Certification Rules

1. Overview

The Certification Process outlines how the Company receives, assesses, and determines applications for certification under the Rules. It ensures transparency, fairness, and alignment with the Australian AI Ethics Principles.

2. Application Submission

Applications must be submitted via the Website. Applicants are required to:

• Provide business details, including ABN for verification of eligibility as an Australian Business;
• Upload their business logo; and
• Submit responses to the Responsible AI Application Questionnaire (see Section 3).
• Applicants must also sign and submit the Responsible AI Pledge (Annexure 2).
• Incomplete applications may be returned for clarification or additional information.

3. Responsible AI Application Questionnaire

Applicants must answer the following questions to assist the Company in assessing the maturity, ethics, and governance of AI use or development within their organisation. Responses must demonstrate alignment with the Australian AI Ethics Principles (as listed in Section 4 of the Rules).

• 1. Describe briefly how your business currently uses AI or plans to develop AI solutions (for example tools, applications, or models). If there is no current use, note future plans.
• 2. Which AI tools or applications are in use? Select all that apply: chatbots or virtual assistants; predictive analytics or forecasting; image recognition or computer vision; natural language processing; automation or robotic process automation; HR or recruitment tools; marketing or content creation; supply chain or inventory management; AgriTech or farming optimisation; healthcare diagnostics or patient tools; other; none currently. For pre-built models, note their purpose.
• 3. How does your business identify and mitigate key risks associated with AI use? For example basic checklists or reviews, with a short example if applicable.
• 4. Does your business follow any ethical guidelines or frameworks for AI? If yes, name them: Australian AI Ethics Principles; internal company policy; international standards (for example EU AI Act guidelines); industry-specific standards (for example ISO standards for AI); other. If no, the business qualifies for the Commit tier with the Pledge.
• 5. How does your business ensure privacy and security of personal data in AI systems, and is it compliant with Australian laws such as the Privacy Act 1988? Methods may include data encryption and anonymisation; user consent and opt-out mechanisms; regular security audits; compliance with the Privacy Act via data impact assessments; third-party tools such as secure cloud providers; other.
• 6. Does your business ensure AI avoids discrimination based on protected characteristics (for example race, gender, disability), and how do you address bias in models? Methods may include diverse and balanced training data; bias detection tools or algorithms; inclusive testing with varied demographics; external audits or reviews; other.
• 7. Which best describes your AI use, including any high-risk areas? Select all that apply: low-risk (internal automation or content generation); medium-risk (customer recommendations or marketing); high-risk: employment or hiring decisions; high-risk: credit scoring or financial services; high-risk: healthcare or medical diagnosis; high-risk: law enforcement or surveillance; high-risk: education or assessment tools; high-risk: critical infrastructure; high-risk: biometric identification; other; none or unsure. Where high-risk, provide brief mitigation.
• 8. Does your business maintain documentation for AI development, testing, and oversight? If yes, note responsible roles or persons.
• 9. Does your AI undergo regular fairness audits or human-in-the-loop reviews? If yes, give the frequency and method.
• 10. Are there procedures to contest or override AI decisions? Give a brief example.
• 11. How does your business measure and mitigate environmental impacts of AI (for example energy use)? Not applicable if minimal.
• 12. Describe measures to ensure AI benefits society, and any plans for scaling AI with responsible governance.

4. Assessment and Determination

Each application is reviewed by an authorised Assessor, who evaluates responses to the questionnaire, alignment with the Responsible AI Pledge, and supporting documents such as policies or governance frameworks. Assessors operate in accordance with the definition in Section 2.1 of the Rules.

The Assessor may request a follow-up video call with the Applicant to discuss responses, clarify issues, or address concerns.

The Company determines the appropriate Certification Tier based on the evaluation. Payment is required after approval.

5. Public Register and Transparency

Upon certification, Certified Businesses are listed in a public searchable register on the Website. Each profile displays:

• Certification status and tier;
• The business logo; and
• Responses to the Responsible AI Questionnaire (subject to privacy and commercial sensitivity redactions).
• This register promotes transparency and allows verification of certification.

6. Renewal and Reassessment

Renewal requires confirmation that questionnaire responses remain accurate or are updated as necessary, along with any updated evidence of compliance, as per Section 7 of the Rules. The Company conducts reassessments as required.

7. Confidentiality and Privacy

All applicant data is collected, stored, and processed in compliance with the Privacy Act 1988 (Cth) and the Company’s Privacy Policy. Sensitive or proprietary information not marked for public display will remain confidential and used solely for certification purposes.

8. Continuous Improvement and Future Regulation

The Certification Process may be updated to reflect emerging AI legislation, regulatory obligations, or ethical standards in Australia.