5Strategy (direction and ambition)

Strategy is the force that seeds everything else. It defines what the agency is trying to achieve with AI, how far and how fast it intends to go, and how much risk it is willing to carry to get there. Without a clear strategy, AI use cases proliferate from the bottom up, each defensible on its own but collectively unmanaged, and the agency drifts. The Policy for the responsible use of AI in government now makes a strategic approach to adopting AI a mandatory expectation, not a nicety. This section sets out what that strategy must contain, and introduces the maturity model that keeps ambition honest.

5.1What an AI strategy must answer

An AI strategy for a government agency does not need to be long, but it must be decisive. It should state the agency’s purpose for using AI in terms of public value, not technology; the outcomes it seeks and how they will be measured; the boundaries it will not cross; the few areas where it will focus first; and the risk appetite that governs all of it. It should be owned by the accountable authority and the executive, not delegated to a project. And it should connect explicitly to the National AI Plan’s three pillars, capture the opportunity, spread the benefits, and keep Australians safe, so that the agency’s ambition sits inside the national posture.

5.2The AI Autonomy Ladder: matching ambition to readiness

Ambition without readiness is the most common way AI initiatives fail. The AI Autonomy Ladder gives government a disciplined way to set ambition, by tying each step to the two variables that actually decide AI risk: how much the AI decides, and how reversible its actions are. Each rung grants the AI more decision rights, and each therefore demands more of the agency’s architecture, design and governance. The rungs cannot be skipped. One step in particular, the move from approving each output to supervising autonomous action, is the threshold where most organisations discover that a promising pilot cannot be scaled safely, because it is the point at which assurance must shift from reviewing outputs to governing the system at runtime.

1. 1AssistiveAI suggests; a person decides and acts on everything.
2. 2AugmentativeAI drafts or acts on narrow tasks; a person approves each output.
3. The supervision threshold: assurance moves from reviewing outputs to governing the system as it runs
4. 3SupervisedAI acts within bounds; a person supervises and can veto or roll back.
5. 4AutonomousAI acts without per-action review, governed by policy and monitoring.
6. 5OrchestratedMany AI agents coordinate as a system.

For most agencies today, the honest answer is that AI sits at rungs 1 to 2: assistive, human-decided, valuable and comparatively low-risk. The value of the ladder is not to rush to rung 5, but to be deliberate about where the agency is, where it wants to be, and what must be built before it can responsibly take the next step. Section 11 turns this into a roadmap. The strategic rule is simple: never grant the AI more autonomy than the architecture, design and governance can safely hold.

5.3Risk appetite and the use-case portfolio

Strategy becomes operational through two artefacts. The first is a written risk-appetite statement, endorsed by the accountable authority, that defines the agency’s tolerance for AI risk across dimensions such as harm to individuals, legal and lawfulness exposure, privacy, security, and reputation, and that names the risk tiers the agency will use. The second is a use-case portfolio: a deliberate, prioritised view of where AI will be applied first, assessed against value and risk, and recorded in the use-case register the policy requires. Together they convert a strategy document into decisions about what to do, what to defer, and what to refuse. Appendix A provides an intake and risk-tiering template that produces both.

5.4Strategy outputs