The Digital Transformation Agency has started rolling its AI impact assessment tool across Commonwealth portfolios, pairing a December policy update with a requirement that agencies maintain registers of every in-scope generative use case before chatbots and copilots reach citizens.
From pilot to production gate
The tool replaces a volunteer “pilot assurance framework” tested with a handful of departments in late 2024. Agencies now complete a threshold questionnaire covering data sensitivity, affected cohorts and decision consequences; medium- and high-risk proposals must document mitigations, human oversight and incident escalation paths before procurement delegates sign contracts.
Policy version 2.0, effective 15 December 2025, also mandates accountable owners for each use case and integration with existing privacy and cyber frameworks rather than a standalone AI silo. Non-corporate entities must comply; government-owned corporations are encouraged to mirror the process.
What vendors will feel
Microsoft, Google and local integrators bidding on whole-of-government agreements report longer security questionnaires but clearer evaluation criteria. Panels that once waved through “internal only” pilots now ask whether training data includes personal information, how prompts are logged, and what happens when a model hallucinates a welfare eligibility answer.
Defence and Home Affairs were already running classified assessments; the change bites hardest in service delivery shops—Services Australia, the Tax Office, Department of Health—where front-line staff experimented with summarisation tools during call spikes.
Ethics and transparency hooks
The process explicitly references Australia’s AI Ethics Principles and the national assurance framework agreed with states in 2024. Agencies must publish or update AI transparency statements when citizen-facing tools go live, and establish pathways for staff and the public to report safety concerns without relying on informal IT tickets.
Implementation deadlines stagger through June and December 2026, giving smaller agencies time to hire or train responsible-AI leads. The DTA warns, however, that “later deadline” is not a free pass if a minister demos a chatbot on national television next week.
State alignment
New South Wales and Victoria already run their own assurance templates; the Commonwealth tool is designed to map across them so joint programs—such as shared health records pilots—do not duplicate paperwork. Queensland’s election-season digital pledges include a promise to publish agency AI inventories, which will likely import the same taxonomy.
For Australian startups selling retrieval-augmented generation to government, the register requirement is double-edged: more bureaucracy upfront, but a published list of approved use cases that sales teams can reference when knocking on department doors.
Civil society groups want parliamentary oversight of high-risk registers, not just internal governance. For now, the practical test is whether any agency still deploys an unregistered model after this month—and how quickly the DTA names the first project it pauses for incomplete paperwork.