What is responsible AI? The Australian answer, explained

A working definition

Start with the thing being governed. The OECD defines an AI system as a machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments.^[1] That definition matters because the European Union, the Council of Europe and the United States have adopted it, and because it is wide enough to catch the spreadsheet macro that scores loan applications as well as the chatbot on your website.

Responsible AI is then the practice of designing, buying, deploying and running such systems so that the people they affect are treated fairly, can understand when AI is being used on them, can challenge an outcome, and can find a human who is accountable for it. The word that does the work is practice. Responsible AI is not a belief about technology. It is a set of things an organisation does, and can show it does, across the life of each system.

Australia's eight AI Ethics Principles

The Australian Government published its AI Ethics Principles in 2019 through what is now the Department of Industry, Science and Resources. They are voluntary and are intended to complement existing law rather than replace it.^[2] They remain the reference point that later Australian guidance, and Responsible AI certification, maps back to.

• Human, societal and environmental wellbeing. AI systems should benefit individuals, society and the environment.
• Human-centred values. AI systems should respect human rights, diversity and the autonomy of individuals.
• Fairness. AI systems should be inclusive and accessible, and should not involve or result in unfair discrimination against individuals, communities or groups.
• Privacy protection and security. AI systems should respect and uphold privacy rights and data protection, and ensure the security of data.
• Reliability and safety. AI systems should reliably operate in accordance with their intended purpose.
• Transparency and explainability. There should be transparency and responsible disclosure so people can understand when they are being significantly impacted by AI, and can find out when an AI system is engaging with them.
• Contestability. When an AI system significantly impacts a person, community, group or environment, there should be a timely process to allow people to challenge the use or outcomes of the system.
• Accountability. People responsible for the different phases of the AI system lifecycle should be identifiable and accountable for the outcomes, and human oversight of AI systems should be enabled.

Two of the eight do most of the practical work. Contestability is the one Australian businesses most often miss, because it requires a route to a human that actually functions. Accountability is the one regulators test first, because it is answered with a name.

The six essential practices

Principles say what good looks like. Practices say what to do on Monday. On 21 October 2025 the National AI Centre published the Guidance for AI Adoption, which replaced the Voluntary AI Safety Standard of September 2024 and condensed its ten guardrails into six essential practices.^[3][4] The guidance comes in two editions, a foundations version for organisations starting out and an implementation version for teams that build or customise AI, run higher-risk use cases or need stronger controls.^[3]

• Decide who is accountable. Assign, document and communicate who answers for AI governance, for each system, and for third-party systems and contractors.
• Understand impacts and plan accordingly. Assess who a system affects and how, before it goes live.
• Measure and manage risks. AI-specific risk management, proportionate to the use case.
• Share essential information. Tell the people who need to know, inside and outside the organisation, what the system does.
• Test and monitor. Before deployment and for as long as the system runs.
• Maintain human control. Keep a person able to intervene, override and switch off.

The guidance is explicit that some of these apply across the organisation, such as governance frameworks, clear roles and an AI register, while others apply to each system and each use. The same tool can carry very different risk depending on where it sits. An internal drafting assistant and a model that screens job applicants are not the same project, even if they run on the same vendor.^[3]

If you want the six practices as a document your team can adopt, the free AI policy template is structured on them and on the eight principles, with the 10 December disclosure built in.

What is actually binding in Australia

Voluntary does not mean unregulated. Existing law applies to AI exactly as it applies to a person or a spreadsheet doing the same job: the Privacy Act, the Australian Consumer Law, anti-discrimination law, work health and safety duties, and the sector regulators. Three instruments deserve a specific mention because they name AI.

The Privacy Act disclosure, 10 December 2026

From 10 December 2026, organisations covered by the Privacy Act must state in their privacy policy the kinds of decisions made or substantially assisted by automated systems, including AI, and the kinds of personal information those systems use.^[5] It is a privacy policy content obligation rather than a consent rule, and it is the Australian AI obligation with the nearest hard date. The automated decision-making disclosure guide covers the three-limb test and what to write, and the free disclosure builder drafts the section.

Government's own policy, version 2.0

The Digital Transformation Agency's Policy for the responsible use of AI in government is binding on non-corporate Commonwealth entities, with limited carve-outs. Version 2.0 took effect on 15 December 2025 and requires agencies to publish an AI transparency statement, name accountable officials and use-case owners, keep an internal AI use-case register and apply risk-based controls per use case.^[6] It is the clearest statement of what the Commonwealth means by responsible AI, and suppliers to government increasingly meet it as a procurement expectation.

