Book a demo Start free

Product

Product overview Agents Automations Apps Code (Beta) Integrations Governed Runtime Security

Where Renly runs

Windows app Android app Inside other AI apps

Solutions

Finance Sales Operations People and HR Marketing Enterprise

Resources

Pricing Docs Academy Blog Compare Support

AI governance and capability

AI governance framework AI governance assessment AI capability maturity AI maturity assessment
Book a demo Sign in
On this pageAustralian Government policy, standards and law
  1. Australian Government policy, standards and law
  2. International standards and frameworks
  3. Australian guidance for organisations
  4. European Union
  5. Maturity models, patterns and frameworks

AI Capability Maturity Assessment · Part V. Reference

References

15 minute read · Version 1.0.0 · 48 references

In this chapter

48 laws, policies, standards, frameworks and guidance cited by the model, each with its publisher, status, key dates and the date it was last checked.

  1. Australian Government policy, standards and law
  2. International standards and frameworks
  3. Australian guidance for organisations
  4. European Union
  5. Maturity models, patterns and frameworks

Every instrument the model cites, with its status and the date it was checked against the official source. This assessment is not legal advice and is not a certification. Obligations and dates were checked against official sources on 15 October 2026; confirm them against the source instruments, which can change.

Australian Government policy, standards and law

Policy for the responsible use of AI in government, version 2.0

Digital Transformation Agency · 15 December 2025 · Policy · Australian Government

In force; replaced version 1.1 (1 September 2024)

  • 15 December 2025Version 2.0 takes effect
  • 15 June 2026Strategic position on AI adoption developed and communicated to staff (within 6 months)
  • 15 December 2026Accountable use-case owners, internal register (shared with the DTA every 6 months), responsible AI practices including AI incident processes, mandatory staff training, and AI use case impact assessments begun (within 12 months)
  • 30 April 2027Existing use cases not yet assessed brought into line

The policy states deadlines as ‘within 6 months’ and ‘within 12 months’ of taking effect; the ANAO and Governing Intelligence convert these to the dates shown. High-risk use cases: governed through a designated board or senior executive, reported to the DTA once deployment is decided, reviewed at least every 12 months.

Checked 15 October 2026 · Cited by 1.1, 1.2, 1.3, 1.5, 2.1, 2.2, 2.3, 2.5, 3.1, 3.2, 3.3, 3.4, 3.5, 5.4, 7.1, 7.2, 7.3, 8.1, 8.2, 8.3, 8.5

AI impact assessment tool

Digital Transformation Agency · 1 December 2025 · Tool · Australian Government

Current (page updated 1 December 2025)

Checked 15 October 2026 · Cited by 1.2, 3.1, 3.2

Standard for AI transparency statements

Digital Transformation Agency · 28 February 2025 · Standard · Australian Government

Current; requirement first took effect 28 February 2025; page updated 1 December 2025. Statements reviewed at least annually; the DTA is told of every change.

Checked 15 October 2026 · Cited by 3.4

Technical standard for government’s use of artificial intelligence (AI technical standard), with the Agentic AI addendum

Digital Transformation Agency · 31 July 2025 · Standard · Australian Government

Current; agentic AI addendum published June 2026 (page updated 4 June 2026). Strongly recommended by Policy v2.0 rather than mandated.

The 31 July 2025 adoption date comes from secondary sources and the Governing Intelligence fact check; the DTA page shows no release date.

Checked 15 October 2026 · Related: link 1 · Cited by 3.3, 4.1, 4.2, 4.4, 5.5, 6.1, 6.2, 6.3, 6.4, 6.5, 7.2, 7.3

Guidance on AI procurement in government

Digital Transformation Agency · 2 December 2025 · Guidance · Australian Government

Released with Policy v2.0 and the AI impact assessment tool

Source is the DTA media release of 2 December 2025; the guidance itself is published on digital.gov.au.

Checked 15 October 2026 · Cited by 5.4

AI Plan for the Australian Public Service 2025

Australian Government · 12 November 2025 · Plan · Australian Government

Current. Three pillars: trust, people and tools. All agencies expected to appoint Chief AI Officers in 2026; mandatory foundational AI literacy training; GovAI and GovAI Chat.

The plan’s deliverables appendix says agencies are expected to appoint Chief AI Officers ‘in 2026’. Implementation material and press coverage cite July 2026.

Checked 15 October 2026 · Cited by 1.1, 1.3, 5.3, 7.1, 7.4, 7.5, 8.1, 8.2, 8.3, 8.4

National AI Plan

Department of Industry, Science and Resources · 2 December 2025 · Plan · Australian Government and Organisation

Current. Builds on existing laws and sector regulators, with targeted new laws only where needed; establishes the Australian AI Safety Institute.

Checked 15 October 2026 · Cited by 1.1

Australia’s AI Ethics Principles

Department of Industry, Science and Resources · 7 November 2019 · Principles · Australian Government and Organisation

Published 2019, page updated 2 December 2025. The department now describes the Guidance for AI Adoption as evolving these eight principles; Policy v2.0 and the assurance framework still cite them.

