Updated 4 October 2026. Two things have moved since this story ran. First, the rulebook: Circular DCS-2024-04, described below, is now archived and replaced by Circular DCS-2026-02, issued 30 July 2026, which makes a new NSW AI Operational Policy mandatory, including adherence to Australia's AI Ethics Principles and use of the AI Assessment Framework. Second, the auditor has looked again. The Auditor-General's Internal controls and governance 2026 report, published 12 August 2026, examined 10 selected agencies with the highest AI use or potential benefit, a smaller sample than the 2025 count below, so the percentages are not directly comparable. All 10 use AI and half have an AI policy. Five had considered AI in their risk management, four in their IT policies and one in procurement; eight had training in place. Six of the 10 keep a register that captures all their AI use. The report finds governance is not keeping pace with the speed of adoption. We read the full report and set its findings against the new rules in All 10 NSW agencies the auditor examined use AI. The dedicated performance audit mentioned at the end of this story is listed among the 2026–27 performance audits in the Audit Work Plan 2026–2029.
If you sell AI to a NSW agency, work in one, or are a citizen whose services are increasingly delivered through one, the question that matters is not whether government uses AI. It does, at scale: 357 tools, piloted or fully implemented, across 21 of the 26 agencies that account for 95 per cent of the state's budgeted expenditure. The question is whether the scaffolding around those tools exists. The Auditor-General's answer, in chapter 7 of the Internal controls and governance 2025 report, is: mostly not yet.
The scorecard, straight from the audit
Source: NSW Auditor-General, Internal controls and governance 2025: Procurement and technology, chapter 7 governance table (percentage of AI-adopting agencies that considered each element). "Formal reporting" is the 29 per cent with policy or procedures for monitoring and reporting on AI use; the report notes a further figure, 52 per cent, for agencies that had done at least some reporting to senior management. Accessed 11 July 2026.
The report's own reading of the gap is direct: Only 38% of agencies have
established formal AI policies or embedded consideration of AI into existing
policies.
Some agencies told the audit they rely on the whole-of-government AI
Ethics Policy instead, and the report answers that squarely: in isolation, it is
unlikely to be sufficient
, because agency-level policy has to cover ownership and
scope, roles and responsibilities, and how and to whom to report misuse or
concerns.
Inventory is the other quiet finding. Fifteen of the 21 AI-adopting agencies
keep a centralised inventory of their AI tools; six do not, meaning they cannot
produce a consolidated list of the AI they run. And only 29 per cent of agencies
report having a strategy for AI at all, which the audit connects to its broader
point: AI has not yet been integrated as a strategic or operational tool
across
the sector.
The framework is mandatory. Compliance is close, not complete.
NSW is not governing AI from a blank page. Circular DCS-2024-04, in force since 1 July 2024, makes the state's five-principle AI Ethics Policy and the NSW AI Assessment Framework mandatory across an AI system's lifecycle, with projects over $5 million (or funded by the Digital Restart Fund) additionally registered with the Department of Customer Service under the Digital Assurance Framework.
Against that rulebook, the audit's sample found near-compliance with the letter and gaps in the ceremony: 13 of 15 relevant agencies with AI projects under $5 million had completed the assessment tool, but one of those had it approved without the required senior officer sign-off. All three agencies with projects above $5 million had completed and approved assessments; one had not registered its project with the Department of Customer Service as required. Small numbers, but they are exactly the checks the framework exists to make routine.
Since the audit's cut-off, the framework itself has moved: on 27 January 2026 the NSW Government relaunched the AI Assessment Framework in a modernised form, a 16-question structured initial assessment that generates a risk score and the list of mandatory assurance activities, with a deep-dive toolkit for higher-risk cases and, for the first time, explicit coverage of agentic AI. The relaunch answers one audit criticism, the old assessment's length and subjectivity, and answers none of the policy, inventory, reporting or procurement gaps, which sit with each agency rather than with the tool.
Why this matters beyond NSW
Every Australian government is deploying AI behind a framework that claims assurance; NSW is simply the first whose independent auditor has counted the gap between the framework and the floor. The count says adoption is running roughly two years ahead of governance: two thirds of agencies have assigned accountability and trained staff, one third have adjusted the risk and IT machinery, one in twenty has worked out how to buy AI properly, despite most of those 357 tools being procured rather than built. The Audit Office has a dedicated performance audit of AI governance scheduled for 2026-27. On these numbers, it will not be short of material.