high risk. If the trial leads to deployment, it informs the full FAIRA for the deployed system. Lack of agreement on whether a product contains AI should not stop an assessment. The guideline notes that products with ambiguous AI features can still be assessed for risks at the human-machine interface.

Key dates

Both the policy and the FAIRA guideline were reissued as version 2.0.0 in August 2026, with the policy last updated on 26 August 2026. The policy takes effect from its issue date.

How it relates to other frameworks

The FAIRA values assessment applies Australia’s AI Ethics Principles, and the policy points agencies to the national framework for the assurance of AI in government for further detail. For advice on AI management and terminology, it points to ISO/IEC 42001, ISO/IEC 22989 and the National AI Centre’s Guidance for AI Adoption, and the guideline points to the DTA’s AI technical standard. Other states use their own instruments, such as the NSW AI Assessment Framework and the WA AI Assurance Framework.