NSW AI Assessment Framework support

What the AIAF is

The NSW AI Assessment Framework (AIAF) is the NSW Government's mandatory risk self-assessment for AI use cases. Under the NSW AI Operational Policy and Circular DCS-2026-02, NSW Government sector agencies must use the AIAF when designing, developing, deploying, procuring or using systems that contain AI components, across the whole lifecycle of a use case.¹²

The framework was redesigned in January 2026 and aligns to the National framework for the assurance of AI in government. From 30 September 2026, agencies register and assess AI use cases through the AIAF Platform. The assessment sets an intrinsic risk level and identifies the assurance activities that follow, which may include privacy, human rights or cyber security review.¹³

The Operational Policy replaced the NSW AI Ethics Policy and adopts Australia's AI Ethics Principles as the NSW Government's ethical principles for AI.²

Who it applies to

• Mandatory for NSW Government sector agencies and statutory authorities and bodies, under Circular DCS-2026-02.
• Recommended, not mandatory, for state owned corporations and some other entities.
• Not mandatory for local government, universities or third-party suppliers. Councils and universities may still choose to use the framework as good practice.
• High- and critical-risk use cases are referred to the NSW AI Review Committee, whose advice is advisory. Projects over $5 million or funded through the Digital Restart Fund receive additional central oversight.

How we support agency teams

• Use case mapping. Identifying where AI is in use or proposed, including AI inside vendor products, and which use cases need registration.
• Evidence preparation. Gathering what the assessment asks for: data, intended use, affected groups, potential harms and the controls in place.
• Drafting inputs. Clear, well-supported draft responses for the agency's accountable owner to review and enter in the platform.
• Assurance follow-through. Preparing for the assurance activities the assessment identifies, and, where the risk warrants it, independent technical testing that shows whether controls work.
• Records and reassessment. Organising decisions and supporting evidence so they can be retained and reassessed when a use case changes.

What stays with the agency

Related

Many agencies also need an AI inventory, policy and accountability arrangements that make the AIAF easier to run. See AI governance and risk and the AI Governance Readiness Assessment. Working across jurisdictions? See Queensland FAIRA.