AI Capability Maturity Assessment · Part V. Reference
Editions and obligations
In this chapter
The Australian Government edition and Organisation edition: who each is for, the instruments each is anchored to, the criteria worded differently, and every obligation with a date, mapped to the criterion and level that meets it.
The model comes in two editions. The 40 criteria, the five levels and the scoring are the same in both; what changes is the wording of a few criteria, the notes on each criterion, the instruments referenced and the obligations with dates attached. Choose the edition at the start of an assessment; every report carries it.
Australian Government edition
Non-corporate Commonwealth entities and other Australian Government bodies that apply the Policy for the responsible use of AI in government. State and territory agencies can use it, noting that Commonwealth instruments may not bind them.
Anchor instruments
- Policy for the responsible use of AI in government, version 2.0
- AI Plan for the Australian Public Service 2025
- Information Security Manual
- Protective Security Policy Framework
- Privacy Act 1988 and the Australian Privacy Principles
- Privacy and Other Legislation Amendment Act 2024
- Archives Act 1983
Criteria worded for this edition
- 2.1 Accountable owners: Accountable officials for implementing the Policy are designated and the DTA is told of changes, and each in-scope AI use case has a single accountable use-case owner, recorded on the register and kept current.
Dated obligations in this edition
| Date | Obligation | Criterion | Met at |
|---|---|---|---|
| 15 June 2026 | Strategic position on AI adoption communicated to staff (Policy v2.0) | 1.1 Endorsed AI strategy | Level 3 (Defined) |
| 10 December 2026 | Automated decisions using personal information explained in the privacy policy (Privacy Act) | 3.4 Transparency and contestability | Level 3 (Defined) |
| 15 December 2026 | Accountable use-case owner for each in-scope use case (Policy v2.0) | 2.1 Accountable owners | Level 3 (Defined) |
| 15 December 2026 | Internal register of in-scope AI use cases (Policy v2.0) | 2.3 Use-case register | Level 3 (Defined) |
| 15 December 2026 | In-scope assessment of new use cases during design, and impact assessments begun (Policy v2.0) | 3.1 Impact assessments | Level 3 (Defined) |
| 15 December 2026 | A process for adopting AI use cases (Policy v2.0 responsible AI practices) | 3.3 Lifecycle and gates | Level 3 (Defined) |
| 15 December 2026 | AI incident processes overseen by a governance body (Policy v2.0) | 3.5 Incident and near-miss management | Level 3 (Defined) |
| 15 December 2026 | Mandatory responsible-AI training for all staff (Policy v2.0) | 8.1 Foundational AI literacy | Level 3 (Defined) |
| 15 December 2026 | Staff and public pathways to report AI safety concerns (Policy v2.0) | 8.5 Reporting culture and calibrated trust | Level 3 (Defined) |
| During 2026 | Chief AI Officer appointed (APS AI Plan) | 1.3 Executive ownership | Level 3 (Defined) |
| 30 April 2027 | Existing use cases assessed and brought into line (Policy v2.0) | 3.1 Impact assessments | Level 3 (Defined) |
Organisation edition
Australian companies, not-for-profits and other organisations outside the Commonwealth policy framework, including suppliers to government and organisations that export to or operate in the European Union.
Anchor instruments
- ISO/IEC 42001:2023 Information technology - Artificial intelligence - Management system
- Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1
- Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, NIST AI 600-1
- Guidance for AI Adoption
- Voluntary AI Safety Standard
- Privacy Act 1988 and the Australian Privacy Principles
- Privacy and Other Legislation Amendment Act 2024
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI)
Dated obligations in this edition
| Date | Obligation | Criterion | Met at |
|---|---|---|---|
| 2 February 2025 | Measures to support AI literacy for providers and deployers (EU AI Act Article 4) Applies where the EU AI Act reaches you | 8.1 Foundational AI literacy | Level 3 (Defined) |
| 2 August 2026 | EU AI Act transparency obligations for AI that interacts with people or generates content (Article 50) Applies where the EU AI Act reaches you | 3.4 Transparency and contestability | Level 3 (Defined) |
| 10 December 2026 | Automated decisions using personal information explained in the privacy policy (Privacy Act, APP entities) Applies to APP entities under the Privacy Act | 3.4 Transparency and contestability | Level 3 (Defined) |
Every dated obligation
In the assessment, an obligation that applies while its criterion is below the level that meets it makes the gap a must-do (class A), and a horizon that ends after the due date is flagged as a deadline at risk.
Australian Government edition
- 15 June 2026Strategic position on AI adoption communicated to staff (Policy v2.0) (1.1)
- 10 December 2026Automated decisions using personal information explained in the privacy policy (Privacy Act) (3.4)
- 15 December 2026Accountable use-case owner for each in-scope use case (Policy v2.0) (2.1)
- 15 December 2026Internal register of in-scope AI use cases (Policy v2.0) (2.3)
- 15 December 2026In-scope assessment of new use cases during design, and impact assessments begun (Policy v2.0) (3.1)
- 15 December 2026A process for adopting AI use cases (Policy v2.0 responsible AI practices) (3.3)
- 15 December 2026AI incident processes overseen by a governance body (Policy v2.0) (3.5)
- 15 December 2026Mandatory responsible-AI training for all staff (Policy v2.0) (8.1)
- 15 December 2026Staff and public pathways to report AI safety concerns (Policy v2.0) (8.5)
- During 2026Chief AI Officer appointed (APS AI Plan) (1.3)
- 30 April 2027Existing use cases assessed and brought into line (Policy v2.0) (3.1)
Organisation edition
- 2 February 2025Measures to support AI literacy for providers and deployers (EU AI Act Article 4) (8.1)
- 2 August 2026EU AI Act transparency obligations for AI that interacts with people or generates content (Article 50) (3.4)
- 10 December 2026Automated decisions using personal information explained in the privacy policy (Privacy Act, APP entities) (3.4)
This assessment is not legal advice and is not a certification. Obligations and dates were checked against official sources on 15 October 2026; confirm them against the source instruments, which can change.