GuidanceforAIAdoption:Foundations

SixessentialpracticesforresponsibleAIgovernancev1.0,October2025

|.au/NAIC

GuidanceforAIAdoption:Foundations

|.au/NAIC2

TheGuidanceforAIAdoptionsetsout6essentialpracticesforresponsibleAIgovernanceandadoption.

Webasedthisguidanceonnationalandinternationalethicsprinciples.ItisthefirstupdatetoAustralia’sVoluntaryAISafetyStandard(VAISS),launchedin2024.Inthisupdate,publishedinOctober2025,wehave:

?condensed10guardrailsinto6essentialpractices

?removedredundantlanguage

?expandedouraudiencetodevelopersaswellasdeployers.

Thereare2versionsoftheguidance.Thisversion,Foundations,outlinestheessentialpracticeseveryorganisationneedsforgoodAIgovernance.Foundationsisfor

businessesandorganisationsintheearlystagesofadoptingAI.Whenyou'rereadyfordetailedstep-by-stepinstructiononhowtoimplementthesepractices,refertothe

otherversionoftheguidance,

Implementationpractices

.

GuidanceforAIAdoption:Foundations

|.au/NAIC3

Introduction

Artificialintelligence(AI)bringsenormousopportunityand

potentialtoAustralianbusiness.It’salreadyreshapingthe

wayorganisationsoperate–andifithasn’tyetreachedyours,it’slikelytouchingothersinyoursector.

InAustralia,manyorganisationsaremovingaheadwiththeirAIplans.

SoftwareengineersareusingAItohelpthemwritecode.Teamleadersareboostingemployeeengagementandspeedingupcustomerinteractions.Businessesare

automatingdataentryand,insomecases,usingAItoolsintheirboardrooms.

HelpingallorganisationsembraceAI

ForthosewhogetAIrightearly,advantagesabound.AItools,systemsandagentscandeliveracompetitiveedgeacrosseverythingfrommarketingandprocurementto

stakeholderengagementandcustomerservice.LargeroperatorsmaybemovingfasteronAIadoption,butsmallerorganisationscanshareinitsbenefitstoo.

Buttherearesomepracticalconsiderations.Organisationsarekeentousesystemstheyandtheirendusersknowandtrust,andwithgoodreason.Oncetrustisbroken,whetherwithcustomers,stakeholdersorthepublic,itisdifficulttoregain.

That’swhyAIsystemsneedtobeimplementedwithresponsiblepractices.

IfyouareusingAIinyourorganisation,youneedtoputsomeessentialgovernancepracticesinplace.Thiswillhelpyousafelyharnessthemovementthatisreshapingindustriesandorganisations.

Byfollowingthisguidance,yourorganisationcouldimprovecustomerengagement,strengthenemployeetrust,reimagineproducts,andincreaseproductivity.

Settingupforsuccess:gettingAIgovernanceright

GoodAIgovernanceisawayfororganisationstoadoptAIwithconfidence.Itputsinplacethesystems,processesandtoolstoidentifyandmanagerisks,whiletakingadvantageofAI’supsides.

ResponsibleAIpracticesbuildinstrategicoversight,robustframeworksandtransparent,explainablesystems.

Ifyou’restartingsmall,responsibleAIpracticeswillbesimpletoimplement.

Theycan–andshould–growasyouruseofAIsystemsmatures.

GuidanceforAIAdoption:Foundations

|.au/NAIC4

Howtousetheguidance

StartwhereyouareandbuildconfidenceasyourAIusematures.

Youdon’tneedtoimplementeverythingatonce.GetstartedacrossallsixessentialpracticestoestablishbasicresponsibleAIgovernance.Addmoreactionsasyourorganisation’sAIusegrowsoryourgovernancecapabilitiesmature.

Thesixpracticesaredesignedforflexibility.Adopttheminwaysthatfityourorganisation’sspecificcontext,constraintsandusecases.

Importantconsiderations

Asyoureadandadoptthesixpractices,rememberthatAIgovernancehappensat

2levels.

?Somepracticesapplytoyourwholeorganisation(likehavinganAIpolicy).

?SomepracticesapplytoeachspecificAIsysteminthecontextthatyouuseit(likeperformingtests).

ThesameAIsystemcanpresentdifferentrisksdependingonhowyouuseit.

Forexample,usingChatGPTtodraftmarketingemailsisdifferentfromusingittoassessjobapplications.Eachusecaseneedsitsowngovernancechecks.

WhenanAIsystemcouldbeusedinmultipleways,considerallpossibleusecases,includingwaysitmightbemisused.

Rememberthatdocumentationiskey.Youshoulddocumenteveryactivityinthese

essentialpracticesthatyoucarryout.Thiswillletyouauditandreviewyourgovernancewhenyouneedto.GooddocumentationalsohelpsyourorganisationlearnandimproveitsAIgovernanceovertime.

Thepracticesinthisdocumentarewrittenfororganisationalleadersandgovernancepeople–theyidentifytheessentialpracticesyouneedtoensurehappenacrossyourorganisationandsupplychain.

