The short answer
The Australian Government's Guidance for AI Adoption, known as AI6, asks every organisation using AI to do six things: decide who is accountable, understand the impacts, manage the risks, share essential information, test and monitor, and keep people in control. It is voluntary. But it is the reference point regulators, customers and auditors now use, and a business of 50 to 500 people can meet it with one named executive, a short policy, an AI register and a handful of habits.
On this page
Key takeaways
- AI6 is voluntary guidance, not law. It is still the yardstick customers, insurers and regulators hold you to.
- It covers AI you buy and switch on, not just AI you build.
- The AI register is the centre of it. Four of the six practices depend on knowing what you have.
- At 50 to 500 people the right size is one owner, two pages of policy and a quarterly review, not a department.
What is AI6?
The National AI Centre, part of the Department of Industry, Science and Resources, published the Guidance for AI Adoption in October 2025. It replaced the Voluntary AI Safety Standard, whose ten guardrails were folded into six essential practices. People call them AI6.
It comes in two versions. Foundations is a short document for organisations starting out or using AI in low-risk ways. Implementation Practices is a longer one with numbered requirements, for teams with mature governance, technical capability or high-risk uses. Both are free, and the centre publishes templates for an AI policy and an AI register alongside them.
The guidance is mapped to ISO/IEC 42001, the international AI management standard, and to the NIST AI Risk Management Framework. Work you do against AI6 counts towards both.
Do you have to follow it?
No. It is voluntary. Three things make it matter anyway.
- The Privacy Act. From 10 December 2026, businesses covered by the Act must explain in their privacy policy the decisions their software makes about people. You cannot disclose what you have not listed, and the AI register AI6 asks for is the list.
- Your customers. Procurement questionnaires now ask which AI governance framework you follow. AI6 is the Australian answer. ISO 42001 certification is the heavier one, and few mid-sized businesses need it.
- Your regulators. APRA expects regulated entities to understand the systems and service providers their operations depend on. ASIC has reviewed how licensees govern AI and found governance lagging behind adoption. Directors' duties already cover decisions made with AI.
What are the six practices, in plain English?
- Decide who is accountable. Name one senior leader who owns AI across the business. Write an AI policy. Give every AI system a named owner who understands what it does, and be clear about what your suppliers are responsible for and what you are.
- Understand impacts and plan accordingly. Before AI touches customers or staff, work out who it affects and how, with particular care for people who are vulnerable. Give people a way to question an outcome that AI shaped, or to report a problem.
- Measure and manage risks. Screen each use of AI for risk, put controls in proportion to it, and investigate when something goes wrong. A tool drafting internal notes and a model that scores loan applications do not need the same controls.
- Share essential information. Keep an AI register of every system. Tell people when AI makes or shapes a decision about them, or when content could be mistaken for a person’s work. Be honest about what the systems can and cannot do.
- Test and monitor. Test before go-live and keep watching after it. When you buy AI, ask the vendor for evidence of their testing. Extend your existing data governance and cyber security to cover AI.
- Maintain human control. Make sure a person can pause, override or switch a system off, that the people overseeing it are trained to, and that critical work can continue if it fails.
Each practice has a "getting started" level and a "next steps" level. The getting-started level is what this article covers. It is designed to be reachable by an organisation with no AI governance at all.
What is the minimum that works at 50 to 500 people?
You do not need a committee or a governance platform. You need eight things, and most of them fit on a page.
- One named executive. The CEO picks one person and writes it down. Which role matters less than the fact there is a name. IT runs the systems and legal advises, but this person answers for the outcomes.
- A two-page AI policy. What staff may use, what data may go into it, who approves a new tool, and what is not allowed. The National AI Centre publishes a template. Longer policies are read less.
- An AI register. Every tool and feature, its owner, the data it uses, the decisions it touches and its risk level. A spreadsheet is fine. Four of the six practices depend on this list existing.
