Assess an AI use in twelve questions.
Modelled on the questions the NSW Government asks its own agencies before an AI system is approved, cut down for a business your size. Twenty minutes per tool.
Where this comes from
NSW Government agencies cannot approve an AI system without working through the NSW AI Assessment Framework: sixteen core questions across purpose, governance, data and privacy, security, fairness, transparency and human oversight, with high and critical risk cases referred to an independent review committee. Since 30 July 2026 that is mandatory for every agency, under the NSW AI Operational Policy. The NSW page explains it.
A business your size does not need sixteen questions and a committee. It needs the same discipline in a form one person can run in twenty minutes. These twelve questions are that. Run them on every AI tool, feature or workflow before it touches client information, and again whenever its purpose changes.
The twelve questions
| # | Area | Ask | What a good answer looks like |
|---|---|---|---|
| 1 | Purpose | What is this AI actually doing, in one sentence, and who asked for it? | If nobody can write the sentence, it has not been decided. Write it before anything else. |
| 2 | Owner | Who is accountable for it, by name? | One person, not a team. This is the person the NSW framework calls the accountable official. In your business it may be you. |
| 3 | Information | What information goes in, which bucket is it in (public, internal, client, sensitive), and where is it processed? | If the answer includes client or sensitive information and the processing location is unknown, stop here and find out. |
| 4 | Consent and notice | Do the people whose information goes in know, and have you said so where they can read it? | A sentence in the privacy policy, terms or intake form. From 10 December 2026, automated decisions must be disclosed by covered businesses. |
| 5 | Decision | Does it make, or substantially shape, a decision about a person: a price, a booking, an application, an escalation? | If yes, a human owns the decision and the tool prepares it. Mark it. |
| 6 | Checker | Who reads the output before it reaches a client or a decision is acted on? | A name. If the answer is nobody, it is not ready. |
| 7 | Wrong answers | What happens when it is plausibly wrong, and how would you know? | AI produces plausible output, not correct output. Decide how errors are caught and how often you sample. |
| 8 | Fairness | Could it treat some people worse than others because of who they are or what the data says about people like them? | Screening, scoring and triage tools carry this risk. If you cannot see how it decides, treat the risk as real. |
| 9 | Security and access | Which account is it on, who can log in, and what happens to access when someone leaves? | Business account you administer, training off, listed in the access register. |
| 10 | Vendor terms | Have you read what the provider does with the information: retention, training, location, sub-processors? | Twenty minutes. Write the answer next to the tool. Re-read when the terms change. |
| 11 | Incident | If the wrong file goes in tomorrow, who is told, what is deleted, and who decides whether a client is told? | The one-page bad-day plan. Written before it is needed. |
| 12 | Review | When will you look at this again, and what would make you switch it off? | Quarterly, and whenever its purpose changes. Name the trigger for stopping. |
How to score it
You do not need a risk matrix. Three rules. If question 3 involves sensitive information and the processing location is unknown, the answer is no until it is known. If question 5 is yes and question 6 has no name, the answer is no until it does. If any two other questions have no answer, the tool waits until they do. Everything else is a yes with the answers filed next to the tool in your register.
Write the twelve answers on one page, date it, and keep it with the tool register. When a client, an insurer or a larger customer asks how you assess AI, that page is the answer, and it is the same shape as the one a government agency would produce.
The one thing to do next
Run it on the tool your team uses most. Then take the Exposure Check to find the ones you have forgotten.