Australian Government Policy for Responsible Use of AI

The Digital Transformation Agency (DTA) issued the Policy for the responsible use of AI in government as a whole-of-government administrative policy for the Australian Public Service. Version 1.1 took effect September 1, 2024 and required non-corporate Commonwealth entities to designate accountable official(s) and publish AI transparency statements. Version 2.0 replaced v1.1 and took effect December 15, 2025. The current policy remains mandatory for non-corporate Commonwealth entities, with exceptions for the defence portfolio and national intelligence community; corporate Commonwealth entities are encouraged, not required, to apply it. It is policy, not a general statute applying to private companies. Version 2.0 maintains accountability and transparency duties and adds requirements for agencies to set a strategic position on AI adoption, operationalise responsible AI practices, designate accountable owners for in-scope use cases, maintain internal use-case registers, train staff, and conduct risk-based impact assessments. The first new requirement, a strategic position on AI adoption, was due within six months of v2.0 taking effect (June 15, 2026). Agencies have 12 months (December 15, 2026) for operational practices, staff training, accountable use-case owners, and an internal register. Existing use cases must be assessed and brought into scope by April 30, 2027. As of September 2026, only the first deadline has passed. The public transparency statement gives a high-level account of an agency’s approach, including why it uses AI, use patterns and domains, direct public interactions or significant impacts without human review, monitoring and safeguards, compliance with policy and law, and the date of last update. It must be reviewed at least annually and sooner after significant changes. The statement need not list every individual use case. Separately, the internal register captures in-scope use cases, owners, risk ratings, and assessment details; the DTA requires periodic sharing. The policy complements existing legislation, privacy, cybersecurity, records, procurement, and public-service obligations rather than replacing them. Agencies should use v2.0; archived 2024 resources may omit newer requirements.