- A five-question screen for anything new. Does it use personal information? Does it make or shape decisions about people? Can a person check its output? What happens when it is wrong? Who owns it? Answered in writing before it is switched on.
- A disclosure line. In your privacy policy, and wherever people interact with AI. From 10 December 2026 part of this is a legal duty under the Privacy Act, not just good practice.
- A test before go-live and a number after. Run new AI on real cases without letting it act, so you see what it would do. Once live, track one measure that shows whether it is working, and look at it.
- A human checkpoint where it matters. Anything that affects a customer, an employee or money gets a person who approves or can reverse it. Widen what the AI does alone only when the numbers say it is ready.
- A quarterly review. One hour. New tools found, vendors that switched AI on, incidents, and whether the policy still fits. New AI features arrive with every software update, so the register goes stale fast.
For the board
A director should be able to answer three questions. What AI do we use and who owns each system? Which of it touches personal information or decisions about people? What did we test before go-live, and what are we measuring now? If the executive team cannot answer them in a page, start there.
Where do you start?
- Find what you have. Ask every team lead what AI they and their people use, including free tools and features switched on inside software you already pay for. Expect to be surprised.
- Rank it by risk. Anything using personal information or shaping decisions about people goes to the top. That is where the Privacy Act and your customers will look first.
- Name the owner and write the policy. Two pages, approved by the leadership team, sent to every member of staff with a short explanation of why.
- Put the register in front of the board. Directors are being asked about AI. A one-page register with owners and risk levels is the answer they need.
- Run one process properly. Pick one high-value use, screen it, test it, give it a checkpoint and a number. It becomes the worked example for everything that follows.
How does AI6 relate to ISO 42001 and the Privacy Act?
They sit at three levels. The Privacy Act's automated decision rules are law, with a date. They require you to disclose the kinds of decisions your software makes about people and the kinds of personal information it uses. Our guide to what changes on 10 December covers the test and the steps.
AI6 is the practice layer. It is voluntary, but it is what the register, the policy and the checkpoints are built to, and it is how you show a customer or regulator that the disclosure sits on something real.
ISO/IEC 42001 is the certifiable layer. An accredited body audits your AI management system and issues a certificate. It suits businesses selling AI-driven products to enterprise or government buyers. For most mid-sized businesses it is a later step, if it is ever needed, and an AI6-shaped programme is the right foundation for it.
This article is general information, not legal advice.
Frequently asked questions
Is AI6 mandatory?
No. The Guidance for AI Adoption is voluntary guidance from the National AI Centre. But the Privacy Act's automated decision rules are law from 10 December 2026, and the AI register and disclosure that AI6 asks for are how you get ready for them. Customers, insurers and auditors also use AI6 as their reference point.
Does AI6 apply if we only use AI inside software we buy?
Yes. The guidance covers organisations that deploy AI as well as those that build it. Copilot in Microsoft 365, AI features in your CRM and scoring tools in your loan origination system all count. The vendor is responsible for how it was built. You are responsible for how you use it.
What goes in an AI register?
One row per AI tool or feature: what it is, who owns it, who uses it, what data goes in, what decisions it touches, its risk level, and when it was last reviewed. A spreadsheet is fine. The National AI Centre publishes a template.
Do we need ISO 42001 certification?
Usually not at 50 to 500 people, unless you sell AI-driven products to enterprise or government customers who ask for it. AI6 is aligned to ISO/IEC 42001, so an AI6-shaped programme is the first step if certification is ever needed.
How much time does AI governance take?
The first pass, finding what you have and writing the policy and register, is a few weeks of part-time work for one person. After that it is a short screen for each new tool and a quarterly review of about an hour.
Should IT own AI governance?
Someone must own it, and it matters less which role. The CEO names one executive and writes it down. IT runs the systems and legal advises on the rules, but the owner is accountable for the outcomes and answers the board.
Not sure where your AI governance stands?
In a free 30-minute session we start your AI register together. You keep it.
