Government AI assessments need evidence before the deadline

The dates need their surrounding scope

The DTA's Policy for the responsible use of AI in government version 2.0 took effect on 15 December 2025. It applies to non-corporate Commonwealth entities with stated exceptions. It is not a blanket deadline for every Australian business.

The assessment-tool introduction refers to implementation by 15 December 2026. The current policy section is more specific: agencies must begin assessments within 12 months of the policy taking effect, while existing unassessed use cases must be scoped and have relevant policy actions applied by 30 April 2027. New use cases are assessed for scope during design. In-scope assessments begin at design and are finalised, with agreed treatments applied, before deployment.

These official pages were checked on 11 September 2026. Agency owners and suppliers should use the current policy to confirm the applicable category and timing rather than treating the December date as a single rule for all work.

Scope the use case before assessing the product name

The following sections provide engineering analysis and an illustrative example. They do not add requirements to the DTA policy or determine an agency's formal risk rating.

A product can support several uses with different consequences. Drafting an internal meeting summary and recommending an action affecting a member of the public are not the same use case simply because both use the same model.

Describe the users, task, affected people, inputs and outputs. Explain whether the system only drafts text, recommends a decision or can trigger an external action. This gives the accountable agency something concrete to assess against the policy's scope criteria.

For a supplier, the useful question is what evidence the agency needs for its defined use case. A generic statement that the platform uses responsible AI does not explain how a particular deployment behaves.

Follow one example through the system

Consider a synthetic agency workflow that summarises incoming correspondence for a staff member. The AI produces a draft summary and suggests a routing category. A staff member reviews both before the case-management system is updated.

Map the actual input path, model provider, retrieval sources, logs and final write. Record what happens when a letter contains an instruction aimed at the AI, refers to another case or includes material the model cannot interpret reliably.

Test whether the human-review boundary can be bypassed through another endpoint or tool. A diagram saying that review exists is weak evidence if the implementation also exposes an unrestricted write path.

Keep an example trace with appropriate sanitisation. It should show which input produced the draft, what the reviewer changed and which action the system ultimately performed.

Make evaluation useful to the assessor

Build a representative set containing routine correspondence, ambiguous wording, missing pages and cases that should be escalated. Include examples where a plausible summary would omit a qualification that changes the meaning.

Ask reviewers to assess material omissions, incorrect claims and routing consequences. A single overall accuracy percentage can hide the failure category most relevant to the use case.

For an illustrative failure, the summary may say a person agrees to a proposed action while omitting the condition attached to that agreement. The system has produced readable text, but the operational interpretation is wrong. The evidence should preserve that distinction.

Record the model, prompt, retrieval configuration and evaluation version. Otherwise the assessment may describe a build different from the one deployed.

Treat supplier changes as part of the operating relationship

The policy requires monitoring and revalidation for material changes and advises agencies to monitor vendor changes. The delivery implication is to agree how the agency learns about changes that affect the assessed behaviour.

A model replacement, expanded data source or newly enabled tool can change the use case even when the interface looks the same. Keep release notes specific enough to identify those changes and rerun the relevant tests.

Define who decides whether the existing assessment remains accurate. The supplier can provide technical evidence, while the agency retains its own governance responsibilities and approval process.