Checked 15 October 2026 · Cited by 8.5

Information Security Manual

Australian Signals Directorate · 2026-09 · Standard · Australian Government

Current release September 2026. AI controls since June 2024; expanded December 2025 (general-purpose AI usage policy, AI development controls), March 2026 (executive AI accountability principle, no access to unapproved AI agents from personal devices, no training on organisational data without consent), June 2026 (flagging risky agent actions for human approval) and September 2026 (unique identity for each AI agent, AI agent register, least-privilege tools and permissions, task-scoped authorisation, retrieved content treated as untrusted, central logging, human approval before sensitive or high-impact actions).

Checked 15 October 2026 · Cited by 1.3, 2.3, 3.5, 4.3, 4.4, 5.1, 5.2, 5.3, 5.4, 5.5, 6.2, 6.4, 6.5, 8.3

Hosting Certification Framework

Australian Government · 2021-03 · Framework · Australian Government

Current; certified services required for sensitive government data, whole-of-government systems and PROTECTED systems for new contracts and extensions from 30 June 2022

Checked 15 October 2026 · Cited by 4.3, 5.1

Deploying AI systems securely

Australian Signals Directorate, with international partners · 16 April 2024 · Guidance · Australian Government and Organisation

Current

Checked 15 October 2026 · Cited by 5.1, 5.2, 6.5

AI data security

Australian Signals Directorate, with international partners · 23 May 2025 · Guidance · Australian Government and Organisation

Current

Checked 15 October 2026 · Cited by 4.1, 4.3

Privacy Act 1988 and the Australian Privacy Principles

Parliament of Australia (administered by the Attorney-General’s Department; regulated by the OAIC) · 1988 · Legislation · Australian Government and Organisation

In force. Includes the Notifiable Data Breaches scheme and, since 10 June 2025, a statutory tort for serious invasions of privacy. A further reform exposure draft (Privacy Amendment (Personal Data Protection) Bill 2026) was released for consultation in August 2026 and had not been introduced to Parliament at the check date.

Checked 15 October 2026 · Cited by 3.4, 3.5, 4.3, 4.5

Privacy and Other Legislation Amendment Act 2024

Parliament of Australia · 10 December 2024 · Legislation · Australian Government and Organisation

Royal Assent 10 December 2024. Automated decision-making transparency (APP 1.7 to 1.9) commences 10 December 2026: APP entities must explain in their privacy policies the kinds of personal information used, and the kinds of decisions made, where a computer program makes, or does something substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual’s rights or interests. The OAIC published guidance on 30 September 2026.

  • 10 December 2026Automated decision-making transparency obligations commence

Checked 15 October 2026 · Related: link 1 · Cited by 3.4, 6.2

Privacy (Australian Government Agencies - Governance) APP Code 2017

Office of the Australian Information Commissioner · 1 July 2018 · Legislative instrument · Australian Government

In force since 1 July 2018; requires a written privacy impact assessment for high privacy risk projects

The official title uses a long dash between ‘Agencies’ and ‘Governance’; it is written with a hyphen here.

Checked 15 October 2026 · Cited by 3.1

Archives Act 1983

Parliament of Australia · 1983 · Legislation · Australian Government

In force

Checked 15 October 2026 · Cited by 4.4, 4.5

Automated Decision-Making Better Practice Guide

Commonwealth Ombudsman, with the OAIC and the Attorney-General’s Department · 2025-03 · Guidance · Australian Government

March 2025 edition

Verified through search; the PDF refused automated download.

Checked 15 October 2026 · Cited by 3.4, 4.4, 6.2

Guidance for AI Adoption

National AI Centre, Department of Industry, Science and Resources · 21 October 2025 · Guidance · Organisation and Australian Government

Current; published in two versions (Foundations and Implementation practices). Six essential practices: decide who is accountable; understand impacts and plan accordingly; measure and manage risks; share essential information; test and monitor; maintain human control. Now hosted on ai.gov.au.

Checked 15 October 2026 · Cited by 1.2, 1.3, 2.1, 2.5, 3.1, 3.3, 3.4, 5.5, 6.2, 6.3, 7.1, 8.1, 8.5

International standards and frameworks

ISO/IEC 42001:2023 Information technology - Artificial intelligence - Management system

ISO and IEC · 18 December 2023 · Standard · Organisation and Australian Government

Edition 1, current. Annex A contains 38 controls across nine control objectives (A.2 to A.10). Certifiable.

Publication date confirmed through the IEC webstore; iso.org refused automated access. The control count was confirmed from the standard’s structure and secondary sources, not the paid text.

Checked 15 October 2026 · Cited by 1.1, 1.2, 1.3, 1.4, 1.5, 2.1, 2.2, 2.3, 2.4, 2.5, 3.1, 3.2, 3.3, 3.4, 3.5, 4.1, 4.2, 4.3, 4.4, 4.5, 5.1, 5.2, 5.3, 5.4, 5.5, 6.1, 6.2, 6.3, 6.4, 6.5, 7.1, 7.2, 7.4, 7.5, 8.1, 8.2, 8.3, 8.4, 8.5

Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1

National Institute of Standards and Technology (United States) · 26 January 2023 · Framework · Organisation

Current; NIST states it is being revised, with no new version or date announced at the check date. Four functions: GOVERN, MAP, MEASURE and MANAGE.

