Deploying AI in Australian Government: a practical governance guide

Agencies are under pressure from two directions. Staff want AI for drafting, summarising and research, and many are already using public tools. Meanwhile the rules have tightened and become more specific. In the past year the PSPF, the DTA’s AI policy and the ISM have each published AI-specific requirements, and they don’t all say the same thing.

The good news is that, read together, they describe a workable path. This guide sets out what each one asks for and how to run a rollout that will stand up to an audit.

The PSPF: OFFICIAL is allowed, with conditions

PSPF Policy Advisory 001-2025, issued on 7 October 2025, confirms that OFFICIAL information can be used with generative AI. Entities must:

1. only provide access to generative AI products hosted on Hosting Certification Framework providers, OpenAI or Anthropic, or that have had a foreign ownership, control or influence (FOCI) risk assessment
2. make sure staff training covers handling security classified information when using generative AI
3. follow the existing PSPF technology authorisation process (Requirements 0086 to 0088) and consider ASD guidance when approving tools

Requirement 0088 is the one to keep in view: a system is authorised to the highest classification of the information it will process. The advisory covers OFFICIAL. It doesn’t extend to OFFICIAL: Sensitive, and the DTA’s staff guidance on public generative AI says plainly that OFFICIAL: Sensitive and above must not go into public generative AI tools. If you want staff to use AI on OFFICIAL: Sensitive work, you need a system authorised for it.

The DTA policy: accountability and a deadline

The Policy for the responsible use of AI in government moved to version 2.0 on 15 December 2025 and applies to non-corporate Commonwealth entities, with some exceptions. Its mandatory requirements cover accountable officials, transparency statements, a strategic approach to AI adoption, use case accountability, internal use case registers, staff training and AI use case impact assessment.

The dates matter. Agencies must begin AI use case assessments within 12 months of the policy taking effect, which means by 15 December 2026, and must work out whether existing use cases are in scope and apply the policy to them by 30 April 2027. If your agency’s AI chat pilot hasn’t been through the in-scope assessment yet, it should be on this quarter’s list.

The ISM: controls for the system itself

The ISM now has controls written for AI, and they’re what your assessor will test the system against. For a chat-style assistant the main ones are:

• ISM-2074: a general-purpose AI usage policy is developed, implemented and maintained
• ISM-2093: role-based access controls restrict AI applications’ access to sensitive data
• ISM-1924 and ISM-2094: prompts are screened for adversarial input, and output is filtered for sensitive data exposure
• ISM-2103: organisational data isn’t used to train or improve models without explicit consent
• ISM-2123: prompts and outputs are securely deleted when a chat is removed
• ISM-2112: AI applications that process classified data can’t reach external public data sources directly

Logging controls apply as they would to any system: central logging (ISM-1405), minimum event detail (ISM-0585) and at least 12 months of searchable retention (ISM-1988). For an outsourced service, ISM-1570 expects the provider and its service to have an IRAP assessment, refreshed at least every 24 months.

ASD’s Engaging with artificial intelligence (January 2024) remains the general reference the PSPF advisory points to.

What a defensible deployment looks like

Put those together and an AI deployment for OFFICIAL: Sensitive work needs:

• hosting and a supplier that pass the PSPF advisory’s test, plus an authorisation to OFFICIAL: Sensitive under Requirements 0086 to 0088
• sign-in through the agency’s identity provider, with MFA and role-based access to models and features
• a classification on every conversation, with stricter handling (redaction, blocked features) at higher levels
• prompt-level audit logs that go into the agency’s SIEM
• retention that follows the agency’s records obligations, with deletion that actually deletes
• a vendor incident procedure with a notification timeframe in the contract
• the use case recorded in the internal register and assessed under the DTA policy

Common mistakes

Starting at OFFICIAL and assuming the same tool will do for OFFICIAL: Sensitive. The advisory that makes OFFICIAL straightforward doesn’t cover the higher level, so the authorisation work still has to be done.

Treating the tool as a productivity app. Once staff put government information into it, it’s an information system, with an authorising officer, a register entry and a security assessment.

Taking a platform’s IRAP report as the service’s. An assessment of the cloud a vendor runs on covers the cloud. ISM-1570 is about the service you’re actually buying, so ask for its scope and date.

Assuming SOC 2 or ISO 27001 answers the ISM question. They’re useful evidence of a vendor’s security management, but they aren’t IRAP assessments and don’t test ISM controls.

Run a small pilot first

A pilot that produces evidence is worth more than a large rollout that produces anecdotes:

1. Pick 10 to 20 staff and one low-risk, high-volume task, such as drafting from public material or summarising published reports.
2. Do the DTA in-scope assessment and register the use case before you start.
3. Use a tool that meets the logging and access requirements above, and switch classification on from the first day.
4. Run it for 60 days. Measure time saved on the chosen task, and record every classification event and every near miss.
5. Use that record, not vendor claims, to make the case for wider use.

If you’re evaluating K9 AI for this, the position is: K9 AI is currently operated for information up to OFFICIAL: Sensitive, and PROTECTED handling is not available in production. K9 AI is undergoing an independent IRAP assessment up to PROTECTED, expected to complete by December 2026, so until that report exists your authorising officer will be working from our security pack (available on request) and your own assessment.

Frequently asked questions

Can Commonwealth staff use generative AI with OFFICIAL information?

Yes, under PSPF Policy Advisory 001-2025, provided the product is hosted by a Hosting Certification Framework provider, OpenAI or Anthropic, or has had a FOCI assessment, and the agency follows the PSPF technology authorisation process. Agency policy still applies.

Can OFFICIAL: Sensitive information go into AI tools?

Not into public generative AI tools, according to the DTA's staff guidance. An agency can authorise a specific system for OFFICIAL: Sensitive through its normal PSPF and ISM process, to the highest classification that system will handle.

When do agencies have to start AI use case impact assessments?

Under version 2.0 of the DTA's AI policy, agencies must begin AI use case assessments within 12 months of 15 December 2025, and apply the policy to existing use cases by 30 April 2027.