Thisguidancedoesnotreplaceyourotheressentialgovernanceframeworkssuchasthosefordata,privacy,andcybersecurity.TheseframeworksshouldalreadybeinplaceandreviewedandupdatedforyouruseofAIsystems.The6practicesfocusongovernancemattersspecifictoAIanditsuniquecharacteristics.

Forclarificationonspecifictermsusedinthisdocument,youcanrefertothe

terms

anddefinitions

.

GuidanceforAIAdoption:Foundations

|.au/NAIC5

Essentialpractices

1.Decidewhoisaccountable

AIsystemscanmakeautomateddecisionsthatsignificantlyimpactpeople,

communitiesandbusinesses.Overall,yourorganisationisultimatelyaccountableforhowandwhereAIisused,AIcomplexitycancreategapswherenoonetakesclear

responsibilityforoutcomes.

AccountabilityisthefirststeptousingAIresponsibly.

Gettingstarted

1.1AssignaseniorleaderastheoverallAIgovernanceowner.TheyshouldhaveenoughauthorityandunderstandingofAIcapabilitiesandriskstooverseeallAIuseinyourorganisation.

1.2CreateanAIpolicythatsetsouthowyourorganisationwilluseAIresponsibly.

EnsurethatthepolicyprovidesadvicetoyourstaffonAIrisksandhowtomanagethem.Takealookatour

AIpolicytemplate

togetstarted.

Nextsteps

1.3MakeaspecificpersonaccountableforeveryAIsystemyourorganisationuses.Makesuretheaccountablepeoplearefamiliarwiththetechnologyand

understanditsbusinessimplications.

1.4TrainyouraccountablepeoplesotheycanmakeinformeddecisionsaboutAI’srisksandbehaviours.

1.5Clarifysupplychainaccountabilities.WhenAIsystemsinvolvemultipleparties(vendors,developers,integratorsetc),makeitclearwhoisresponsibleforeachpartoftheAIsupplychain.Thiswillletyouknowwhototalktoifsomethinginthesystemgoeswrong.

1.6TurnyourAIpolicyintoagovernanceframework.Acomprehensiveframeworkwithclearpoliciesandprocedurescanhelpyourorganisationaddress

AI-specificchallenges.

Forfurtherguidance,read

Implementationpractice1.

GuidanceforAIAdoption:Foundations

|.au/NAIC6

2.Understandimpactsandplanaccordingly

BecauseAIsystemscanoperateatspeedandscale,theirpotentialimpactsareoftenmagnified.Withoutcarefulplanning,asingleAIsystemcanleadtowidespreadnegativeoutcomes,suchasunfairdecisionsortheprovisionofinaccurateinformation.

Forexample,AIsystemscanlearnfromandamplifyexistingissuessuchasunwanted

biasindata.Thiscanleadtounfairdecisionsorinappropriategeneratedcontentthat

couldaffectmanypeople.IfanAIsystemusedforshortlistinginhiringhasabias

problem,itcouldunfairlyrejecthundredsofqualifiedcandidatesbeforeanyonenotices.

TouseAIresponsibly,organisationsneedtounderstand,planforandmonitorpotentialimpactsofAIsystems.Thoseaffectedshouldbeabletoraisecomplaintsandgethelp.

Gettingstarted

2.1Carryoutastakeholderimpactassessment.IdentifythegroupsandtypesofpeopleyourAIsystemsmayaffect.Payparticularattentiontovulnerableor

marginalisedcohorts.Assessallpotentialimpacts,suchasunfairdecisions,providinginaccurateorharmfulinformation,encouragingoverreliance,etc.

2.2Createcontestabilitychannels.Setupchannelsforpeopletoreportproblems,challengeorquestionAIdecisions.Thestrengthofthosechannelsshouldmatchhowserioustheimpactis.MakesureyoucantakeactiontosetthingsrightifyourAIsystemhasnegativelyaffectedsomeone.

Nextsteps

2.3Engageyourstakeholdersearlyandcontinueengagingthemthroughout

theAIlifecycle,especiallyyourstaffandcustomers.Understandtheirneeds,

concernsandhowtheymightbeaffected.Usethisknowledgetoinformhowyoudesign,testanddeployyoursystems.

2.4Identifysystemicunwantedimpactsbymonitoringpatternsoffeedback.

Usethisinformationtoproactivelyfixsystemicissuesinyoursystems.

Forfurtherguidance,read

Implementationpractice2.

GuidanceforAIAdoption:Foundations

|.au/NAIC7

3.Measureandmanagerisks

AIrisksfundamentallychangedependingonthetypeandcomplexityofyourAI

systems.RisksoftenemergefromhowtheAIsystembehavesindifferentsituationsanduse-cases,ratherthanonlyfromsoftwareupdates.Theycanrapidlyamplifysmaller

issuesintosignificantproblems.

Forexample,anAIchatbotthatanswerssimplequestionsduringbusinesshours,

whenitcanbemonitoredbyastaffmember,isalow-riskuseofAI.Therisksexpand,however,ifthatchatbotoperates24/7,withouthumanoversight,andanswersmorecomplexquestions.

