Scope of certification
What we assess, and what we do not
A certification is only useful if the people relying on it know its limits. This page sets out the standard we assess against, the evidence each tier requires, how the questionnaire maps to the Australian AI Ethics Principles and the National AI Centre's six essential practices, and where certification stops and other assurance begins.
The standard
Certification assesses an Australian business's responsible AI practices against the eight Australian AI Ethics Principles, as published by the Department of Industry, Science and Resources, and the Responsible AI Pledge in Annexure 2 of our Certification Rules. The Rules are filed with the Australian Trade Marks Office under section 173 of the Trade Marks Act 1995 (Cth).
- 1Human, societal and environmental wellbeing
- 2Human-centred values
- 3Fairness
- 4Privacy protection and security
- 5Reliability and safety
- 6Transparency and explainability
- 7Contestability
- 8Accountability
What each tier requires, and what the assessor checks
Tiers are cumulative. The tier is determined by the assessment, not chosen by the applicant.
Commit
Evidence required
- A signed Responsible AI Pledge (Annexure 2 of the Rules)
- The Responsible AI questionnaire, answered in full
- ABN verified as an Australian business
What is assessed
The assessor checks that the Pledge is signed by someone authorised to bind the organisation, that the questionnaire is complete and internally consistent, and that nothing declared conflicts with the Pledge, including its list of prohibited practices.
Embed
Evidence required
- Everything in Commit
- A Responsible AI Policy, uploaded as a document, that the business states is implemented across its operations
What is assessed
The assessor reads the policy against the requirement in section 4 of the Rules and the eight principles, and checks that the questionnaire answers are consistent with a policy in operation rather than a document on a shelf. A follow-up video call may be used to test that.
Govern
Evidence required
- Everything in Embed
- A Responsible AI Governance Framework, uploaded as a document
What is assessed
The assessor checks the framework for the four elements section 4 of the Rules requires: risk management and accountability embedded in organisational processes; defined roles and responsibilities for AI oversight; impact assessments, monitoring and review; and escalation and accountability mechanisms. The framework must be consistent with the eight principles.
The questionnaire, mapped
Every applicant answers the questionnaire in Annexure 1 of the Rules. The table shows which principle and which National AI Centre practice each area relates to, and how the answer is assessed. “Declared” means the business's own answer, reviewed by the assessor for completeness and consistency. “Document” means an uploaded policy or framework is read.
| Questionnaire area | AI Ethics Principle | NAIC practice | How assessed |
|---|---|---|---|
| How AI is used, or planned | 6 Transparency | 4 Share essential information | Declared |
| AI tools and pre-built models in use | 6 Transparency | 4.1 AI register | Declared |
| How AI risks are identified and mitigated | 5 Reliability and safety | 3 Measure and manage risks | Declared, may be tested on a call |
| Ethical frameworks followed | 8 Accountability | 1.4 AI governance framework | Declared |
| Privacy and security of personal data | 4 Privacy and security | 3.3 Controls, 5.4 Data and cybersecurity | Declared, may be tested on a call |
| Preventing discrimination and bias | 3 Fairness | 3.2 Assess risks, 5 Test and monitor | Declared, may be tested on a call |
| Risk level of AI use, including high-risk areas | 5 Reliability and safety | 3.2 Assess AI system risks | Declared |
| Documentation and who is responsible for oversight | 8 Accountability | 1.1 Accountable people | Declared, may be tested on a call |
| Fairness audits and human-in-the-loop review | 5 Reliability, 3 Fairness | 5 Test and monitor, 6 Maintain human control | Declared |
| Procedures to contest or override AI decisions | 7 Contestability | 2.2 Feedback and redress, 6.1 Human oversight | Declared, may be tested on a call |
| Environmental impact of AI use | 1 Wellbeing | Not a numbered practice | Declared |
| Societal benefit and plans for scaling with governance | 1 Wellbeing, 2 Human-centred values | 1.4 AI governance framework | Declared |
| Automated decision-making and privacy policy disclosure | 6 Transparency | 4.2 Transparency and explainability | Declared |
| Policy and governance framework (Embed and Govern) | All eight | 1.4 Governance framework, 3.1 Risk framework, 2 Impacts | Document |
Against the six essential practices
The National AI Centre's Guidance for AI Adoption sets out six essential practices for Australian organisations. This is an honest account of what certification covers under each one and what it does not. It is a map, not a conformance claim.
1. Decide who is accountable
Covered: The Pledge is signed by an accountable person. The questionnaire records who is responsible for AI oversight. The Govern tier requires defined roles and accountability mechanisms in a governance framework.
