What is the Guidance for AI Adoption?
It is a set of six essential practices published by the National AI Centre, part of the Department of Industry, Science and Resources, to help Australian organisations use AI safely and responsibly. The practices work at two levels. Some cover the whole organisation, such as having an AI policy and an AI register. Others apply to each individual use, because the same tool can carry different risks depending on the task; the foundations version contrasts drafting marketing emails with assessing job applications. The guidance asks organisations to keep clear records of the actions they take under each practice to support audits, reviews and improvement.
How does it relate to the Voluntary AI Safety Standard?
The Voluntary AI Safety Standard was published on 5 September 2024 and set out 10 voluntary guardrails for organisations across the AI supply chain. The department's page for the standard now states that the Guidance for AI Adoption, published on 21 October 2025, is updated and simplified guidance for industry that evolves the standard. The six practices cover the same ground as the guardrails in fewer, plainer steps. If your policies or supplier questionnaires refer to the 10 guardrails, they remain useful, but map them to the six practices at your next review so your documents use the current framework.
Foundations or implementation guidance: which version fits?
The foundations version is written for teams that are starting to use AI, using it in low-risk ways, new to AI governance or wanting practical guidance in a business context. Each practice has getting-started actions and next steps. The implementation guidance is for teams that build or customise AI systems, use AI in more complex ways, manage higher-risk use cases or need stronger controls. It breaks each practice into numbered requirements, some marked as applying to developers. Most small and medium businesses using commercial tools can start with foundations and use the implementation guidance for specific higher-risk uses.
What are the six essential practices?
Each practice comes with a short explanation of why it matters and two sets of actions: getting started, then next steps as AI use grows. The getting-started actions from the foundations version are summarised below. The guidance says you do not need to do everything at once and should adapt each practice to your size, use cases and risk profile. The AICD's Director's Guide to AI Governance refers to the six practices collectively as AI6, a useful shorthand when reporting to a board.
- Decide who is accountable: assign a senior leader as the overall AI governance owner and create an AI policy.
- Understand impacts and plan accordingly: assess who your AI systems may affect and set up channels for people to report problems or challenge decisions.
- Measure and manage risks: create a risk screening process that flags uses needing extra attention or posing unacceptable risk.
- Share essential information: keep an AI register and disclose your use of AI, especially where it makes or influences decisions or could be mistaken for a person.
- Test and monitor: ask suppliers for proof of testing, test before deployment and monitor afterwards.
- Maintain human control: match oversight to the stakes and build points where people can pause, override, roll back or shut down a system.
Which templates come with the guidance?
The National AI Centre publishes free templates alongside the practices, and they are a sensible starting point before paying anyone to write governance documents. The screening questions have no scores or automatic outcomes; the Centre describes them as a quick first step that comes before a full risk assessment and does not replace it. Download the templates from the National AI Centre site and adapt the wording, roles and approval points to the way your business already works.
- AI policy guide and template: core principles, expected behaviours, roles, approval points and review guidance.
- AI register template, in Word and Excel: a table for each AI system, its use, its accountable person and its governance level.
- AI screening questions: seven questions to answer before you build a business case or commit money; a yes to any of them means the use may need stricter controls.
Is following it compulsory?
The guidance is not legislation, and it does not create a new legal duty on its own. The laws that already apply to your business still apply when AI is involved. The implementation guidance points to several of them: documenting how the Australian Privacy Principles apply to each AI use, meeting Notifiable Data Breaches reporting requirements and extending cyber security practices such as the Essential Eight to AI systems. Boards and larger customers may ask how your organisation lines up against the six practices, so keep a short record of what you have done under each one.
Where should a small business start?
Start with the actions that apply across the whole business, then work through individual uses, beginning with the ones that touch customers, staff or money. A practical order for an organisation mostly using commercial tools is below. Each step leaves a record, which is what the guidance asks for and what a reviewer will look for. If the screening questions flag a use, hold any expansion of it until the risk assessment and oversight steps are done.
- Name the senior person who owns AI governance.
- Adopt a short AI use policy based on the template.
- List current AI use in the register, including features built into software you already pay for.
- Run each listed use through the screening questions.
- Set human review and override points for any use that touches customers, staff decisions or money.
- Ask suppliers of higher-risk tools for evidence of testing, then set a review date.