Making sense of the Australian AI governance landscape

Part one of a five-part series.

Australian AI governance is a maturing area. There is already a substantial body of standards, frameworks and guidelines published by Commonwealth, state and industry bodies, and more change is on the way. For organisations starting to think about AI governance, it can be hard to know where to begin.

This five-part series walks through the landscape. In this first part I want to give you a structure to hold in your head. Part two covers the foundations that apply to everyone: the eight Australian AI Ethics Principles, the National Framework for AI Assurance, and the five cornerstones it identifies. Part three steps down to the policies and guidelines that apply to your organisation specifically, based on the kind of organisation you are. Part four shifts focus to the framework and operating model you actually build. Part five brings the series together: what good looks like, where to start, and what holds up when someone asks.

Once you have the structure, the rest of the landscape becomes navigable.

The picture

The whole Australian AI governance landscape fits on one page. Each layer in the diagram does a different job, and the rest of this post walks through them.

The foundation

At the top of the diagram are two foundational items that apply to every Australian organisation using AI, regardless of size, sector or jurisdiction.

Australia’s AI Ethics Principles were published in 2019 by the Department of Industry, Science and Resources. The eight principles cover wellbeing, human-centred values, fairness, privacy, reliability, transparency, contestability and accountability. They have not changed since publication.

These principles are visionary rather than directly implementable. They are the touchstone for your policy statements, board papers and external communications about AI use. You will not implement them directly because they are too abstract for that. Their job is to set the direction and provide a common reference point. Every framework underneath them maps back to these principles, so when you work to any of the operational instruments, you are also satisfying the principles.

The National Framework for AI Assurance was agreed by all Australian states and territories at the Data and Digital Ministers Meeting in June 2024. It takes the principles and translates them into practical mechanisms by introducing five cornerstones:

• AI governance
• Data governance
• Standards
• Procurement
• Risk-based approach

These cornerstones are the structural mechanisms that need to be in place for AI use to be properly governed. The Framework’s own position is that AI governance is one of five cornerstones, not the whole picture. The other four are equally important.

This series focuses initially on AI governance, because that is where most organisations are putting their attention. As the series progresses you will see why the other cornerstones matter and why an AI governance regime that ignores them will not deliver what it should. Part three returns to this in detail.

For now the key point is that the principles and the cornerstones apply to every Australian organisation that uses AI. They are the common ground.

Where you sit

The next two layers of the diagram help you work out where your organisation sits. Two questions get you there.

Who are you? This picks your primary operating instrument. There are three options.

If you are a Commonwealth government agency, you work to the DTA Policy for Responsible Use of AI in Government, along with its supporting tools including the AI Impact Assessment Tool and the AI Procurement Model Clauses.

If you are a state or territory government agency, you work to your jurisdiction’s instruments. NSW is the most developed, with the AI Ethics Policy and the AI Assessment Framework. Victoria, Queensland and others have their own instruments at varying levels of maturity.

If you are an industry or non-government organisation, there is no mandatory instrument that applies to you. You have latitude, and many organisations are developing their own internal AI policies and frameworks. If you want a recognised reference point to anchor that work, the National AI Centre’s Guidance for AI Adoption (often shortened to AI6) is the best choice. It is voluntary, but it is the most likely reference point if a regulator or auditor reviews your AI governance later.

What do you do? This picks the sector overlays that apply on top of your primary instrument. These attach based on your activities. Financial services brings APRA and ASIC obligations into scope. Healthcare and medical device applications bring the TGA. Recordkeeping for public sector organisations brings the relevant archives authority. Education brings the Australian Framework for Generative AI in Schools. Other sectors have their own overlays where the activity is in scope.

Overlays are additive. A bank using AI is governed by AI6 plus APRA plus relevant privacy obligations. A NSW Health agency is governed by the NSW instruments plus relevant overlays for health and records.

The supporting layers

Two further layers sit underneath the main structure.

Board oversight uses the Australian Institute of Company Directors framing for AI governance. This translates AI governance into the language and concerns of boards. It does not introduce new obligations, but it gives directors a structured way to understand and oversee AI use in the organisation.

Supporting reference frameworks include the disciplines that AI governance relies on. Data governance frameworks like DAMA and DCAM. AI-specific standards like ISO 42001 and NIST AI RMF. Cyber security frameworks like NIST CSF and ISO 27001. Your existing risk management frameworks. None of these are mandatory. As you work through the detail of your operating model, referencing recognised frameworks like these strengthens the work and gives you a defensible position if it is ever questioned.

What this means

By the end of this first part you should be able to place your organisation on the diagram.

The foundations at the top apply to you regardless of who you are. The Ethics Principles set your direction. The cornerstones tell you what needs to be in place underneath your AI governance to make it work.

The jurisdiction layer and sector overlays vary by organisation. Two questions get you to your specific stack.

The supporting layers are available as additional reinforcement when you choose to draw on them.

Part two takes the foundations at the top of the diagram and goes into them properly. The eight Australian AI Ethics Principles, the National Framework for AI Assurance that turns them into something operational, and the five cornerstones it identifies. The foundation that applies to every Australian organisation using AI, regardless of who you are or what you do.

If you want to talk through any of this, just get in touch.