Start by checking which law, supervisory expectation, proposal, or guidance applies to your organization. The table identifies each instrument, its status, and who it addresses. The contribution section then explains what AAES Govern records can help a reviewer examine.
These pages describe the product and cite public instruments. They are not legal advice, not a certification, and not a statement that any instrument applies to your organization. The official source is authoritative; applicability questions belong to your advisers.
Instruments, by status
| Instrument | Status | What it addresses |
|---|---|---|
| Guidance for AI Adoption (six essential practices) · National AI Centre, DISR | Voluntary guidance. Released 21 October 2025. The PDFs on ai.gov.au were posted on 5 May 2026 and re-uploaded in July 2026, and both versions are still dated October 2025, so neither upload is a new edition. Evolves the 2024 Voluntary AI Safety Standard; creates no legal duty. | Any organization adopting AI. The six practices (referenced below as AI6): decide who is accountable, understand impacts, measure and manage risks, share essential information, test and monitor, maintain human control. Action-layer records can support review of practices 1 and 6. |
| National AI Plan and Australian Standards for AI consultation (September 2026) · Australian Government | Policy, not law. The National AI Plan (December 2025) kept existing laws and sector regulators as the foundation and did not proceed with the September 2024 mandatory-guardrails proposals paper, which is a closed consultation document, not law and not a progressing legislative regime. The Government announced an AI infrastructure framework on 15 July 2026 and published a consultation paper in September 2026 on standards for large data centers and advanced AI development. These proposals are consultation-stage policy, with legislation targeted for early 2027; they are not current duties. | Economy-wide direction. Nothing in it creates an obligation for organizations using AI today. |
| Privacy and Other Legislation Amendment Act 2024 · automated-decision transparency | Binding law, not yet commenced. The APP 1 transparency duty commences 10 December 2026. | Privacy policies must disclose the kinds of personal information used in, and the kinds of, decisions made by computer programs where the decision is reasonably expected to significantly affect an individual's rights or interests, including programs doing things substantially and directly related to making the decision, not only solely automated ones. |
| CPS 230 and CPS 234 · APRA | Binding prudential standards for APRA-regulated entities. CPS 230 (operational risk) first applied on 1 July 2025; targeted amendments apply from 1 July 2026. Pre-existing service-provider arrangements transitioned by 1 July 2026, earlier where an arrangement was renewed before then. CPS 234 (information security) has applied since 1 July 2019. | Operational risk, service-provider oversight and controls that cover AI and agent deployments inside regulated entities. The regulated entity answers to APRA; using AAES does not transfer that responsibility. |
| Letter to Industry on artificial intelligence · APRA | Supervisory letter to all APRA-regulated entities, 30 April 2026. | APRA asks boards and accountable executives to strengthen AI governance, security, supplier oversight and assurance as AI adoption grows. |
What AAES Govern records may contribute
| Expectation | AAES contribution | Capability status |
|---|---|---|
| Decide who is accountable (AI6 practice 1) | Each registered agent has an accountable manager whose chain of managers ends at a person. AAES Govern records the approver for human approval decisions; those assignments do not establish statutory appointments. | Implemented. |
| Maintain human control (AI6 practice 6) | Capabilities registered as irreversible require human approval bound to the exact request, with expiry. The operator classifies the action and must ensure reviewers have the information and authority to decide. | Implemented. |
| Records an internal audit or APRA review can inspect (AI6 practices 3 and 5; CPS 230 / CPS 234 evidence) | Decision records are linked by cryptographic fingerprints to help detect changes. The client's own reviewer can check an export offline. | Implemented. An independently controlled witness can be configured separately; that is not an external assessment, and the default deployment has none. |
AAES Govern decision records may support review of access and approval controls. They do not establish lawful processing, model fairness, suitability, or compliance with any instrument as a whole.
Export checks do not establish complete capture, downstream success, or meaningful human oversight. Enforcement requires a credential path the agent cannot bypass. See the verification checks and their limits.
Your responsibilities
- The client remains the regulated entity. Ask your advisers whether and how CPS 230, the Privacy Act duty from December 2026, or any other instrument applies to you.
- Activity outside AAES Govern is visible only where telemetry is supplied. Decision records cover routed requests; reported telemetry may describe other activity without establishing complete coverage.
- AAES has no independent certification or assessment. No SOC 2 report exists, and no penetration test has been performed yet; an independent test is planned for Q4 2026.
- Status changes. The announced Australian Standards for AI may be introduced after this note's review date. Re-check the primary source before relying on the status shown here.
Bring the instruments your risk team cites to a scoped evaluation.