Guidance for AI Adoption (AI6): AI governance in Australia.
What the current Australian standard is, the six practices that replaced the ten guardrails, what is and is not law, and what a business on Claude or ChatGPT should have on file. General information, not legal advice.
The short answer
Australia's current national guidance on AI governance is the Guidance for AI Adoption, published by the National AI Centre on 21 October 2025. It replaced the Voluntary AI Safety Standard's ten guardrails with six essential practices, often called AI6: decide who is accountable, understand impacts and plan accordingly, measure and manage risks, share essential information, test and monitor, and maintain human control. It is voluntary, comes in a Foundations edition and an Implementation practices edition aligned with ISO/IEC 42001 and the NIST AI RMF, and existing law such as the Privacy Act still applies in full.
The six practices of the Guidance for AI Adoption
Each practice is short to state and takes real work to show. The table sets out what each one asks, what we would expect a business to have on file to show it, and the ISO/IEC 42001 clause area it corresponds to.
| Practice | What it asks | What to have on file | ISO 42001 clause area |
|---|---|---|---|
| 1. Decide who is accountable | Name the people accountable for AI use overall and for each AI system. | A named owner per tool and agent, written into the AI register and the policy. | Clause 5, leadership and roles |
| 2. Understand impacts and plan accordingly | Work out who each AI use could affect, and how, before it goes live. | A short impact note per use: who is affected, what could go wrong for them. | Clause 6.1, including the AI system impact assessment |
| 3. Measure and manage risks | Identify, assess and treat the risks of each AI use. | An AI risk register with likelihood, impact, control, owner and review date. | Clauses 6.1 and 8, risk assessment and treatment |
| 4. Share essential information | Be open with staff, customers and others about where AI is used. | The policy shared with staff, and plain disclosure where customers meet AI. | Clause 7.4 and Annex A, communication and information for interested parties |
| 5. Test and monitor | Check AI systems work as intended before and after they go live. | Records of what the AI did, reviewed by the owner on a schedule. | Clause 9.1, monitoring and measurement |
| 6. Maintain human control | Keep people able to oversee, override and stop AI systems. | A list of what waits for a person, approvals recorded at the time, a tested off switch. | Clause 8 and Annex A, operation and use of AI systems |
The ISO 42001 column is our mapping, not an official crosswalk. The practice names are from the Guidance for AI Adoption on industry.gov.au; the descriptions and the evidence column are our plain-English reading of them.
What replaced the Voluntary AI Safety Standard
Many searches, policies and supplier questionnaires still name the Voluntary AI Safety Standard and its ten guardrails. That standard has been replaced, and the change is more than a renumbering.
Ten guardrails became six practices
The Voluntary AI Safety Standard (2024) set out ten guardrails. The Guidance for AI Adoption, published on 21 October 2025, replaced them with six essential practices, which is why you will see it called AI6.
Two editions instead of one
Foundations is written for organisations starting out. Implementation practices is written for governance and technical professionals, and is aligned with ISO/IEC 42001 and the NIST AI RMF.
Tools to do the work, not only principles
The package includes an AI screening tool, a policy guide and template, an AI register template and a glossary. A small team can start from those without buying anything.
Still voluntary
Nothing in the change made the guidance mandatory. It is the national reference point for good practice, not a law.
Is AI governance law in Australia?
For everyday business use, there is no AI-specific law yet. The Guidance for AI Adoption is voluntary. That does not mean AI use is unregulated, because the law that already applies to the work applies when AI does it.
The Privacy Act is the one most businesses meet first. Personal information pasted into an AI tool is still personal information, and privacy policy changes due in December 2026 require disclosure of automated decisions that significantly affect individuals. Consumer law, anti-discrimination law and sector rules apply in the same way: a misleading claim is misleading whether a person or a model wrote it.
On 15 July 2026 the Prime Minister announced an Office of AI in the Department of the Prime Minister and Cabinet to implement Australian Standards for AI, with legislation planned for early 2027. Reports say the standards target large data centres and frontier AI rather than everyday business use.
Government is the exception to “voluntary”. Commonwealth agencies follow the Digital Transformation Agency's Policy for the responsible use of AI in government, often searched as the DTA AI policy. It binds the agencies, not private businesses, but suppliers to agencies should expect questions shaped by it.
This page is general information, not legal advice. For a specific obligation, ask a lawyer.
How AI6 relates to ISO 42001 and the NIST AI RMF
The three describe the same ground. The Implementation practices edition of the Guidance for AI Adoption is aligned with ISO 42001 and the NIST AI RMF, so a register, a risk assessment or an approval record built for one counts for the others.
The difference is what you can prove. ISO/IEC 42001 is the only one of the three that an accredited body can certify, which is why it matters when a customer or tender asks for evidence rather than a statement. AI6 is the plain-English place to start; ISO 42001 is the management system you grow into when that proof is asked for (our page on ISO 42001 certification in Australia covers who can certify you and the path to audit). If a tender names the US framework, our comparison of ISO 42001 and the NIST AI RMF sets out where they differ.
