NSW AI Assessment Framework — A Mandatory 16-Question Risk Gate for Every State AI System, and What the Auditor Found

The NSW AI Assessment Framework (AIAF) evolved from the 2022 NSW AI Assurance Framework. Under Circular DCS-2024-04 it is mandatory, alongside the AI Ethics Policy, for all NSW Government use of AI across the system lifecycle.
Agencies complete 16 assessment questions, identify risks and mitigations, and must submit high- or critical-risk systems (or those with high residual risk) to the NSW AI Review Committee via the AI Secretariat. Projects above A$5 million, or funded from the Digital Restart Fund, receive additional central oversight through the Digital Assurance Framework.
The Audit Office of NSW examined 10 agencies with significant AI use in its report 'Internal controls and governance 2026' (17 August 2026). All 10 kept an AI register, but only 4 recorded formally assessed AI systems. Of 15 AI projects reviewed, 13 had been assessed under the framework and 4 lacked a cyber risk assessment. Only half of the agencies had an AI strategy or agency-level AI policy, and just one considered AI in procurement documents. Transport for NSW's seatbelt-enforcement system, where three human reviewers approve every potential infringement, was cited as good practice.
The Auditor recommends that agencies assess all required AI solutions against the framework by 30 June 2027. Lesson: a mandatory gate produces assessments, but registers, strategy and cost tracking lag without follow-through.

Read the full analysis: https://www.digital.nsw.gov.au/policy/artificial-intelligence/ai-governance-assurance-and-frameworks/nsw-ai-assessment-framework