The Commonwealth’s AI policy now sorts government AI into seven kinds, not four. The DTA’s assessment tool still offers the old four

What changed, and what did not

The policy is the one mandatory Commonwealth instrument on AI use: it binds all non-corporate Commonwealth entities, with some exceptions, and sets eight requirement areas, from accountable officials to impact assessments. Version 2.1 says it took effect on 15 December 2025 as version 2.0, with minor updates published on 21 October 2026 (v2.1).

We compared the new 26-page PDF word by word against the 22-page version 2.0 we saved on 7 October. Outside the cover, copyright year, contents page and that one sentence on page 6, the first 22 pages are identical. Every mandatory requirement, recommended action and timeframe reads as it did. The four added pages are Appendix D, the Classification system for AI use. The two supporting standards were reissued as version 2.1, their downloads marked last updated 20 October, and the only change in each is that they now point to Appendix D.

So the label is accurate in one sense. An agency’s obligations are the same as they were on 20 October. What changed is the vocabulary every agency must use to tell the Commonwealth, and the public, what its AI does.

Four patterns become seven

The classification is not new in itself. Since December 2025 it sat as Attachment A of the Standard for AI transparency statements, and the DTA ran a page carrying it, headed Version 2.0, with four usage patterns and six domains. Appendix D replaces it.

Old column from the DTA’s Classification system for AI use, version 2.0, as archived on 25 September 2026; new column from the Policy for the responsible use of AI in government, version 2.1, Appendix D, pages 23 to 25. The six domains (service delivery; compliance and fraud detection; law enforcement, intelligence and security; policy and legal; scientific; corporate and enabling) keep their names, with rewritten descriptions and new example lists.

The three new patterns cover much of what generative AI does in offices. Strategic support takes in Policy drafting, briefing preparation, legislative analysis and consultation analysis. Coding runs from generating first-draft code to reviewing code for accessibility or security issues. Workflow automation Executes or coordinates predefined processes, tasks or actions with limited discretion, such as routing requests and updating records.

Under the old scheme, drafting and workflow tools sat under one label, and coding had none: at least two agencies filed code work under analytics. Workplace productivity was described as tools that Automates routine tasks, manage workflows, and facilitate communication, with content creation among its examples. The new version confines it to routine work without materially changing business processes or administrative outcomes. A chatbot that drafts a minister’s brief and one that books meetings no longer share a label.

The definition that matters most: decision-making

The category the public has most reason to watch was rewritten, not just renamed. Version 2.0 defined it by mechanism: AI used to support a decision by guiding, assessing or making a recommendation to a human decision maker, or to make decisions or take administrative action without human intervention. Its examples were eligibility systems and recommendations on applications.

Uses AI to make, or substantially and directly inform, a decision or administrative action that could affect the rights or interests of an individual or entity. This includes refusing or failing to take such an action.

Policy for the responsible use of AI in government, version 2.1, Appendix D, page 23

Version 2.1 defines it by effect on the person, and its example list is longer: it now includes risk scoring, prioritisation recommendations, case triage and recommended enforcement actions. In the old scheme, risk detection systems were the example given for analytics. An agency that scores or triages cases has a clearer instruction to call that decision-making. Analytics still lists risk analysis, so the line is whether the score feeds a decision about someone.

The wording will be familiar to anyone following privacy law. From 10 December 2026, the Privacy Act’s automated decision transparency rule applies where a computer program is used to make, or do a thing substantially and directly related to making a decision that could reasonably be expected to significantly affect the rights or interests of an individual, and the OAIC’s fact sheet says a decision includes failing or refusing to do something. The two tests are not the same: the Act adds a significance threshold and a personal information limb, and Appendix D does not mention the Privacy Act. But the policy now describes government decision-making in language close to the law agencies will report under from December.

Where agencies must use it, and the tool that lags

Appendix D says agencies are required to classify their AI use by these usage patterns and domains in three places: their internal use case register, when assessing a use case with the AI impact assessment tool, and in their public AI transparency statement.

The register and the statement standards were updated to match. The tool was not. The impact assessment tool on the DTA’s download page on 23 October is the same file we saved on 7 October, byte for byte, and the download is marked last updated 1 December 2025. Its usage pattern question still offers four tick boxes: Analytics for insights among them, and no box for coding, workflow automation or strategic support. An officer following the policy on 23 October would be told to classify by seven patterns using a form that offers four. Version 2.1 was two days old on 23 October, and a revised tool may be on the way; the tool page does not say.

Agencies may instead use an internal process that integrates all provisions of the impact assessment tool (policy, page 14), and must be able to revise it in response to any impact assessment tool updates (page 15). So the tool’s four boxes set the template even for agencies that do not fill in the DTA’s form.

The public statements used the old labels too. Of the 116 AI transparency statements we saved on 30 September, 45 contained the phrase “Analytics for insights”, a label Appendix D no longer uses. Version 2.1 sets no date by which agencies must reclassify. The transparency standard’s general rule applies: statements must be reviewed at least once a year and when any new factor materially impacts the existing statement’s accuracy. Whether a new classification is such a factor is left to each agency.

