---
title: "Guidance for AI adoption"
url: "https://ailawframework.com/frameworks/guidance-for-ai-adoption"
type: "framework_note"
site: "AI Law Framework"
issuer: "National AI Centre (Australian Government)"
status: "Voluntary guidance. It is published by the Australian Government’s National AI Centre, it is not legislation, and it does not make any practice a condition of practising law."
checked: "2026-11-01"
---

# Guidance for AI adoption

> Six essential practices for safe and responsible AI governance, in a foundations version and an implementation version. Voluntary.

Canonical page: https://ailawframework.com/frameworks/guidance-for-ai-adoption  
Checked: 2026-11-01

Site index for agents: https://ailawframework.com/llms.txt

Voluntary guidance. It is published by the Australian Government’s National AI Centre, it is not legislation, and it does not make any practice a condition of practising law.

Six essential practices for safe and responsible AI governance, in a foundations version and an implementation version. Voluntary.

This is a reading aid for an Australian law firm. It is not legal advice, not a certification, and not a finding that a tool or a firm complies. The sentences paraphrase the sources listed, checked on the date shown. Where a standard is sold by ISO or the AICPA, the page uses the publisher’s public description and does not reproduce the standard.

## What it is

The National AI Centre publishes the essential AI practices on ai.gov.au. The page says they are the Australian Government’s guidance for responsible AI use, and that they help organisations put governance, oversight and transparency in place. The Department of Industry, Science and Resources says it published Guidance for AI Adoption on 21 October 2025 and that it evolves the Voluntary AI Safety Standard, which this site describes separately.

There are two versions of the same six practices. The foundations version is for organisations that are early in planning or trialling AI, and gives “getting started” and “next steps” for each practice. The implementation version is for teams that build or customise AI systems, use AI in more complex ways, or manage higher-risk uses, and numbers its actions (1.1.1, 1.1.2 and so on). Some of its actions are marked for developers only. The pages list both as PDF downloads that show a publication date of 5 May 2026.

The implementation version says some practices apply across the whole organisation, such as governance frameworks, clear roles, AI registers and supply chain accountability, and others apply to individual systems and uses. It says the same tool can carry very different risks depending on how it is used, and that each use should be reviewed on its own.

## Who it applies to

The pages say the guidance is for organisations that use or develop AI. It is voluntary. Neither version says a law firm must follow it, and neither is a conduct rule. A firm that buys and uses AI tools is a deployer, and the practices that bear most directly on a deployer are the register, disclosure, testing, oversight and supplier-accountability actions. Nothing on the pages makes the practices a condition of practising law.

## What it asks of a law firm using AI

- Practice 1, Decide who is accountable. The foundations version suggests a senior AI governance owner and an AI policy, then a named person for every AI system, training for those people, clear supply chain accountabilities, and a governance framework. The implementation version adds accountable people, supply chain accountabilities, AI literacy and training, and an AI governance framework.
- Practice 2, Understand impacts and plan accordingly. Foundations suggests a stakeholder impact assessment and contestability channels for people who want to report a problem or challenge a decision. The implementation version covers identifying and engaging stakeholders, feedback and redress processes, and monitoring for systemic issues.
- Practice 3, Measure and manage risks. Foundations suggests a risk screening process, then risk management that accounts for the differences between traditional IT, narrow AI, general purpose AI and agentic AI, risk assessments for each use case, controls matched to risk, and an incident process. The implementation version covers a risk management framework, assessing risks, controls, and monitoring and reporting incidents, including notifiable data breaches.
- Practice 4, Share essential information. Foundations suggests an AI register that covers every AI system, including AI embedded in other tools, and a habit of disclosing AI use, especially where AI makes or influences decisions, generates content that can meaningfully affect people, or can be mistaken for a human. Next steps are documenting capabilities and limitations, transparency across the supply chain, and explaining outcomes in proportion to their seriousness.
- Practice 5, Test and monitor. Foundations suggests asking a supplier for proof of testing, testing before deployment, monitoring after deployment in proportion to risk, and extending data governance and cybersecurity practice to AI systems. Next steps are stress-testing and, for uses that need extra governance attention, independent testing.
- Practice 6, Maintain human control. Foundations suggests meaningful human oversight matched to the system’s autonomy and the stakes, and points where a person can pause, override, roll back or shut the system down. Next steps are training for the people who oversee AI and keeping alternative pathways so critical functions continue if the AI fails or is retired.

## How it maps to this framework

| This site’s question | What the instrument says that bears on it |
| --- | --- |
| Efficiency: Whether the tool saves total human work at the quality the task needs. | Not set here. |
| Effectiveness: Whether the output is good enough for the task. The catalogue does not score this. | Practice 5 is testing before deployment and monitoring afterwards. That is about whether a system keeps behaving as intended. It does not replace a lawyer reading and checking the output against the task. |
| Due diligence: What the firm has actually read about hosting, training and assurance before it relies on the tool. | Practices 1, 3, 4 and 5 give a firm questions to put to itself and to a vendor: who is accountable, what the risk assessment found, what the register records, and what proof of testing exists. They are a prompt for the firm’s own record. They are not a finding that a tool is safe to use. |
| Confidentiality: Whether client and other confidential information can go into the tool. | Practice 5 asks organisations to extend data governance and cybersecurity practice to AI systems, including models that learned from sensitive data. The pages do not restate a solicitor’s duty of confidentiality and do not authorise a particular upload. The National AI Centre’s own video on the essential practices page says AI used in legal practice must not breach client privilege and confidentiality rules. |
| Disclosure: When the firm tells the client, and where required the court or another party, that AI was used. | Practice 4 asks organisations to tell people when they are dealing with AI and when AI affects them. A separate National AI Centre page, “Be clear about AI-generated content”, covers when and how to disclose. None of this is a court practice note or a direction that every client letter must name the tool. |
| Certifications: ISO, SOC 2 and IRAP names recorded against the tool. A listed name is not a finding that the certificate covers the firm’s plan. | The pages do not say that a certificate such as ISO/IEC 42001 satisfies the practices, and they do not require one. A certificate can be one record of governance. It is not the practice. |
| Data residency: Where the tool holds data, including whether that place is recorded as Australia. | Not set here. |

## Sources

- [Essential AI practices (National AI Centre)](https://www.ai.gov.au/staying-safe-and-responsible/essential-ai-practices)
- [Guidance for AI adoption: foundations](https://www.ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-foundations)
- [Guidance for AI adoption: implementation guidance](https://www.ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-implementation-guidance)
- [Voluntary AI Safety Standard: the 10 guardrails (date of the 2025 guidance)](https://www.industry.gov.au/publications/voluntary-ai-safety-standard/10-guardrails)

## Related pages

- [Voluntary AI Safety Standard](https://ailawframework.com/frameworks/voluntary-ai-safety-standard.md)
- [Policy for the responsible use of AI in government](https://ailawframework.com/frameworks/responsible-use-of-ai-in-government.md)
- [ISO/IEC 42001](https://ailawframework.com/frameworks/iso-iec-42001.md)
- [NIST AI Risk Management Framework and the Generative AI Profile](https://ailawframework.com/frameworks/nist-ai-rmf.md)