The Guidance for AI Adoption: what the six essential practices ask of your organisation

On 21 October 2025 the Department of Industry, Science and Resources published the Guidance for AI Adoption, developed by the National AI Centre. It updates the Voluntary AI Safety Standard released in September 2024, condensing that standard’s ten guardrails into six essential practices and extending them to organisations that develop AI as well as those that deploy it.

In December 2025, the National AI Plan confirmed that the Government would not proceed, at this time, with its earlier proposal for mandatory guardrails in high-risk settings. That makes this guidance more important, not less. In the absence of an AI-specific statute, it is the Government’s clearest description of what responsible AI use looks like, and it is the benchmark a regulator, a court or a board is likely to reach for when asking whether an organisation took reasonable care.

The guidance is voluntary. It does not change the law, and following it does not guarantee compliance with any law.

Two versions for different starting points

The guidance comes in two versions.

Foundations is written for organisations starting out with AI, including small businesses. It covers aligning AI use with business goals, setting up basic governance and managing risk.

Implementation practices is written for organisations scaling AI or managing more complex systems, and gives more detailed governance and technical direction. It breaks each practice into numbered sub-practices and tags some as applying to developers or deployers. A single organisation can be both: a business that fine-tunes a model or builds AI into its own product is acting as a developer for that system.

The National AI Centre has also published supporting tools, including an AI screening tool, an AI policy guide and template, an AI register template, and a set of terms and definitions.

For most mid-sized Australian organisations, Foundations is the place to start and Implementation practices is the reference for any use case that touches customers, employees or significant decisions.

The six essential practices

1. Decide who is accountable. Establish end-to-end accountability and AI governance. In practice this means naming a senior owner for AI governance, adopting an AI policy, and assigning a responsible person to each AI system. The implementation version adds supply chain accountabilities, AI literacy and training, and a documented governance framework. The test is simple: if an AI system produces a harmful outcome tomorrow, everyone should already know whose problem it is.

2. Understand impacts and plan accordingly. Ensure stakeholder rights and fair treatment. Identify who an AI system could affect, with particular attention to vulnerable groups, give people a way to raise concerns and seek redress, and watch for systemic issues over time. For a recruitment screening tool or a customer eligibility model, this is where the real exposure sits.

3. Measure and manage risks. Implement AI-specific risk management. Screen proposed uses for risk, assess and treat the risks of each use case, and monitor and report incidents. The implementation version expects a fit-for-purpose risk framework and points to existing reporting duties, such as the Notifiable Data Breaches scheme, where an AI incident involves personal information.

4. Share essential information. Ensure appropriate transparency and explainability. Keep an AI register, tell people when they are dealing with AI or AI-generated content, and be able to explain outcomes that affect them. The implementation version adds transparency through the supply chain, which in practice means knowing enough about a vendor’s model to answer your own customers’ questions.

5. Test and monitor. Ensure quality, reliability and protection through evaluation and monitoring. Test systems before deployment, monitor performance afterwards, test further where risk is higher, and extend data governance and cyber security controls to AI systems. Vendor assurances are an input to this practice, not a substitute for it.

6. Maintain human control. Integrate meaningful human oversight and control. Decide where a person must review or be able to override an AI output, train the people who do it, keep alternative processes for critical functions, and decommission systems when they are no longer appropriate. Oversight that consists of approving every recommendation without the time or information to question it is not meaningful.

How the practices connect to existing law

The guidance repeatedly points to obligations that already apply, regardless of whether an organisation adopts it. These include:

• Privacy. The Australian Privacy Principles govern the personal information that AI systems collect, infer and use. From 10 December 2026, APP 1 will also require privacy policies to describe certain automated decisions.
• Australian Consumer Law. The guidance refers to the prohibitions on misleading or deceptive conduct and unconscionable conduct, and to statutory guarantees, all of which can be engaged by AI-driven products, claims and customer interactions.
• Anti-discrimination law. The guidance notes that unfair treatment by an AI system can amount to unlawful discrimination in certain areas of public life, and refers to the Fair Work Act where outputs disproportionately affect people on the basis of a protected attribute.
• Directors’ duties. The guidance refers to directors’ duty of care and diligence, including assessing and governing non-financial risks such as those arising from AI and data.
• Work health and safety. It also flags work health and safety duties where AI creates physical or psychosocial risks for workers.

The guidance does not say that adopting the six practices satisfies any of these obligations, and organisations should not assume it does. A more defensible reading is that the practices are a practical way to generate the evidence of care that these laws already reward: documented decisions, assessed risks, informed people and working controls. Whether a particular use complies with a particular law is a question for your legal adviser.

Mapping to ISO/IEC 42001

ISO/IEC 42001:2023, published in December 2023 and adopted in Australia as AS ISO/IEC 42001:2023, is a management system standard for AI. The guidance names it as a key international standard it aligns with and refers readers to a separate crosswalk.

Organisations do not need ISO/IEC 42001 to follow the guidance. For those that already run, or are considering, a certified management system, the correspondence is broadly as follows:

• Practice 1 aligns with the leadership requirements, including the AI policy (clause 5.2), and with competence (clause 7.2).
• Practices 2 and 3 align with planning, in particular AI risk assessment, AI risk treatment and AI system impact assessment (clauses 6.1.2 to 6.1.4).
• Practice 4 aligns with the standard’s requirements for documented information and communication with interested parties, and with the AI-specific controls in Annex A.
• Practices 5 and 6 align with operation and performance evaluation, including monitoring and measurement (clause 9.1), internal audit (9.2) and management review (9.3).

This is an indicative mapping, not an official one. Its value is in letting one governance programme answer both the Australian guidance and an international standard that overseas customers increasingly ask about.

Where to begin

For a mid-sized organisation, the first useful step is rarely a policy document. It is an honest inventory: which AI systems are in use, including features switched on inside existing software, who owns each one, and which affect people in ways that matter. With that inventory, the six practices become a workable plan rather than a list of principles.

General information, not legal advice. The Guidance for AI Adoption is voluntary. Confirm how any legal obligation applies to your organisation with your legal adviser.