The NSW AI Assessment Framework: A Supplier's Guide

What is the NSW AI Assessment Framework?

The NSW AI Assessment Framework (AIAF) is a mandatory, risk-based assessment that all NSW Government use of AI must apply. It is administered under Digital NSW and has been updated to address generative AI specifically.

The framework operationalises the NSW AI Ethics Principles — trust, transparency, customer benefit, fairness, privacy, and accountability — turning them from aspirations into a structured assessment every government AI system must pass. NSW also stood up a dedicated Office for Artificial Intelligence in September 2025 to drive safe, strategic AI adoption across government, signalling that this framework is central to how the state buys and builds AI, not a compliance afterthought.

Who does the AIAF apply to?

Directly, the AIAF binds NSW Government agencies: any agency deploying, building, or procuring AI must apply the framework to that use.

Indirectly — and this is the part that matters for suppliers — it reaches every vendor whose product or service puts AI in front of an agency. When an agency runs an AIAF assessment, it needs answers about the system's training data, model behaviour, human oversight points, monitoring, and records. Those answers come from the supplier. A mid-market vendor who can answer AIAF-shaped questions crisply walks into procurement with an advantage; one who cannot becomes the reason a deal stalls in assurance review.

What does an AIAF assessment involve?

An AIAF assessment is proportionate to risk: the higher the potential impact of the system, the deeper the scrutiny. In practice an assessment covers:

• Risk tiering — classifying the system by its potential impact on people, services, and rights
• Purpose and benefit — documenting what the system is for and the customer benefit it delivers
• Affected stakeholders — identifying who the system touches and how they are protected
• Human oversight — specifying where people review, approve, or can override the system
• Data governance and privacy — mapping what data the system uses and under what controls
• Monitoring and review — committing to an ongoing cadence, not a one-off sign-off

How should a mid-market supplier prepare?

You do not need an enterprise compliance team to be AIAF-ready. You need five things, documented and true:

1. Document your AI system's purpose, data flows, and model dependencies — what it does, what it reads, what it calls
2. Map your practices to the ten guardrails of the Voluntary AI Safety Standard — accountability through to stakeholder engagement
3. Designate accountable owners for each AI system, on both the business and technical side
4. Build audit trails and decision logs into the system from the start — retrofitted records rarely survive scrutiny
5. Align your management practices to AS ISO/IEC 42001:2023, the AI management system standard the Voluntary AI Safety Standard explicitly references

This is the checklist we build against on every engagement — our Responsible AI page shows the full practice mapping.

How does the AIAF relate to ISO 42001 and the Voluntary AI Safety Standard?

They are layers of the same stack, not competing regimes:

The AIAF is NSW's mandatory assessment process — it applies when AI touches NSW Government. The Voluntary AI Safety Standard is the Commonwealth's practical standard for any Australian organisation, structured as ten guardrails covering accountability, risk, data governance, testing, human control, transparency, contestability, supply-chain transparency, records, and stakeholder engagement. ISO/IEC 42001 is the certifiable international management-system standard that the Voluntary AI Safety Standard explicitly aligns with, adopted in Australia as AS ISO/IEC 42001:2023.

The practical implication: preparing well for one substantially prepares you for the others. A supplier whose delivery practice maps to the ten guardrails and aligns to ISO/IEC 42001 can answer an agency's AIAF questions with documents that already exist.