The Australian Government's Guidance for AI Adoption, published by the National AI Centre, sets out six essential practices: decide who is accountable, understand impacts and plan accordingly, measure and manage risks, share essential information, test and monitor, and maintain human control. The foundations version is written for organisations that are new to AI or using it in lower-risk ways. More mature organisations, and high-risk uses, should work from the implementation guidance.

The six practices and what they mean on a Monday morning

1. Decide who is accountable. Name one senior person who owns AI governance. Not a committee, a person. Most organisations we speak to have AI in use across several teams, and nobody who could tell you all of it.
2. Understand impacts and plan accordingly. Before a system goes live, ask who it affects and how things could go wrong for them. Set up a way for people to raise concerns or complaints.
3. Measure and manage risks. Screen each AI use for risk, so a meeting-notes assistant and an eligibility-scoring model don't get the same level of scrutiny. Spend governance effort where the risk is.
4. Share essential information. Keep an AI register, and tell people when AI is part of how you interact with them. From 10 December 2026, this overlaps with the new Privacy Act transparency obligation for automated decisions.
5. Test and monitor. Check a system works before deployment, and keep watching once it's live. AI behaviour can drift as data, prompts and vendor models change.
6. Maintain human control. Make sure people can step in, pause or override an AI system, and know when they should. For AI agents that take actions, this includes being able to switch them off.

Where to start this month

If you only do three things: name your accountable owner, start an AI register (a spreadsheet is fine), and screen what's already in use by risk. Everything else builds on those.

FAQ

Is this guidance mandatory? It's guidance, not legislation. But it lines up with existing obligations, including the Privacy Act changes starting 10 December 2026, so it's a practical way to get ready.

We use Microsoft 365 Copilot. Does this apply? Yes. Copilot is an AI system in use in your organisation, so it belongs on your register and needs an owner.

What's the difference between the foundations and implementation guidance? Foundations is for organisations starting out or using AI in low-risk ways. Implementation guidance is for those with mature governance or higher-risk use cases.

"

Starting your AI register or unsure who should own AI governance? Our AI Readiness Assessment is a structured way to begin.

"

About the author: Timotius Devin is AI Lead at PerData Technology Partners in Melbourne. At PerData he helps Australian organisations design, govern and deploy AI on the Microsoft platform.

Sources

1. National AI Centre, Guidance for AI adoption: foundations: https://www.ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-foundations
2. National AI Centre, Guidance for AI adoption: implementation guidance: https://www.ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-implementation-guidance