AI for public servants: Understanding the new AI Assessment Framework

Artificial intelligence (AI) is rapidly changing how NSW public servants work.

To ensure that AI use across government is safe and responsible, the Office for AI has released a new AI Assessment Framework (AIAF).  

The AIAF is the government’s mandated framework for assessing and governing the use of AI. It ensures there are appropriate controls in place for all AI use cases across NSW Government.

The new AIAF builds on the principles of the original framework and captures new AI capabilities, such as agentic AI. It also simplifies the user experience for agencies, making assessments easier and more accessible.

We sat down with Daniel Ward, Principal Advisor Enterprise AI Risk and Innovation in the Office for AI, to learn more about the new framework and how it works.

When is the AIAF used and why?

The AIAF gives agencies a consistent and transparent way to understand the risks and responsibilities that come with deploying AI. It also ensures that systems are lawful and aligned with NSW ethical principles.

Any AI use case from across NSW Government must use the framework to determine the risk level (low, medium or high) and what regulatory requirements are needed.

How does the new AIAF work?

We’ve designed the AIAF to be run across the whole life cycle, from the concept phase to deployment. When you’re starting to think about the idea, you can run the assessment. It only takes 15 minutes, and it will give you feedback on what you should be considering.

Why was the AIAF updated?

Agencies needed something faster and easier to use.  

The old AIAF was a one-size-fits-all assessment that would take upwards of 40 hours to complete. It also required a significant amount of subject matter expert input, which was a barrier for low-risk use cases.  

We also needed a less subjective method of assessment.  

The old framework asked agencies to self-assess the level of risk. In the new framework the risk assessment is all built in; we have scoring logic that does that for you. When you fill in the assessment questions, it will tell you whether the use case is low, medium or high risk.

What are the key changes in the new AIAF?

We’ve split the assessment into 2 parts. The first part is a structured assessment that identifies the intrinsic risk of an AI use case. This is based on the characteristics of the system itself, before mitigations are considered. The second part of the assessment is a deep-dive toolkit that is only used where higher-risk is identified.

The initial assessment is now just 16 questions, and they range across topics like level of autonomy, what data is used, and the type of decisions being influenced or generated by the AI tool.  

Based on these responses, the framework determines a targeted risk outcome that reflects the inherent risk profile of the use case. For lower risk uses, it clearly sets out the regulatory and policy requirements that apply. For more complex use cases, it goes into greater detail, identifies specific risks and outlines the controls required, including who needs to be involved to assess their effectiveness.

It’s all about proportionate assurance across different use cases.

What’s next?

This redesign sets the foundation for how we’re going to do responsible AI governance going forward.  

The new AIAF is all machine readable, and it has been created in a way that it can be systemised easily. That’s the next step for us; to take the framework out of Excel and systemise it, which will make it even easier to use. It will also make it easier for us to see different use cases, so we can highlight those and share best practice use cases from across government.

We also have several new modules that will be introduced to the framework. We will be building out more guidance on procurement and privacy, and we want to go deeper into balancing the cost of building AI use cases, and the benefits they return.