NSW AI Operational Policy the binding NSW instrument behind the assessment framework

Why it matters for NETEVO

This is the first Australian instrument that takes an AI ethics framework, makes it mandatory, and then requires an organisation to attest to it in writing every year. For any organisation operating in or supplying the NSW Government, it is the binding statement of what AI governance now has to look like.

The four-part NSW framework, and where this policy sits in it. Circular DCS-2026-02 sets out four instruments: the AI Strategy sets the direction; the NSW AI Operational Policy sets the mandatory requirements; the AI Review Committee advises on use cases assessed as inherently high or critical risk; and the NSW AI Assessment Framework supplies the step-by-step risk-assessment process. This policy is the limb that states the obligations. Coverage extends across departments, executive agencies, public financial and non-financial corporations, separate agencies, state owned corporations, statutory authorities and bodies, government subsidiaries incorporated under the Corporations Act, and advisory entities including boards and committees.

What agencies must do. The circular enumerates eight mandatory requirements: adhere to Australia's AI Ethics Principles across design, development, deployment and use; appoint an Accountable Official to oversee implementation and coordinate with the NSW Office for AI; establish governance and assurance of AI using existing functions where possible; register every AI use case in the AI Assessment Framework Platform and maintain accurate records through the system lifecycle; apply the assessment framework where registration determines an assessment is required; refer high-risk and critical-risk use cases to the AI Review Committee for advice on risk mitigation; align agency ICT acceptable-use policies to the policy's acceptable-use principles; and make AI literacy and policy training available to relevant employees. Separately, agencies must provide a signed annual attestation for the previous financial year to the NSW Office for AI by 31 October each year, with the first attestation due by 31 October 2027.

The attestation is the part that changes how governance has to be built. A signed annual declaration covering a mandatory register of every AI use case, with a fixed calendar deadline, is not a document that can sensibly be assembled by hand each October. The evidence chain runs from registration, through assessment and any committee referral, to a named signature — and every link in that chain is a record a well-built system can emit as a by-product of operating, rather than a document someone reconstructs after the fact. That is the distance the Law-to-Code Methodology exists to close: obligations delivered as executable, evidence-emitting controls instead of a policy binder.

A registration gate, and a platform still being rolled out. Registration is now the entry point: the platform decides from the registration answers whether a full assessment is required, so the framework is no longer triggered by an agency's own judgement about materiality alone. The AI Assessment Framework Platform is being deployed by the NSW Office for AI and is not yet fully adopted; during the transition, agencies must continue applying the existing Excel-based assessment process to all AI use cases. Assessments must be revisited across the system lifecycle and whenever changes to risk, context or functionality could affect outcomes or oversight.

NETEVO encodes obligations identified by counsel or compliance into executable controls. It states what an instrument requires; it does not interpret that instrument against any particular organisation's facts.