Not covered: Supply-chain accountabilities (1.2) and staff AI-literacy training (1.3) are not assessed.
2. Understand impacts and plan accordingly
Covered: The Govern tier requires impact assessments in the governance framework. The questionnaire covers contest and redress procedures and societal benefit.
Not covered: Stakeholder engagement (2.1) and monitoring for systemic issues (2.3) are not separately assessed.
3. Measure and manage risks
Covered: The questionnaire covers how risks are identified and mitigated, the risk level of each use, privacy and security controls and bias prevention. The Govern tier requires risk management embedded in processes.
Not covered: Responsible AI Australia does not assess individual risk assessments or the effectiveness of controls.
4. Share essential information
Covered: Every certified business's questionnaire responses are published on the register, subject to the redactions the Rules allow. The automated decision-making question records privacy policy disclosure.
Not covered: AI-generated content transparency (4.4) is not assessed.
5. Test and monitor
Covered: The questionnaire records whether the business conducts fairness audits or human-in-the-loop reviews, and how often.
Not covered: This is declared by the business. Responsible AI Australia does not test, evaluate or red-team any AI system, and does not verify test results.
6. Maintain human control
Covered: The questionnaire records human review practices and the procedures for a person to contest or override an AI decision. Contestability is one of the eight principles every tier commits to.
Not covered: Decommissioning practices (6.2) are not assessed.
How assessment works
An independent assessor
Assessors are independent, based in Australia and competent in AI and the Australian AI Ethics Principles, and must disclose conflicts of interest. An assessor with a personal or commercial connection to an applicant steps aside. Borderline decisions are reviewed by a second person before a mark is issued.
Evidence review and follow-up
The assessor evaluates the questionnaire, alignment with the Pledge and the uploaded policy or framework, and may request a video call to clarify responses. Responsible AI Australia then determines the tier. There is no cost to apply, and payment is only taken after approval.
Twelve months, then renewal
Certification is valid for 12 months. Renewal requires confirmation that responses remain accurate, updated evidence on request, and re-examination. Failure to renew results in revocation and loss of the right to use the Mark.
Complaints and revocation
Anyone can complain about non-compliant AI use by a certified business. The business has 28 days to respond and remedy. Unresolved complaints, breaches of the Rules or misuse of the Mark can lead to suspension or revocation. Decisions can be appealed within 21 days.
Where certification stops and other assurance begins
Certification is one layer of assurance and it is designed to stack with the others. This is how it fits alongside auditors, regulators and your own advisers.
Certification covers
Covered elsewhere
Certification coversYour business's responsible AI practices, assessed against the eight Australian AI Ethics Principles at a published tier, with an independent human review of your evidence.
Covered elsewhereConformance with ISO/IEC 42001, NIST AI RMF, the Voluntary AI Safety Standard or the EU AI Act is assessed by accredited auditors under those frameworks. Certification maps to them and stacks with them; it does not replace them.
Certification coversHow you govern AI: accountability, oversight roles, risk management, privacy and security practices, bias prevention, contestability and transparency, as declared and documented.
Covered elsewhereWhether a particular practice satisfies the Privacy Act, the Australian Consumer Law, anti-discrimination law or therapeutic goods regulation is a question for your legal or privacy adviser, and for the regulator concerned.
Certification coversThe organisation. Certification is granted to a business for its practices, the same way Australian Made is granted to a licensee rather than to a single product line.
Covered elsewhereIndividual AI products, models or systems. Product safety and performance sit with product regulators such as the TGA, and with your own testing and evaluation.
Certification coversWhat you tell us and show us: your answers, your policy, your governance framework, and a follow-up conversation where the assessor needs one.
Covered elsewhereTechnical testing of your systems. Accuracy, safety and bias are measured by your own evaluation or by a specialist tester. Where the questionnaire asks about audits, your answer is declared, not re-run by us.
Verifying a certification
Every certified business is listed on the public register with its tier, its questionnaire responses and a machine-verifiable credential. The free verification API returns status, tier and validity for any business by name, ABN, domain or certification ID.
Related documents
- Certification Rules, version 1.0 (PDF)
- Australia's AI Ethics Principles
- National AI Centre, Guidance for AI Adoption
- Independence and impartiality policy
- Using the certified mark
This page describes the Certification Rules, version 1.0, effective 10 October 2025, as applied by Responsible AI Australia (ABN 16 675 184 291). If the Rules and this page ever differ, the Rules prevail. Last reviewed 23 September 2026.