Policy for the responsible use of AI in government
Version 2.0 binds non-corporate Commonwealth entities, with the exceptions in the policy. It does not bind a private law firm.
Version 2.0, from 15 December 2025, is mandatory for non-corporate Commonwealth entities, with exceptions in the policy. It does not bind a private law firm.
MaintainedLast reviewed
Key facts
- Issued by
- Digital Transformation Agency
- Sources listed
- 3
This is a reading aid for an Australian law firm. It is not legal advice, not a certification, and not a finding that a tool or a firm complies. The sentences paraphrase the sources listed, checked on the date shown. Where a standard is sold by ISO or the AICPA, the page uses the publisher’s public description and does not reproduce the standard.
What it is
The Digital Transformation Agency’s policy page says version 2.0 is effective from 15 December 2025, and that version 1.1 took effect on 1 September 2024. The policy aims to support adoption of AI in government and to make that use responsible. It sets principles and requirements under strategy and oversight, preparedness and operations, and AI use-case impact assessment.
The December 2025 update is described as strengthening governance: agencies develop a strategic approach to adopting AI, operationalise responsible use, designate accountability for use cases, and take risk-based actions at use-case level.
Who it applies to
The policy applies to non-corporate Commonwealth entities under the Public Governance, Performance and Accountability Act 2013, with exceptions set out in the policy. The implementation page says corporate Commonwealth entities are encouraged to apply it. A private law firm is neither. The policy becomes relevant to a firm when a government client requires it in a contract, or when the firm is advising an agency on the agency’s own compliance. The contract or the instruction does that work. This page does not.
What it asks of a law firm using AI
- The policy page lists mandatory requirements for in-scope agencies: designate accountable officials; publish a transparency statement; develop a strategic approach to AI adoption; operationalise responsible use; assign accountability for AI use cases; keep an internal use-case register; train staff; and assess use-case impact.
- The strategy and oversight page says agencies must make a public statement of their approach to AI adoption and use, as the Standard for transparency statements prescribes. It says agencies must develop a strategic position on AI adoption within 6 months of the policy taking effect.
- It says agencies must designate an accountable use-case owner for each in-scope use case within 12 months, keep a register of those owners, and create a register of in-scope use cases within 12 months. The register is shared with the DTA every 6 months from the time it is created.
- Those deadlines run for agencies. They are not dates by which a law firm must publish a statement.
How it maps to this framework
The rows are this site’s questions. Where the cell says “Not set here”, the instrument does not set that requirement. The gap is still recorded, so it is not treated as answered.
| This site’s question | What the instrument says that bears on it |
|---|---|
| Efficiency Whether the tool saves total human work at the quality the task needs. | One principle on the strategy page is that agencies adopt AI to enhance efficiency, decision-making, policy outcomes and service delivery. That is the government’s reason for using AI. It is not a measure of a firm’s time saving. |
| Effectiveness Whether the output is good enough for the task. The catalogue does not score this. | Not set here. |
| Due diligence What the firm has actually read about hosting, training and assurance before it relies on the tool. | A firm selling to, or advising, a non-corporate Commonwealth entity can expect questions that mirror the policy: who is accountable, what the use case is, and what the impact assessment found. Those questions belong to the agency. The firm’s own tool assessment is a separate record. |
| Confidentiality Whether client and other confidential information can go into the tool. | The policy sits alongside the Protective Security Policy Framework and the Privacy Act for agencies. It does not restate a solicitor’s duty. Official information a firm receives from an agency is handled on the terms of that engagement. |
| Disclosure When the firm tells the client, and where required the court or another party, that AI was used. | Agencies must publish a transparency statement about their approach to AI. That is the agency’s public statement. It is not a direction that a private firm publish one. |
| Certifications ISO, SOC 2 and IRAP names recorded against the tool. A listed name is not a finding that the certificate covers the firm’s plan. | Not set here. |
| Data residency Where the tool holds data, including whether that place is recorded as Australia. | Not set here. |
Sources
- Policy for the responsible use of AI in government, version 2.0
- AI in government policy: implementation
- AI in government policy: strategy and oversight
Checked 2026-10-10. Issued by Digital Transformation Agency.