Does the Australian Government have its AI risk settings right?

Why this matters now

AI adoption has shifted from cautious experimentation to rapid operational use.

Many agencies are exploring, piloting or deploying AI to speed up service delivery, improve analysis, and handle workloads that teams can’t sustain with traditional methods. Minister for the Public Service Katy Gallagher has emphasised trust as the make-or-break factor: “This new policy provides agencies important advice and direction to ensure public servants are using AI wisely, so that Australians can have confidence that we are using AI in the right way.”

For government, the risk is no longer simply “keeping up with the private sector”. It’s falling behind public expectations of responsive, efficient services. The challenge is building confidence and competence in real time while technology evolves faster than traditional policy cycles.

Policy landscape: Strong direction, uneven execution

Australia’s guidance for AI in government is maturing quickly, but it is also getting more complex. The Policy for the responsible use of AI in government (v2.0) sets mandatory expectations for accountability, transparency statements, use‑case registers and impact assessments. It is a stronger baseline, but it still leaves room for interpretation, so risk settings can diverge across agencies depending on culture, capability and confidence.

The National framework for the assurance of artificial intelligence in government adds structure through a nationally consistent, principles-based approach to testing and assurance. The 2024 pilot report makes the practical challenge explicit: AI’s complexity, speed and scale can amplify harm, while opacity, bias and unpredictability can overwhelm traditional ICT governance. In short: the frameworks are there, but many agencies are still building the maturity to apply them consistently.

Overlaying this is the National AI Plan focused on growing Australia’s AI industry and supporting an AI-enabled economy, with government capability, public services and safety forming part of that broader agenda. The APS AI Plan reinforces the productivity opportunity and the need to lift capability across all agencies—not just early adopters—and expects baseline AI literacy across the APS.

How Australia compares globally

Internationally, Australia sits between prescriptive and permissive models. The EU is implementing a risk‑tiered regime through the EU AI Act (clear rules, higher compliance burden). The UK favours a principles‑based, pro‑innovation approach (more discretion, more responsibility). The US remains decentralised, with strong momentum on productivity use cases but uneven risk maturity. Australia’s challenge is less the existence of frameworks and more whether risk appetite is applied consistently enough to enable safe scale.

Our view: Risk appetite should reflect mission and enable efficiency

One-size-fits-all governance won’t work. Real-world risk appetite varies because:

• Agency missions and consequences of failure differ.
• Data quality and governance maturity are uneven.
• Accountability models for AI (especially more autonomous systems) are still evolving.

What public-sector leaders should do next

1. Set an agency-specific AI risk appetite, with clear executive accountability (e.g. Secretary, Deputy Secretary, CIO or risk committee ownership). Define what “high-risk AI” means for your mission, where human oversight is mandatory, and what evidence is required before scaling.
2. Build repeatable assurance. Use the national assurance framework as the backbone, then tailor it: standard intake, impact assessment, testing, approvals, and ongoing monitoring.
3. Match controls to use cases, including defined checkpoints for privacy, security, bias, explainability, human oversight, and auditability before scale. By clearly separating low-risk productivity tools from high-impact decisioning, agencies can apply stronger controls where needed without slowing decisions, while avoiding unnecessary constraints on low-risk automation.
4. Train everyone (not just technical teams). Baseline AI literacy is now expected across the APS; make training scenario-based so staff can spot common failure modes (privacy, bias, hallucinations, over-reliance) and use approved tools safely.
5. Treat governance as enablement. Good governance clears a path for safe experimentation. The agencies moving fastest tend to bring risk, policy, legal, audit, CIO and operational leaders into the room early, so controls are designed in, not bolted on.
6. Address procurement risk early. Clarify vendor responsibilities, model hosting, data usage, offshore processing considerations and contractual protections.

In practice, agencies should be asking:

• Who owns AI risk appetite? Is this clearly defined at Secretary / Deputy Secretary / CIO / risk committee level?
• Which use cases are we prioritising? Have we clearly separated low-risk productivity tools from high-impact decisioning?
• What evidence is required before scale? Have we defined minimum standards for privacy, security, bias testing, explainability, human review and auditability?
• How are we managing procurement risk? Do we understand where models are hosted, how data is used, and what contractual protections are in place?
• How are we maintaining public trust? Do we have clear transparency statements, citizen impact considerations and accessible complaint mechanisms?

So, does Australia have the right AI risk settings?

Australia has the right policy direction, but not yet consistent operational settings. The next challenge is not more principles but translating those principles into agency-level risk appetite, repeatable assurance, approved tools, trained people and clear accountability.

The opportunity is real: AI can help government scale service delivery and analysis without proportional increases in cost or headcount. The risk is also real: if governance is either inconsistent or overly restrictive, productivity gains will be delayed and public confidence will be harder to earn. The practical aim is simple: define risk appetite, apply it consistently, and ensure accountability for outcomes.