Skip to content

Guidance for AI Adoption (AI6) – 6 Essential Practices

Purpose: Primary framework for implementing responsible AI governance in Australia Audience: Executive, governance, risk and compliance teams | Time: 30-45 minutes

Status

Federal government guidance published on 21 October 2025. It is the current general, non-binding guidance for responsible AI adoption in Australia.

Australian Standards for AI: update, October 2026

On 15 July 2026, the Government announced plans to legislate a framework for large data centres and AI training, including future mandatory requirements for large AI data centres. A new Office of AI has been established within PM&C to coordinate its design. On 26 August 2026, National Cabinet agreed to develop nationally consistent mandatory standards for large data centres, and the Commonwealth said it intends to legislate the AI standards in early 2027, including conditions for AI training. A public consultation paper took submissions until 9 October 2026. Media reports say the legislation may also require AI companies to report serious AI incidents to the affected organisation and the Australian Signals Directorate. These are proposals, not law.

The announcement does not withdraw or make AI6 mandatory. Organisations can continue using AI6 as current non-binding guidance while complying with existing law. (Prime Minister of Australia; PM&C Office of AI, accessed 22 July 2026)

What is the Guidance for AI Adoption?

On 21 October 2025 the National AI Centre (NAIC), within the Department of Industry, Science and Resources, released the Guidance for AI Adoption. It sets out six essential practices ("AI6") for responsible AI governance and adoption by organisations operating in Australia.

The Department describes this guidance as an updated and simplified framework that evolves the Voluntary AI Safety Standard (VAISS). The VAISS publication and its 10 voluntary guardrails remain available. The implementation guidance says all VAISS practices have been integrated into its implementation practices.

There are two versions of the guidance:

  • Foundations – for organisations getting started with AI or using AI in lower-risk ways
  • Implementation guidance – detailed practices for organisations building or customising AI, using complex or higher-risk systems, or needing stronger controls

The foundations guidance links to supporting resources including AI screening questions, an AI policy template and an AI register template. The implementation guidance links to the AI register template.

The six essential practices (AI6) in plain language

1. Decide who is accountable

Every AI use case should have clear owners.

  • Assign a senior leader as the overall AI governance owner, with enough authority and understanding to oversee AI use
  • Define who is responsible for approving, operating and monitoring each AI system
  • Clarify decision rights between IT, business units, risk/compliance and vendors
  • Make sure accountability appears in policies, job descriptions and governance forums (e.g. risk committee, digital steering group)

For SMEs

Even if you only have a few people, write down who:

  • signs off AI use
  • checks risks
  • responds if something goes wrong

2. Understand impacts and plan accordingly

Before deploying AI, understand what could go wrong and who could be affected.

  • Identify people and groups who may be impacted (customers, staff, suppliers, vulnerable communities)
  • Consider impacts on privacy, safety, fairness, security, employment and reputation
  • Carry out a stakeholder impact assessment, paying particular attention to vulnerable or marginalised groups
  • Set up ways for people to raise problems, complain, or challenge AI decisions and get help
  • Monitor feedback over time to spot systemic issues

For SMEs

Use a simple AI screening / intake form to document purpose, data, users and potential harms before you start building or buying.

3. Measure and manage risks

Treat AI use like any other material business risk.

  • Use a risk screening process to flag AI systems and use cases that pose unacceptable risk or need extra governance attention
  • Add AI-related risks to your enterprise risk register (privacy, cyber, safety, conduct, IP, regulatory)
  • Align to existing frameworks (privacy management, cyber security, WHS, consumer law, financial services)
  • Define risk appetite for AI in different areas (e.g. marketing vs safety-critical operations)
  • Record controls and safeguards and review them regularly

For SMEs

Start with a small standard set of AI risks and controls and reuse them across systems rather than reinventing the wheel each time.

4. Share essential information

Be open about how you use AI and what it means for people.