Checked 15 October 2026 · Cited by 1.1, 1.3, 1.4, 1.5, 2.1, 2.2, 2.3, 2.4, 2.5, 3.2, 3.3, 3.5, 4.1, 4.2, 4.4, 5.2, 5.3, 5.4, 5.5, 6.1, 6.2, 6.3, 6.5, 7.1, 7.2, 7.3, 8.1, 8.2, 8.5

Australian guidance for organisations

Voluntary AI Safety Standard

National AI Centre, Department of Industry, Science and Resources · 5 September 2024 · Standard · Organisation

Ten guardrails. The department’s page (updated 2 December 2025) says the Guidance for AI Adoption evolves this standard; cite the guardrails for continuity and the Guidance for current practice.

The guardrails
  • 1 Establish, implement and publish an accountability process, including governance, internal capability and a strategy for regulatory compliance
  • 2 Establish and implement a risk management process to identify and mitigate risks
  • 3 Protect AI systems and implement data governance measures to manage data quality and provenance
  • 4 Test AI models and systems to evaluate performance and monitor the system once deployed
  • 5 Enable human control or intervention in an AI system to achieve meaningful human oversight
  • 6 Inform end-users regarding AI-enabled decisions, interactions with AI and AI-generated content
  • 7 Establish processes for people impacted by AI systems to challenge use or outcomes
  • 8 Be transparent with other organisations across the AI supply chain about data, models and systems
  • 9 Keep and maintain records to allow third parties to assess compliance with guardrails
  • 10 Engage stakeholders and evaluate their needs and circumstances, with a focus on safety, diversity, inclusion and fairness

Checked 15 October 2026 · Cited by 1.2, 2.1, 3.4, 4.1, 4.3, 4.4, 5.4, 5.5, 6.2, 6.3, 8.5

A Director’s Guide to AI Governance (Version 2)

Australian Institute of Company Directors and the Human Technology Institute, University of Technology Sydney · 29 June 2026 · Guidance · Organisation

Version 2 released 29 June 2026, updating the June 2024 original; includes a summary and checklist for smaller and not-for-profit boards

Checked 15 October 2026 · Cited by 1.1, 1.3, 1.5, 2.2

European Union

Regulation (EU) 2024/1689 (Artificial Intelligence Act), as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI)

European Parliament and Council of the European Union · 1 August 2024 · Legislation · Organisation

In force. Applies to providers placing AI on the EU market wherever they are established, and to providers and deployers outside the EU where the AI’s output is used in the EU.

  • 1 August 2024Entry into force
  • 2 February 2025Prohibited practices and AI literacy (Article 4) apply. As amended in 2026, Article 4 requires providers and deployers to take measures to support the development of AI literacy, without requiring any specific level of any individual.
  • 2 August 2025Obligations for general-purpose AI models apply
  • 2 August 2026Transparency obligations (Article 50) and most remaining provisions apply; generative systems already on the market before this date have until 2 December 2026 to meet the Article 50(2) marking obligation
  • 2 December 2026Additional prohibited practices added by the 2026 amendment apply
  • 2 December 2027High-risk obligations apply to Annex III systems (moved from 2 August 2026 by Regulation (EU) 2026/1744)
  • 2 August 2028High-risk obligations apply to Annex I systems (product safety legislation; moved from 2 August 2027)

Regulation (EU) 2026/1744 was adopted on 8 July 2026, published on 24 July 2026 and entered into force on 27 July 2026. Its high-risk dates are fixed, not linked to standards availability.

Checked 15 October 2026 · Related: link 1 · Cited by 1.2, 2.1, 2.3, 3.1, 3.2, 3.3, 3.4, 3.5, 4.1, 4.4, 4.5, 5.2, 5.4, 5.5, 6.1, 6.2, 6.3, 6.4, 6.5, 8.1, 8.2, 8.3

Maturity models, patterns and frameworks

Responsible AI Pattern Catalogue: RAI Maturity Model pattern

CSIRO Data61 · 2024-04 · Pattern catalogue · Organisation and Australian Government

Online catalogue maintained by the authors; the catalogue paper was published in ACM Computing Surveys in April 2024. The maturity model pattern is a governance pattern mapped to ISO/IEC 42001 and the EU AI Act, related to the RAI certification pattern.

Used for structure only: rate a small set of dimensions with a crisp method, and design against too many dimensions and vague rating rules.

Checked 15 October 2026

Responsible AI Maturity Model (Microsoft Research technical report, 2023)

Microsoft Research · 2023-05 · Maturity model · Organisation

Published technical report

Used for structure only: a maturity model as a strategic planning instrument used in facilitated workshops, read from foundations to practice. None of its wording or level names are used.

Checked 15 October 2026

This assessment is not legal advice and is not a certification. Obligations and dates were checked against official sources on 15 October 2026; confirm them against the source instruments, which can change.