The Australian Standards for AI, still being written

At National Cabinet on 26 August 2026 the Commonwealth stated its intention to legislate Australian Standards for AI in early 2027, aimed in the first instance at large data centres and AI training.^[7] In October the Assistant Minister set out the shape: AI developers will need to prove their safety systems work.^[8] No bill has been published. Nobody, including us, can tell you today which businesses the standards will bind or what they will require, and anyone who claims to is guessing. What a business can do is make the voluntary layer real now, so that a future standard reads as a list of things it already does. The compliance deadlines tracker carries every dated obligation and its source.

Sector regulators have moved faster than Parliament. ASIC and APRA have told financial services firms what they expect of AI governance, Ahpra has published guidance for health practitioners, and courts in several jurisdictions have issued AI practice notes. The industry tracker keeps each sector current.

The international frameworks that do the heavy lifting

Three frameworks come up in every enterprise questionnaire and most board papers. None is Australian law. All three are useful because they are specific.

• OECD AI Principles. Adopted in May 2019 and updated in May 2024, with five values-based principles: inclusive growth and wellbeing; human rights and democratic values including fairness and privacy; transparency and explainability; robustness, security and safety; and accountability.^[1] Australia is an adherent, and the Australian principles are recognisably a local edition of these.
• ISO/IEC 42001:2023. Published in December 2023, the international standard for an AI management system. It sets requirements for establishing, running, maintaining and improving the system that governs AI inside an organisation, and it can be certified by an accredited body.^[9] It is the right target for a large organisation that already runs ISO 27001 or ISO 9001, because it follows the same structure.
• NIST AI Risk Management Framework 1.0. Released on 26 January 2023 by the United States standards body, for voluntary use, and built around four functions: Govern, Map, Measure and Manage.^[10] It is a method rather than a certification, and it is the one most Australian risk teams quietly use to structure an AI risk register.

The EU AI Act sits alongside these as law rather than framework. It entered into force on 1 August 2024 and reaches providers and deployers outside the EU where a system's output is used in the EU.^[11] Its high-risk obligations are now timetabled for December 2027, and the deadlines tracker records the current dates. An Australian business selling into Europe should treat it as a customer requirement, not a foreign curiosity.

Where Australian businesses actually are

The honest baseline is low. The Australian Responsible AI Index 2025, produced by Fifth Quadrant for the National AI Centre from a survey of 418 AI decision makers, put the mean score at 43 out of 100, one point down on the previous year. Twelve per cent of organisations were rated Leading, 23 per cent Implementing, 48 per cent Developing and 17 per cent Emerging. The largest organisations averaged 47; those with 20 to 99 employees averaged 40.^[12]

The public has noticed. The 2025 KPMG and University of Melbourne global study found 36 per cent of Australians willing to trust AI and 78 per cent concerned about negative outcomes.^[13] The OAIC's 2026 community attitudes survey found only 4 per cent of Australians trust AI companies with their personal information.^[14]

Put those two facts together and responsible AI stops being a compliance topic. It is the gap between how quickly Australian businesses are adopting AI and how little of that adoption they can show was done carefully. The businesses that can show it have something most of their competitors do not.

What responsible AI looks like in practice

For a business of any size, the practices above reduce to seven things that can each be evidenced with a document or a name. This is the order we see work.

• Name an owner. One person accountable for AI use across the business, and one for each system that affects people.
• Keep a register. Every AI system in use, including the ones staff adopted without asking, with what it does, whose data it touches and who owns it.
• Assess impact before go-live. Who is affected, what could go wrong, and whether the decision is one a person should make or review.
• Write the policy. Short enough that a new employee reads it. The template is free.
• Disclose. Tell customers when AI is engaging with them, and from 10 December 2026 put the automated decision-making section in your privacy policy.
• Test and monitor. Before launch, and on a schedule afterwards, with the results kept.
• Give people a route to a human. A contact, a timeframe, and someone who can actually change the outcome. This is contestability, and it is the practice customers feel most directly.

Independent certification is the way to show the list is real rather than aspirational. Responsible AI certification assesses a business against the eight AI Ethics Principles through human review, and lists it on a public register that people and AI agents can verify. It is evidence that the practices are in operation. It is not a legal clearance, and no certification in Australia is. How it works is set out here.

Responsible AI, AI ethics, AI governance, AI safety

These four phrases are used interchangeably and should not be. Each names a different layer.

• AI ethics is the values layer: what we think AI should and should not do to people. The eight principles are an ethics document.
• Responsible AI is the practice layer: the choices an organisation makes so its systems honour those values, and the evidence it keeps.
• AI governance is the system layer: the policies, roles, registers and controls that make responsible AI repeatable rather than heroic. ISO 42001 is a governance standard.
• AI safety is mostly used for the frontier: the work of making powerful models themselves safe, which is what the Australian Standards for AI appear aimed at. For a business deploying AI, safety is one of the eight principles rather than the whole job.

The AI governance glossary defines each of these and thirty other terms with sources.

Questions people ask