13Applying the framework in your agency

A framework earns its keep in contact with a particular agency: a particular size, mission, risk profile and starting point. This section answers the six practical questions agencies ask most often: how much of this machinery do we actually need; how do we find the AI we already have; what do we do about the assistants staff use every day; how do we buy AI well; what do we do when something goes wrong; and what can we draw from the rest of the Commonwealth rather than building alone. Appendix L provides a twenty-question self-assessment that locates an agency against the framework and points to the roadmap horizon it should start from.

13.1Right-size the machinery, never the accountability

The policy binds non-corporate Commonwealth entities from the scale of Services Australia to entities of a few hundred people, and one size of governance machinery does not fit that range. The framework is deliberately separable: its accountabilities are fixed, while its structures scale. What never scales down: a named accountable official for the strategy and for each use case; the register; an impact assessment for every in-scope use; gates that fail closed; and provenance for any decision affecting a person. What scales freely: whether the AI Governance Committee is a dedicated body or a standing item of the existing risk committee; whether the six capabilities of Section 6.5 are roles, functions or shared services; and how heavy the simulation and monitoring stack needs to be for the risk actually carried.

13.2Find the AI you already have

Most agencies’ first honest register is a discovery exercise, because AI arrives without announcing itself. It is embedded in productivity suites, security tooling, recruitment platforms and translation services; it is switched on by vendors as features in products bought for other reasons; it is running informally in analytics teams as models that quietly graduated from experiment to dependence; and it is in staff hands as public generative tools. The policy’s obligations attach to the use of AI, not to how it was acquired, and an audit or an incident will not distinguish between AI the agency chose and AI it merely absorbed. A short discovery sweep closes the gap:

• Ask every business area, with an amnesty framing: what tools do you use that draft, decide, score, rank or summarise for you? The amnesty matters; discovery punished is discovery ended.
• Sweep procurement records and current contracts for AI features and AI-adjacent services, and ask incumbent vendors to declare AI in their products and any planned by default.
• Scan the application and SaaS estate for AI capabilities enabled or about to be enabled by vendors, including in security, HR and service-management tooling. Recruitment platforms deserve particular care: under the APSC’s 2026 principles, AI must not make selection decisions, and any AI screening must preserve merit and be disclosed.
• Visit the analytics and research teams and ask which models are, in practice, relied on for operational decisions, whatever their formal status.

Everything found goes on the register and is tiered under Appendix A. Most of it will be low-risk and lightly governed, which is the correct outcome; the point is that the agency now knows, and can say so to an auditor with a straight face. Repeat the sweep annually; the estate does not stand still.

13.3Govern the everyday assistants

The highest-volume AI in an agency is not a bespoke system; it is the generative assistant in every staff member’s hands, drafting minutes, summarising documents and answering questions. These uses sit at rungs 1 to 2 of the Autonomy Ladder, and drowning them in case-by-case governance would discredit the framework in a month. The efficient pattern is to register the pattern, not the keystrokes: one enterprise use case, one accountable official, one impact assessment covering assistive productivity use, refreshed as tools change, with individual use governed by a short acceptable-use policy that fits on a page.

The Commonwealth has made this pattern easier to run well. GovAI Chat, the government-hosted assistant on the Department of Finance’s GovAI platform, gives agencies a multi-model assistant inside a government boundary, with logging and without staff prompts training vendor models; it is rolling out across the APS through 2026 and is the natural approved tool for general assistive use. The whole-of-government trial of Microsoft 365 Copilot, evaluated by the DTA in 2024, supplies the practical lessons: value concentrates in summarising and first drafts, and it is realised only where staff are trained in prompting and given agency-specific guidance. Foundational AI training is now mandatory for APS staff, with the APS Academy’s AI in government fundamentals available to every agency, which turns the training line of this policy from aspiration into a scheduled obligation.

Two boundaries keep this honest. The moment an assistant is connected to agency systems so that it can act, send, file, change records, it has crossed the rung-3 threshold of Section 5.2, and the full design and gate discipline of Section 8 applies. And staff training, proportionate to role, is what makes the seven lines real; the policy expects capability, not just compliance text.

13.4Buy AI well

Most agency AI is bought, not built, so procurement is where governance succeeds or fails first. The DTA’s AI procurement guidance and the Commonwealth Procurement Rules frame the process; the framework adds the assurance spine: apply the third-party checklist at Appendix D before contract, not after; require evidence for capability claims, model documentation, evaluation results, references, because marketing copy is not assurance; and pilot inside a contained enclave under Section 7.4 before anything touches production data. The contract itself carries the controls that matter for the life of the arrangement:

13.5When something goes wrong: AI incident response

Section 10.4 gave every system a kill switch and a rollback; the agency also needs the organisational muscle to use them well. An AI incident is any of: a harmful, unlawful or materially wrong output acted on; a privacy breach involving an AI system; a security compromise of a model, its prompts or its data; sustained drift or behaviour outside tolerance; or the discovery of consequential AI operating outside the register. The response path is the same discipline the agency already knows from security incidents, tuned for AI:

1. 1Detect
2. 2Contain
3. 3Assess
4. 4Notify
5. 5Recover
6. 6Learn

Lessons feed the assurance loop back into detection and policy.

Three features distinguish good AI incident practice. Containment is instant and rehearsed: pausing the system is always available, always reversible, and never career-limiting for the person who pulls it. Notification is mapped in advance, the Office of the Australian Information Commissioner for eligible data breaches, the Australian Cyber Security Centre for cyber incidents, the Ombudsman, affected people and the minister’s office as the situation requires, so no one is designing a communications strategy at midnight. And near misses are treated as first-class citizens: they travel the same path in miniature, they are free lessons, and their absence from reporting is a warning sign, not a comfort. Appendix K provides a runbook skeleton with severity classes, roles, a first-hour checklist and the notification map, ready to adapt.

13.6Draw on the whole-of-government ecosystem

No agency should govern AI alone, and none needs to. The Digital Transformation Agency owns the policy, the AI Impact Assessment tool, the technical standard and its agentic addendum, and the procurement guidance, and it now publishes the central list of agency transparency statements, which makes an agency’s absence as visible as its presence. The Department of Finance operates GovAI, the government-hosted AI platform and assistant, and AIDE, the delivery and enablement function that convenes the Chief AI Officers across the service. The National AI Centre’s Guidance for AI Adoption offers the plain-language practices of Section 3.5, and the Australian AI Safety Institute tests and monitors advanced models so that individual agencies do not each need to. The Australian Signals Directorate publishes the AI security guidance of Section 3.7 and keeps the ISM’s AI controls current; the OAIC covers AI and privacy; the APSC covers AI in recruitment and conduct; and the APS Academy carries the whole-of-service capability programs, including the now-mandatory foundational training. The operating principle is simple: adopt central instruments and platforms where they exist, contribute lessons back through the Chief AI Officer network and the communities of practice, and spend the agency’s scarce assurance effort on the risks that are unique to its mission, not on rebuilding what the Commonwealth already provides.