Start this week: an AI6 checklist for an SME on Claude or ChatGPT
Seven steps that make a start on the accountability, risk, sharing and human control practices and put something on file for each. None needs a consultant.
Name one owner
One person accountable for AI use across the business, with the authority to approve or stop a tool. That is practice one done.
List every AI tool in use
Claude, ChatGPT, Copilot, the AI features inside your existing software, and anything bought on a credit card. Put an owner against each line.
Move work onto a plan you control
Work that touches customer or company data belongs on a business or team plan the organisation administers, not on personal accounts.
Write a one-page policy
Approved tools, what may and may not go in, and who reviews output before it is sent, posted or paid. Our template is a starting point.
Decide what waits for a person
List the actions AI may take on its own and the ones that need a human to approve them. Anything customer-facing or financial should wait.
Check your privacy policy
If AI helps make decisions that significantly affect people, the December 2026 privacy changes mean your privacy policy needs to say so.
Set a review date
Put a date in the calendar, three months out, to review the register, the policy and anything that went wrong. Then keep it.
For step four, our one-page AI policy template is free to copy. For step two, the worked AI risk register shows how to turn the list into practice three.
Where Sentry AI fits
We set it up on the AI you already use
Sentry AI sets up the register, the policy and the decision trail on your own Claude or ChatGPT workspace, so the evidence AI6 asks for builds as your team works rather than in a scramble before someone asks. We work with businesses in Australia and New Zealand.
We are not a certification body and not a law firm. Nothing on this page is legal advice, and our own ISO 42001 programme is underway, not complete.
More on AI governance
- The AI governance framework, in five parts
- A free one-page AI policy template
- AI risk management, with a worked risk register
- ISO 42001 explained, with the readiness checklist
- ISO 42001 certification in Australia: accredited bodies and the path to audit
- AI6, MBIE guidance and ISO 42001 mapped in one table
- Shadow AI: see which AI tools staff actually use
Frequently asked questions
What is the current AI governance standard in Australia?
The Guidance for AI Adoption, published by the National AI Centre in the Department of Industry, Science and Resources on 21 October 2025. It sets out six essential practices, often called AI6, and comes in two editions: Foundations for organisations starting out, and Implementation practices for governance and technical professionals. It is voluntary.
What replaced the Voluntary AI Safety Standard?
The Guidance for AI Adoption. It replaced the Voluntary AI Safety Standard's ten guardrails, published in 2024, with six essential practices. If a policy, tender response or supplier questionnaire still refers to the ten guardrails, it is worth updating it to the six practices.
What are the six AI6 practices?
Decide who is accountable; understand impacts and plan accordingly; measure and manage risks; share essential information; test and monitor; and maintain human control. Each practice has a Foundations version for organisations starting out and an Implementation practices version for governance and technical professionals.
Is AI governance a legal requirement in Australia?
There is no AI-specific law for everyday business use, and the Guidance for AI Adoption is voluntary. Existing law applies in full, especially the Privacy Act, and privacy policy changes due in December 2026 require disclosure of automated decisions that significantly affect individuals. In July 2026 the government announced an Office of AI to implement Australian Standards for AI, with legislation planned for early 2027; reports say the standards target large data centres and frontier AI rather than everyday business use. This is general information, not legal advice.
What AI policy do Australian government agencies follow?
Commonwealth agencies follow the Digital Transformation Agency's Policy for the responsible use of AI in government. It applies to the agencies themselves, not to private businesses, but if you sell to Commonwealth agencies it is worth reading, because it shapes the questions agency buyers ask about AI.
How does AI6 relate to ISO 42001 and the NIST AI RMF?
The Implementation practices edition of the Guidance for AI Adoption is aligned with ISO/IEC 42001 and the NIST AI RMF, so work done for one carries across. The difference is that ISO 42001 can be certified by an accredited body, while AI6 and the NIST AI RMF cannot. Many organisations use AI6 as the plain-English starting point and ISO 42001 as the structure they grow into when a customer asks for proof.
Does a small business need to follow AI6?
No business is required to, because it is voluntary. It is still the most useful checklist an Australian SME has, and the Foundations edition is written for organisations starting out. The package includes an AI screening tool, a policy guide and template, an AI register template and a glossary, so a small team can work through it without buying anything.
Can Sentry AI certify us against AI6 or ISO 42001?
No. AI6 has no certification, and ISO 42001 certificates are issued only by accredited certification bodies. Sentry AI is not a certification body or a law firm. We set up the register, the policy and the decision trail on your own Claude or ChatGPT workspace, which is the evidence either framework asks for.
Find out where your business stands against AI6
The free AI Readiness Check shows which AI tools are in use and where the gaps are. If they are real, a short call covers what setting up the register, the policy and the decision trail involves for a business your size.
Ask an AI about this page
Opens the assistant with this page loaded: read it, summarise it, cite it.