Australia’s AI policy exempts the whole defence portfolio, which is how veterans’ affairs ended up outside it

The one thing the public can check

We have been through this policy twice: which of the Commonwealth’s AI instruments actually bind, and what the binding one requires. Of its eight mandatory requirements, seven produce artefacts that live inside an agency. The eighth does not. Every in-scope agency must publish an AI transparency statement on its public website, follow a common standard for what goes in it, and review it at least once a year.

That makes it the only requirement whose compliance is visible from outside government, and the Digital Transformation Agency publishes a central index of the statements. So we did the obvious thing nobody appears to have done: take the index, take the authoritative register of Commonwealth entities, and see whether they agree.

They agree, to the entity

The Department of Finance publishes the List of Commonwealth Entities and Companies, updated 1 July 2026. It records 197 bodies, of which 106 are non-corporate Commonwealth entities, the population the AI policy names. The DTA index, last updated 23 June 2026, carries 95 mandatory statements and a further 21 it labels voluntary.

Eleven non-corporate entities therefore have no mandatory statement. We matched the two lists name by name and then read the policy’s scope section, and every one of the eleven is accounted for.

Entity names, portfolios and entity type from the Finance list as at 1 July 2026. The carve-out column is our reading of the policy’s scope section against that list, quoted below.

Ten carve-outs plus one calendar. 106 minus 11 is 95, which is the number of mandatory statements on the index. The DTA’s list is complete. That is worth saying plainly, because a reconciliation that balances is a finding, and the assumption running through most commentary on Australian government AI is that the paperwork is patchy. On this requirement it is not.

The carve-out, in the policy’s own words

The policy states that it does not apply to the use of AI in the defence portfolio or to the ‘national intelligence community’ (NIC) as defined by Section 4 of the Office of National Intelligence Act 2018, and lists the NIC members. It adds that Defence and members of the NIC may voluntarily adopt elements of this policy where they are able to do so without compromising national security capabilities or interests.

Read the first line again. It is not written as an exemption for secret work. It is written as an exemption for a portfolio. Everything administered under the Defence portfolio falls outside, whatever it does.

The Finance register makes the consequence concrete. The Defence portfolio contains six non-corporate entities, and they are not all what the phrase national security suggests. The Australian Naval Nuclear Power Safety Regulator is a safety regulator. The Defence and Veterans’ Service Commission works on suicide prevention among serving and ex-serving personnel. And the Department of Veterans’ Affairs, a Material entity on the Finance list, administers compensation, health care and income support for veterans and their families. Finance records its portfolio as Veterans’ Affairs (part of the Defence Portfolio), and that parenthesis is the whole mechanism.

By contrast, the intelligence carve-out is surgical

The same paragraph treats four other bodies completely differently. The policy carves out only the intelligence role and functions of the Australian Transaction Reports and Analysis Centre (AUSTRAC), Australian Federal Police (AFP), the Department of Home Affairs and the Department of Defence.

So for AUSTRAC, the AFP and Home Affairs the exemption attaches to a function, and everything else they do stays inside the policy. That is visible in the index: all three carry a mandatory transparency statement. An agency that runs facial recognition, risk scoring or triage outside its intelligence function is covered, and has to say so in public.

Two carve-outs, two drafting choices, in adjacent bullet points. One asks what an agency is doing. The other asks which minister it reports to. The second is much easier to administer and much harder to justify to a veteran waiting on a claim.

Three carved-out bodies published anyway

The policy invites voluntary adoption, and three entities the Finance register classes as non-corporate, all of them carved out, appear in the index’s voluntary section: the Department of Veterans’ Affairs, the Defence and Veterans’ Service Commission, and ASIO.

That deserves more attention than the carve-out does. The department the drafting exempts has published a statement regardless, which is the strongest available evidence that the exemption is not load-bearing for an agency like this one. And ASIO, the body with the best claim to the exemption, has published one too.

The voluntary section holds 21 entries in total. The other 18 are corporate Commonwealth entities or Commonwealth companies, which the policy does not reach because they are legally separate from the Commonwealth. Several are household names: CSIRO, Comcare, the National Library, Australian Maritime Safety Authority, Food Standards Australia New Zealand. Their statements exist because they chose to write them.

