NSW AI Assessment Framework

What it is

A self-assessment framework that every NSW Government agency must apply whenever it designs, develops, procures, deploys or uses a system containing an AI component, across the whole lifecycle. The mandate comes from NSW Circular DCS-2024-04, which from 1 July 2024 requires agencies to apply both the NSW AI Ethics Policy and this framework. A modernised version was released on 27 January 2026, cutting a low-risk assessment from days to under thirty minutes and replacing subjective risk ratings with an automatic determination of the oversight a system needs. It is aligned with the Commonwealth’s National Framework for the Assurance of AI in Government and with the EU AI Act’s risk approach. It is the most developed AI assurance regime any Australian government runs.

What it requires

An agency answers a structured set of questions about the use case: what the system does, whose data it touches, who it affects and how far it acts on its own. The answers produce a risk level and a list of mandatory assurance activities, typically a privacy impact assessment, a cybersecurity review and, where people’s rights are engaged, a human rights screen and legal assessment. Generative AI is treated as elevated risk by default; a public-facing chatbot that collects sensitive information triggers the mandatory safeguards automatically. Systems rated high or critical must go to the AI Secretariat for review by the NSW AI Review Committee before they proceed. A senior officer signs off every assessment. The framework assesses against five ethics principles, community benefit, fairness, privacy and security, transparency and accountability, and since October 2025 sits beside an Agentic AI guide requiring human intervention points and regular output review for AI that acts autonomously.

Does this reach your business?

If you sell to NSW Government, yes, whether or not the framework names you. The agency buying your product must assess it, so you will be asked for the answers: what data the system uses, how it was tested, where it acts without a person, how bias and accuracy are checked, and what happens when it is wrong. The assessment is the agency’s, but the evidence is yours to supply, and a supplier who cannot answer slows or loses the procurement. If you do not sell to NSW Government, the framework does not bind you, but it is the clearest published example in Australia of what a sophisticated buyer will ask of an AI supplier, and other states and the Commonwealth are converging on the same questions.

What we recommend

Our advice, for any business selling AI-enabled services to NSW Government, is to fill in the framework yourself before the agency does. Run your product through the workbook, keep the answers with the evidence behind them, and have the privacy impact assessment and security review ready to hand over, because those are the mandatory activities an agency will need from you. Flag anything agentic or generative up front; it lands in the elevated-risk lane regardless. For everyone else, use the framework’s five principles and its list of assurance activities as a preview of what a serious customer’s questionnaire will contain, and keep the same record: what the system does, whose data it touches, who checks it and when.