How to complete a NSW AI Assessment Framework self-assessment

This guide is Australian. It is written for NSW Government agencies and the officers who work through the NSW AI Assessment Framework.

If your agency is running an AI system, or planning to, the AIAF is not optional. The question for most officers is not whether to assess. It is how to work through the assessment on the AIAF Platform and keep it current as the system changes. This guide sets out the steps as Digital NSW describes them.

What changed in 2026

Three changes reshaped how agencies work with the framework.

• A new operational policy. The NSW AI Operational Policy replaced the NSW AI Ethics Policy. It adopts Australia’s AI Ethics Principles and sets governance and assurance accountabilities and rules for acceptable AI use. Each agency must appoint an accountable official to oversee implementation.
• A new circular. Circular DCS-2026-02, issued on 30 July 2026, requires agencies to comply with the operational policy and to apply the AIAF when required. It replaced Circular DCS-2024-04, which made the AI Ethics Policy and the AIAF mandatory in 2024.
• A mandatory platform. From 30 September 2026, agencies must use the AIAF Platform for all new AI use case registrations and assessments. The Excel workbook agencies used before is no longer the standard route.

The AIAF itself remains a risk self-assessment. Its purpose is to make sure AI use cases adhere to the operational policy and Australia’s AI Ethics Principles, and to give agencies a process to identify, document and mitigate AI-specific risks.

Who it applies to

The AIAF applies to all NSW Government agencies, across all AI use cases throughout their lifecycle, whether they form part of a formal project or not. Agencies must use it when designing, developing, deploying, procuring or using systems that contain AI components. It is written for project and executive sponsors, technical leads and data governance leads.

The operational policy does not cover standard automation and analytics that follow predefined logic and do not generate predictions or recommendations used in decisions. Macros, scripts, deterministic rules-based processes and descriptive analytics sit outside it. The policy is not mandatory for local government, universities or third-party suppliers, though suppliers to agencies should expect to provide the information an agency needs to complete its assessment.

Step 1: Log on to the AIAF Platform

Officers access the platform once their agency is onboarded. If outstanding SectorLink onboarding prevents access, an offline pathway exists. You request an offline AIAF from NSW GovAI, which issues a numbered copy of the current controlled offline assessment. You return the completed assessment to NSW GovAI, which uploads it to the platform. The offline pathway is not a general alternative and cannot be used by preference.

Step 2: Register the use case

Register the use case early in its lifecycle, ideally at the idea or procurement stage rather than just before go-live. Registration captures the agency, the responsible officer and the use case details. Every AI use case must be registered, even where it turns out not to need a full assessment.

Before you start, gather what you will be asked. What the system does and for whom. Who supplies it and which models it runs on. What data it uses, including personal and sensitive information. What decisions it makes or informs, and who those decisions affect. How much human oversight it has. The answers come faster when they already sit in an agency AI register.

Step 3: Complete the assessment where required

The registration process determines whether an assessment is needed. Where it is, you complete it on the platform. Your answers determine the overall risk level and the mandatory assurance activities. Those activities may include a privacy review, a human rights review or a cyber security review, and they remain your agency’s work to complete.

Answer for the system as it will actually be used, not as the vendor describes it in general. A summarisation tool used on case files containing sensitive personal information carries a different risk from the same tool used on public reports.

Step 4: Address the focus areas

The focus areas present additional questions and controls for the risks the assessment identified. Work through them with the technical and data governance leads. Each control you adopt needs an owner and a status, and the risks belong in your agency’s risk register alongside everything else the agency manages.

Step 5: Refer high and critical risk use cases

AI systems assessed as high or critical risk must be submitted to the AI Secretariat, which coordinates review by the AI Review Committee, within five business days of completing the AIAF. You submit through the platform prompts or by email to the AI Secretariat. The committee advises on risk mitigation rather than approving the use case.

Separately, the AIAF is integrated into the NSW Digital Assurance Framework. Projects above that framework’s budget threshold, or funded through the Digital Restart Fund, receive additional central oversight to confirm AIAF compliance.

Step 6: Record decisions and reassess on change

Record the decisions made and retain the evidence under your agency’s records requirements. Then keep the assessment current. Digital NSW asks agencies to reassess when there are significant changes to a use case’s features, datasets, purpose or decision-making context.

In practice, the triggers are easy to miss. A vendor ships a new model version. A team starts using the tool on a new kind of record. A system that drafted letters starts sending them. Each is a change to log, and a reason to look again at the registration and the assessment.

Keeping the AIAF current is the standing job

As an agency’s AI use grows, the assessment becomes an ongoing job rather than a single filing. The platform holds the registrations and assessments. Inside the agency, someone still has to notice when a system changes, know which assessment it affects and make sure the reassessment happens. That depends on an internal record of each AI system, its owner and its current state, kept close to the people who run it.

Where Aicura fits

Aicura Essentials carries the NSW AIAF as one of its frameworks. The AI Register holds each AI system with its owners and versions every material change, and registering or changing a system starts its risk assessment, which carries an AIAF level alongside the risk items and suggested controls. The risks and controls it finds join the agency’s published list of AI risks and controls, each with an owner and a status. That gives your agency an internal record to prepare platform submissions from and to notice when a reassessment is due. Aicura is not the AIAF Platform and does not submit to it. It does not certify the agency, determine whether a system passes the AIAF, or stand in for the AI Secretariat or the AI Review Committee. Your responsible officer owns the assessment and the sign-off.

A note on this page

This guide explains how NSW Government agencies work through the NSW AI Assessment Framework. The authoritative sources are Digital NSW’s AI Assessment Framework page, the NSW AI Operational Policy and Circular DCS-2026-02. Where this page and the primary source differ, the primary source governs. This is general information, not legal advice.

---

This guide explains what the rules require and how to do the work. It is general information, not legal advice. How the obligations apply turns on your own circumstances, so read the primary source and take your own advice before you rely on it.

Aicura does not certify, audit or issue a compliance verdict, and it does not produce a score. That decision belongs to your organisation and its people.

Primary source: NSW AI Assessment Framework, Digital NSW