What the NSW Government asks before it uses AI, and how to borrow it
Since 30 July 2026 every NSW Government agency has been required to register, assess and govern each AI system it uses. The framework behind that is public, and it is the best free model a business has for deciding whether an AI tool is safe to switch on.
The one-minute version
- The NSW AI Operational Policy 2026 was made mandatory for NSW Government agencies by circular DCS-2026-02 on 30 July 2026, issued by the Secretary of the Department of Customer Service. The current version of the policy is dated 1 September 2026.
- Every agency must appoint an accountable official, register every AI use case in the AI Assessment Framework Platform, apply the AI Assessment Framework where registration says an assessment is needed, refer high and critical risk cases to the AI Review Committee, align its acceptable-use policy, make AI literacy training available, and provide an annual attestation by 31 October, the first due in 2027.
- The NSW AI Assessment Framework is a self-assessment: sixteen core questions across purpose and oversight, data and privacy, security, fairness and bias, transparency and explainability, human oversight and ethics, with an optional deep dive. It applies across the whole life of a system, including procured systems and supplier-delivered components.
- None of this binds a private business. All of it is a free, tested model for one.
Two reasons. If you sell anything to NSW Government that involves AI, your customer now has to assess it and will ask you the framework's questions. And if you do not, the framework is still the clearest public answer to "what should I check before I switch on an AI tool", written by people who had to make it work across an entire government.
What the framework asks, in plain terms
| Area | What the agency has to answer | What that means for a business your size |
|---|---|---|
| Purpose and oversight | What the AI does, who is responsible, whether it is in scope | One sentence and one name per tool |
| Data and privacy | What information goes in, how it is governed, whether privacy law is met | Which bucket, where processed, whether the Privacy Act covers you |
| Security | How the system and its data are protected | Business accounts, access register, training off |
| Fairness and bias | Whether it could treat people unequally, and how that is tested | Screening, scoring and triage tools get a human decision |
| Transparency and explainability | Whether people know AI is involved and can understand the outcome | The sentence in your privacy policy and intake form |
| Human oversight | Who checks and can override the system | A named checker before anything reaches a client |
| Risk level | Low, medium, high or critical, with high and critical referred upward | Your stop rules: no processing location, no checker, no answer |
How to borrow it
You do not need the sixteen questions or the Excel workbook. You need the discipline in a form one person can run in twenty minutes. That is what the twelve-question assessment in the AI Framework section of this site is: the same areas, cut to the questions that matter for a business under fifty staff, with three stop rules instead of a risk matrix. Run it on every AI tool before it touches client information and keep the page with your tool register.
If you supply NSW Government
Expect the framework's questions in tenders and vendor questionnaires, and expect to be asked for evidence rather than assurance: where data is processed, how outputs are checked, what happens when it is wrong. A completed twelve-question page per AI component, plus your one-page AI rules, is usually more than a competitor will have. For larger contracts, ISO/IEC 42001 becomes a real conversation; for most, it is not.
The one thing to do next
Run the twelve-question assessment on one tool this week. If you supply government, run it on every AI component you deliver.
Where to check for yourself
- NSW AI Operational Policy (Digital NSW)
- Circular DCS-2026-02, Use of Artificial Intelligence by NSW Government Agencies
- NSW AI Assessment Framework (Digital NSW)
12 Sep 2026: first published. Next check: when Digital NSW releases the platform version of the framework, and after the first agency attestations in October 2027.