One small drafting slip: the transparency standard’s PDF points agencies to Attachment D of the Policy for the responsible use of AI in government. The policy calls it Appendix D, and the standard’s web page says Appendix D.

What version 2.1 still does not do

When the AI Review Committee’s first meeting was announced on 7 October, we noted that the APS AI Plan’s first stage for the committee included a step to amend policy and AI impact tool to reflect new high-risk use case workflow, and that version 2.0 did not mention the committee. Version 2.1 is the first revision since, and the plan set mid 2026 for that stage. The 26-page PDF does not contain the word “committee”, and the tool is unchanged. How a high-risk case reaches the committee is still set out in the committee’s own terms of reference, not in the policy that binds agencies.

Our view

The new classification is better than the one it replaces. Four patterns could not tell a reader whether an agency’s AI was drafting Cabinet briefs, writing software or triaging welfare claims, and those are different risks. Defining decision-making by its effect on people, and naming risk scoring and case triage as examples, puts the attention where it belongs. If agencies apply it honestly, the next round of transparency statements should say more than the last.

“Minor” undersells it. No obligation changed, but every agency’s register, assessment and public statement is now written in a different vocabulary, and the series breaks: a statement that says “Analytics for insights” cannot be compared cleanly with one written to Appendix D. The DTA should have shipped the tool with the policy, set a date by which statements move to the new labels, and said plainly what changed. On 23 October the policy page said only that v2.1 made “minor updates”, without listing them, and the DTA’s news had no item on it. Agencies reading version 2.1 have to find the difference themselves, which is what we did.

What to watch

• A revised AI impact assessment tool with seven usage patterns. Until then the policy and its main form disagree.
• Transparency statements moving to the new labels. Each must be reviewed at least annually; nothing requires the change sooner.
• A policy version that names the AI Review Committee and the high-risk workflow the APS AI Plan promised.
• 10 December 2026, when the Privacy Act automated decision transparency obligation starts and agencies, like other APP entities, must describe in their privacy policies the automated decisions that meet the Act’s test.

Sources

Method note. Written substantially by AI and run by people, working from the 10 primary sources below. 25 quotes here were verified by script against copies of the sources we archived. How AI Geek works.

1. Digital Transformation Agency, Policy for the responsible use of AI in government, version 2.1, 26 pages (PDF read in full 23 October 2026): page 6 (v2.0 in effect 15 December 2025, minor updates published 21 October 2026); pages 14 and 15 (the internal-process alternative to the tool); pages 23 to 26 (Appendix D, the usage patterns, domains and where agencies must use them).
2. Digital Transformation Agency, Policy for the responsible use of AI in government, web page (read 23 October 2026): the same effect and update dates; its PDF download marked last updated 22 October 2026.
3. Digital Transformation Agency, Appendix D: Classification system for AI use, web page (read in full 23 October 2026): the requirement to classify in three places; the definitions and examples quoted.
4. Digital Transformation Agency, Policy for the responsible use of AI in government, version 2.0, 22 pages: formerly at digital.gov.au under /sites/default/files/documents/2025-12/, which returned a not-found page on 23 October 2026; compared against our copy saved 7 October 2026.
5. Digital Transformation Agency, Classification system for AI use, version 2.0, Internet Archive copy of 25 September 2026 (read 23 October 2026): the four usage patterns, six domains and their descriptions; the statement that the content is Attachment A of the Standard for AI transparency statements v2.0, published 1 December 2025. The original address now redirects to Appendix D.
6. Digital Transformation Agency, Standard for AI transparency statements, version 2.1, 6 pages (PDF read in full 23 October 2026): page 4 (classification by Attachment D of the policy; the review triggers). On its web page the PDF download is marked last updated 20 October 2026.
7. Digital Transformation Agency, Standard for accountability, version 2.1, 9 pages (PDF read in full 23 October 2026): page 9 (register fields for domain and usage pattern, now pointing to Appendix D). On its web page the PDF download is marked last updated 20 October 2026.
8. Digital Transformation Agency, AI impact assessment tool, its downloads marked last updated 1 December 2025, with the tool DOCX (downloaded 23 October 2026; identical by hash to our 7 October copy): the four usage pattern tick boxes.
9. Digital Transformation Agency, AI Plan for the Australian Public Service 2025, Appendix A: Plan deliverables (read 7 October 2026): the AI Review Committee row and its step to amend the policy and tool.
10. Office of the Australian Information Commissioner, APP 1.7 to 1.9 Transparency Obligation Fact Sheet, September 2026 (read 17 October 2026): the three limbs of the test and that a decision includes failing or refusing to do something.

Work with the impact assessment tool or an agency’s AI register, or read Appendix D differently? Tell us and we will check it against the documents and log the outcome here.