TouseAIresponsibly,organisationsneedtobeabletoidentifyandmanageitsrisks.

Gettingstarted

3.1CreateariskscreeningprocesstoidentifyandflagAIsystemsandusecasesthatposeunacceptableriskorrequireadditionalgovernanceattention.Seeour

AIscreeningtool

forhelpwiththisprocess.

Nextsteps

3.2SetupriskmanagementprocessesthataccountforthedifferencesbetweentraditionalIT,narrowAI,generalpurposeAIandagenticAIsystems.

3.3Conductriskassessmentsandcreatemitigationplansforeachspecificusecaseandidentifiedimpactsinthatcontext.

3.4ApplyriskcontrolsbasedonthelevelofriskforeachofyourspecificusesofAI.

3.5Createprocessestoinvestigate,documentandanalyseAI-relatedincidents.MakesureyouuselessonslearnedtopreventincidentshappeningagainandtoimproveAIsystemsandriskmanagementprocesses.

Forfurtherguidance,read

Implementationpractice3.

GuidanceforAIAdoption:Foundations

|.au/NAIC8

4.Shareessentialinformation

TouseAIresponsibly,organisationsneedtotellusersandstakeholderswhenandhowthey’reinteractingwithAI.

Peopleshouldknowwhenthey’reinteractingwithAIandunderstandwhenAIdecisionsaffectthem.Forexample,whenacustomerisreceivingservicesandinformationfromachatbot,theyshouldknowthisisnotahumanspecialist.

Gettingstarted

4.1CreateandmaintainanAIregister.ThisshoulddocumentallyourAIsystems,

howyouusethem,andanyotherimportantinformationaboutthem.

YourdocumentationshouldincludeanyAIsystem,whetheryoudevelopeditinternallyorprocureditfromelsewhere.ItshouldalsocoverAIthatmightbeembeddedinothersystems,likehumanresourcesandcustomerengagementtools.Seeour

AIregistertemplate

forhelpwiththisprocess.

4.2DiscloseyouruseofAI.MakeitstandardpracticeinyourorganisationtoclearlycommunicateyouruseofAItoyourstakeholders.ThisisespeciallyimportantinsituationswhereAImakesorinfluencesdecisions,generatescontentthatcanmeaningfullyimpactpeople,orcanbemistakenforahumanbeing.

Nextsteps

4.3Identify,documentandcommunicateAIsystemcapabilitiesandlimitations.ExplainingthesecapabilitiesandlimitationstorelevantstakeholderscanpreventtheiroverrelianceonormisuseofAI.

4.4BetransparentacrossyourAIsupplychain.Thiswillletanyonewhointeractswiththesystemunderstandwhatcomponentstheyareusing,theircapabilitiesandlimitations,andkeycharacteristicsliketrainingdatasources.

4.5SetupwaystoexplainAIoutcomes,especiallywhentheyaffectpeople.

Thedetailinyourexplanationshouldmatchhowserioustheoutcomeis,anditshouldbeeasyforpeoplewhoareaffectedtounderstand.

Forfurtherguidance,read

Implementationpractice4.

GuidanceforAIAdoption:Foundations

|.au/NAIC9

5.Testandmonitor

AIsystemscanchangetheirbehaviourovertimeoractinwaysthatarelesspredictablethanconventionalsoftware.Forexample,anAIsystemthatworkedwelllastmonth

mightstartgivingdifferentanswerstodayifitistrainedonadditionaldata.

TouseAIsafely,organisationsshouldtestandmonitortheirAIsystems.

Gettingstarted

5.1Askforproof.Ifyou’rebuyinganAIsystem,askthedeveloperorsuppliertoshowproofthatit’sbeenproperlytested.

5.2Testbeforeyoudeployasystem.ConsiderhowyouwanttouseyourAIsystem.Decidehowyoumighttestthesystemtoensureitisperforminghowyouwantitto,andconductthem.

5.3Monitoryoursystemafteryoudeployit.Setupamonitoringprocessthathelpsyoudetectchangesinperformanceandbehaviour.Matchyourmonitoring

approachtotherisklevelsidentifiedinyourriskassessment.Watchfornewrisksthatwerenotpresentwhenyoufirstdeployedthesystem.

5.4ExtendyourdatagovernanceandcybersecuritypracticestoyourAIsystems.

StrengthenthesepracticestoaddressAI-specificneeds,likeprotectingAImodelsthatlearnedfromsensitivedata.

Nextsteps

5.5Stress-testyourAIsystemtospotissuesorvulnerabilitiesbeforeothersdo.

Makesuresafety,securityandpolicycontrolsaresound,evenwhensomeonedeliberatelytriestobreakorbypassthem.

5.6Considergettingindependenttesting.IfyourAIusecasewasidentifiedneedingadditionalgovernanceattention,considergettingathirdpartytotestyourAI

systems.Thistestingshouldhappenbeforeyoudeploythesystem,aftersignificantchangesandonaregularbasis.

Forfurtherguidance,read

Implementationpractice5.

GuidanceforAIAdoption:Fou