1Executive summary

Artificial intelligence is moving government from automation to agency. For three decades, digital systems automated tasks while people held the decisions. AI inverts that arrangement: it makes decisions, at machine speed, and increasingly without a person in the loop. This is a profound opportunity for a public service under pressure to do more with less, and a profound governance challenge, because autonomy does not fail gracefully. A broken digital process stops; an AI system with bad data does not stop, it acts on the distortion. Governing AI well is therefore not an act of caution that slows the opportunity. It is the precondition for capturing it.

The Australian Government has reached the same conclusion, and across 2025 it turned principles into obligations. The Digital Transformation Agency’s Policy for the responsible use of AI in government was rewritten and, in version 2.0 effective 15 December 2025, now requires every agency to take a strategic approach to adopting AI, to designate accountable officials, to maintain a register of AI use cases, to assess the impact of each one, and to publish transparency statements. The DTA’s AI technical standard, published in July 2025, defines what good looks like across an AI system’s life, from Discover to Operate to Retire. The National framework for the assurance of AI in government sets five cornerstones for assuring AI against Australia’s eight AI Ethics Principles. In October 2025 the National AI Centre updated the Voluntary AI Safety Standard into its Guidance for AI Adoption, condensing ten guardrails into six essential practices. And on 2 December 2025 the National AI Plan set the national posture: technology-neutral, building on existing laws and sector regulators, with targeted new laws only where needed, and backed by a new Australian AI Safety Institute. The momentum has continued into 2026: the APS AI Plan required agencies to appoint a Chief AI Officer by July 2026, the technical standard gained an agentic AI addendum, and most of the policy’s remaining obligations, including use-case owners, the register, impact assessments, staff training and AI incident processes, fall due on 15 December 2026, with existing use cases to be brought into line by 30 April 2027.

The obligations have arrived, but they are spread across many instruments, owned by many agencies, written at different altitudes. A leader who asks the simple question, how do we govern and assure AI across our organisation, safely, securely and effectively, will not find a single answer in any one of them. This framework provides that single answer. It organises the whole of an agency’s response around five domains that every enterprise must get right, and that together form a self-balancing system we call the Governed Intelligence Model.

Renly developed the Governed Intelligence Model as a synthesis of the best current thinking on AI governance, grounded in public standards and anchored, domain by domain, to the Commonwealth mandate. It is deliberately cyclical. A clear strategy ignites the operating model; the operating model grounds the architecture; the architecture lets design scale; and design defines what must be governed. An assurance loop runs the other way: governance feeds what it learns back to strategy, and keeps the system honest, so that ambition does not outrun the architecture and delivery does not outrun safe practice. It is a compass, not a checklist.

This framework is also written to be led and applied, not just admired. Frameworks do not govern; leaders do. Part III therefore closes with two sections that most AI governance documents omit. Section 12 is the executive agenda: what the accountable authority personally owns, the questions leaders should keep asking, the one-page dashboard that lets an executive govern AI on evidence, and the posture that satisfies the auditors, the Ombudsman and the Parliament. Section 13 makes adoption practical: how to right-size the machinery to the agency, find the AI already in the estate, govern the everyday assistants staff are already using, buy AI well, respond when something goes wrong, and draw on the whole-of-government ecosystem rather than building alone. Together they close the gap where most frameworks fail: between the document and the organisation.

1.1What this framework gives you

1.2The decisions this framework asks of leaders

Adopting this framework is itself a small number of executive decisions, and they align precisely with the new policy. Name the accountable official for AI strategy and stand up an AI Governance Committee. Adopt the framework, its risk tiers and its assurance gates. Open the use-case register and run the first impact assessment. Resource the secure foundation and the new roles that govern AI. Section 14 sets these out as a ninety-day mobilisation. None of them is large. Together they are the difference between an agency that adopts AI and one that can prove it is doing so safely, securely and effectively.