NSW government AI assurance: the evidence pack to prepare before a pilot

1. Make the proposed pilot easy to understand

Start with a one-page brief. Describe the task, its current problems, who will use the system and who could be affected. Set out the proposed benefit, the trial boundary and what remains a human decision. Identify the owner who can answer questions and stop the trial.

Our recommendation: put a short evidence index beside the brief. For each item, record its owner, location, review date and any unresolved question. A reviewer should be able to find the relevant test result or data agreement without searching through a sales presentation.

2. Check which rules apply to your organisation

DCS-2026-02 replaces the previous NSW AI circular. The NSW AI Operational Policy replaces the AI Ethics Policy and is mandatory for NSW government sector agencies and statutory authorities and bodies. It recommends the national AI ethics principles and assessment framework for advisory entities, state-owned corporations and government subsidiaries. The policy is not mandatory for councils, universities or third-party suppliers.

Suppliers still face requirements through procurement, contracts and agency checks. The Commonwealth has its own AI policy, mandatory for non-corporate Commonwealth entities with specified exceptions. Do not substitute it for NSW requirements.

For this article, the practical starting point is your agency’s AI governance and procurement teams. Confirm the applicable process, who makes the decision and which evidence they need before scheduling a trial.

3. Use the current registration and assessment process

The AI Assessment Framework, or AIAF, helps agencies assess an AI use case and identify required safeguards. Under the new platform process, registration determines whether an assessment is required. During transition, agencies must continue the Excel assessment for all AI use cases until the platform is fully adopted.

The policy’s detailed guidance says routine use of approved tools with meaningful human oversight generally does not require registration. Follow your agency’s current process rather than deciding that a “pilot” is automatically exempt. If uncertain, start the registration process.

High- and critical-risk cases must be referred to the AI Review Committee. Assessment continues as the system and its use change. Record the advice, actions and agency decision together so the next reviewer can understand what was agreed.

4. Show where the data goes

Draw the journey from the source document to the AI provider, its output and the agency record. Include who can access each step, retention periods, deletion arrangements and whether customer data can be used for model training.

NSW privacy rules apply when generative AI handles personal or health information. The Information and Privacy Commission recommends a privacy impact assessment when agency use will handle personal information. Required assessments may also arise through the AIAF or agency rules. Most state and local agencies sit outside the federal Privacy Act, with exceptions; check the applicable regime.

For an initial experiment, consider whether synthetic examples or public documents can answer the question. Treat moving to real case files as a new decision, with the relevant reviews completed first.

5. Make supplier promises testable

Ask the supplier to identify the product, model, settings and services involved. Request evidence for claims about accuracy, data handling and security. Ask how the agency will learn about model changes and what happens if the service becomes unavailable.

Covered NSW ICT purchases must use the relevant ICT Purchasing Framework documents, subject to the direction’s exceptions. Updated Core& and MICTA/ICTA templates introduced AI clauses from 23 August 2025. Ask procurement to check the current documents and the route for your purchase.

NSW procurement guidance also addresses AI added to an existing contract. Build the agreed checks into the statement of work: what will be tested, who receives the results, how changes are reviewed and when operation can be suspended.

6. Test the work your team actually needs done

Consider a fictional assistant that drafts answers from published policy documents. Build a small set of representative questions, including ambiguous requests, missing information and contradictory documents. Have a subject expert define acceptable answers before running the tests.

Our recommended test record includes the question, source material, output, reviewer judgement and correction needed. Measure usefulness after human checking. A quick draft that takes longer to correct has not demonstrated a useful saving.

Decide what failure means in advance. For example, the assistant must flag missing evidence instead of inventing a policy. If the proposal changes to ranking real benefit applications, revisit the scope, data and consequences before proceeding. Do not assume the earlier trial’s assessment covers that different use.

7. Record the decision and plan the next review

Present the decision-maker with the brief, test results, unresolved risks, proposed controls and conditions for continuing. Record whether the outcome is proceed, revise or stop, together with the reasons and named owners of follow-up actions.

Agree who monitors results, how staff report problems and what triggers another review. Keep the evidence current when the data, model or purpose changes. DataXLR8 can help document the use case, build and test the pilot, and prepare evidence for your agency’s review.