What we checked about the index itself

While we had the list, we tested it. All 116 links resolve. None is a dead end, one has quietly moved and still redirects correctly, and two statements are published as PDFs rather than web pages.

Four hosts refused our automated reader, including through a real browser: the Bureau of Meteorology, which returns an explicit notice that it does not support web scraping, the Department of the Prime Minister and Cabinet, the Australian Competition and Consumer Commission and the Australian Centre for International Agricultural Research. That is a fact about us rather than about them, and we say so rather than counting four working links as broken, which is what a less careful check would have reported. A person with a browser is not blocked in the same way.

The index page says it was last updated on 23 June 2026 and that the DTA will periodically ensure that links are correct. On the evidence of this check, it does.

Where the public’s view of government AI stops

This is a policy, not a law, and its enforcement is internal. But the transparency statement is the one place it faces outward, and the boundary of that outward face is now measurable: 95 of the Commonwealth’s 106 core entities have to tell the public how they use AI, and ten do not because of the portfolio they sit in.

For most of the ten that is uncontroversial. For a department administering veterans’ compensation it is a consequence of drafting rather than a decision anyone appears to have argued for, and the department’s own response to it has been to publish anyway. The cheapest fix available to the policy’s authors is the one they have already drafted once, two bullet points further down: carve out the function, not the portfolio.

The twelfth name to watch is the National Environmental Protection Agency, which began operating on 1 July 2026, eight days after the index was last updated. It is a non-corporate entity in a portfolio with no carve-out, so a mandatory statement is coming. When it appears, the reconciliation above should read 107 and 96.

Sources

1. Digital Transformation Agency, Policy for the responsible use of AI in government, version 2.0 (pdf, downloaded and read 30 September 2026). The National security carveouts section on page 6: that the policy does not apply to the use of AI in the defence portfolio or to the national intelligence community as defined by section 4 of the Office of National Intelligence Act 2018; the list of NIC members; the limitation of the AUSTRAC, AFP, Home Affairs and Defence carve-out to their intelligence role and functions; and the statement that Defence and NIC members may voluntarily adopt elements of the policy.
2. Digital Transformation Agency, Australian Government AI transparency statements (read 30 September 2026). The central index: 95 mandatory statements by non-corporate Commonwealth entities organised by portfolio and 21 voluntary statements; that statements are published by agencies on their own sites and the DTA maintains the links as a central reference; that the page was last updated on 23 June 2026; that the DTA will periodically ensure links are correct; and that the DTA does not validate or endorse individual statements. Every link on the page was followed on 30 September 2026.
3. Department of Finance, List of Commonwealth Entities and Companies, 1 July 2026 (xlsx, downloaded and read 30 September 2026). 197 bodies in total; 106 classified as non-corporate Commonwealth entities, 74 corporate and 17 Commonwealth companies; and the portfolio and materiality recorded against each entity named above, including the Veterans' Affairs portfolio being recorded as part of the Defence Portfolio.
4. Department of Finance, PGPA Act Flipchart and List (read 30 September 2026). That the Flipchart and List cover all non-corporate and corporate Commonwealth entities and companies subject to the PGPA Act, and the Table of Changes recording the National Environmental Protection Agency as a new non-corporate Commonwealth entity established on 1 July 2026 by the National Environmental Protection Agency Act 2025.
5. Digital Transformation Agency, Standard for AI transparency statements (read 30 September 2026). That agencies must publish a statement on their public facing website, the seven minimum contents including when the statement was most recently updated, and that statements must be reviewed at least once a year.
6. Digital Transformation Agency, Policy for the responsible use of AI in government (read 30 September 2026). That version 2.0 is effective 15 December 2025, that version 1.1 took effect 1 September 2024, that the policy applies to all non-corporate Commonwealth entities with some exceptions, and the eight mandatory requirement areas.

Spotted an error? Tell us and we will check it against the sources above and publish the outcome.