  • Tell people when they are interacting with, or significantly affected by, an AI system
  • Provide plain-language explanations of what the system does and its limitations
  • Maintain an AI system register covering purpose, data sources, key risks, controls and owners
  • Be transparent with suppliers and partners about expectations and seek equivalent transparency in return

For SMEs

A simple AI register and standard wording in privacy notices, contracts and internal policies will go a long way.

5. Test and monitor

AI systems must be tested before use and monitored over time.

  • Test systems against accuracy, robustness, bias, security and usability criteria before going live
  • Use realistic data and scenarios, including edge cases and stress tests
  • Set up ongoing monitoring and periodic review, not "set and forget"
  • Define incident thresholds and escalation paths (when to pause, roll back or retire a system)

For SMEs

For each important AI system, agree a short list of "things we will measure" and a cadence for checking them.

6. Maintain human control

People remain responsible for decisions and outcomes.

  • Decide where humans must remain "in the loop" or "on the loop" (reviewing outputs, overruling decisions)
  • Ensure staff using AI have training, guidance and authority to question or override it
  • Avoid over-reliance on AI, especially in high-stakes domains (safety, financial hardship, employment, access to services)
  • Build in clear points where people can pause, override, roll back or shut down an AI system
  • Maintain alternative pathways so critical functions can continue if an AI system fails or is withdrawn

For SMEs

Be explicit about which decisions AI can never make on its own and build that into processes and systems.

How AI6 relates to the 10 voluntary guardrails

The Department describes the Guidance for AI Adoption as updated and simplified guidance that evolves VAISS. It:

  • Condenses the 10 guardrails into 6 practices
  • Groups detailed controls under the 6 practices and adds guidance for developers as well as deployers
  • Includes a VAISS-to-implementation-guidance crosswalk in Appendix 2 of the PDF version (check its section references against the current numbering)

On SafeAI-Aus:

  • The Voluntary AI Safety Standard (10 Guardrails) page is maintained as a detailed control catalogue and historical reference
  • This AI6 page provides the current, higher-level framework that Australian organisations are encouraged to follow

The Department says all VAISS practices are now integrated into the implementation practices. If your organisation has already aligned to the 10 guardrails, SafeAI-Aus suggests you do not need to start again. Instead:

  1. Map existing policies, controls and risk registers into the 6 practices
  2. Use NAIC's implementation guidance to fill gaps
  3. Update internal documentation to reference AI6 as the primary framework

Where AI6 sits in the broader Australian landscape

AI6 aligns with:

  • The Australian Government's AI Ethics Principles
  • Existing technology-neutral laws and regulators (privacy, consumer law, workplace, safety, anti-discrimination, financial services, etc.)
  • International AI governance frameworks such as ISO/IEC 42001 and the NIST AI Risk Management Framework

The National AI Plan released in December 2025 retained existing laws and sector regulators as the foundation for addressing AI-related risks, supported by voluntary guidance including AI6. The Australian AI Safety Institute is now operating within the Department of Industry, Science and Resources to analyse AI capabilities, risks and harms and support regulators and agencies.

The separate Australian Standards for AI announced in July 2026 are still being designed. National Cabinet agreed on 26 August 2026 to develop mandatory standards for large data centres, and the Commonwealth intends to legislate in early 2027. Published material focuses on large data centres and AI training; it does not turn AI6 into a mandatory standard or create general duties for organisations using AI.

See Australian Government AI Policy and Frameworks for the current policy position.

How to use this page

For most Australian organisations, a practical approach is:

  1. 📊 Adopt AI6 as your top-level framework for AI governance and risk management
  2. 📋 Use the SafeAI-Aus toolkit (AI use policy, AI risk register, vendor checklist and project intake templates) to operationalise the 6 practices
  3. 🔗 Refer to the 10 guardrails when you need more granular control statements or when external documents still reference VAISS
  4. 🔄 Review at least annually and after material changes against updates from NAIC, sector regulators, privacy and consumer regulators, the Office of AI and the AI Safety Institute

Official sources

Legal status

AI6 is voluntary guidance and does not replace legal advice. Existing Australian laws and sector-specific obligations continue to apply.