On this page:
When is AI use considered in scope?
AI use is in scope under the Third-Party AI Assessment Framework if it supports or enables service delivery under a departmental contract, agreement or deed, these could include situations where the AI:
- Uses data obtained through service delivery arrangements — including personal, sensitive or other non-public departmental information, whether sourced from departmental systems or directly from participants
- May affect individuals (e.g. jobseekers, employers) receiving services
- Could result in more than insignificant harm to individuals or to the department’s reputation if misused (e.g. through privacy breaches or incorrect decisions)
What does ‘delivering services on behalf of the department’ mean?
Delivering services on behalf of the department refers to any activity undertaken by a third-party organisation under a formal contract, agreement or deed with the department, where the activity contributes to the delivery of departmental programs or services.
For example, in the Workforce Australia Services Deed of Standing Offer 2022 – 2028, ‘Services’ include:
- Workforce Australia Services
- Additional services agreed under Clause 25 of the deed
- Any other services reasonably related to the proper provision of services under the deed
Do I need to submit a Third-Party AI Assessment Application Form?
The department recommends that providers start with Step 1 of the Third-Party AI Assessment Framework, including the checklist on page 3 of the application form to help determine whether your AI use case is eligible to proceed without formal application.
You may not need to submit the form if your AI use case is not related to service delivery and is fully isolated from all departmental service delivery systems and data.
If the proposed AI technology is prohibited under the Department of Home Affairs’ Protect Security Directions, you do not need to submit an Application Form. These technologies are not authorised for use under any circumstances.
If you're unsure, complete Sections 1 and 2 of the application form and submit it to the department. The department will determine whether your AI use case is considered in scope under the Third-Party AI Assessment Framework.
Does the Third-Party AI Assessment Framework apply to consultants?
No, the Third-Party AI Assessment Framework does not apply to consultants engaged under individual contracts for services. Guidance on the authorised use of AI by consultants will be specified in the terms of their contract.
Currently, the framework only applies to third-party organisations that:
- have contractual agreements with DEWR, and
- are subject to the Workforce Australia Universal Guidelines.
Does the AI Assessment Application Form apply to all types of AI use cases, even if it comes by default with approved software?
Yes — the form is designed to apply broadly across different AI use cases, whether they require minimal oversight as part of the function they are intended to provide, or more detailed review before the outputs can be used as part of service delivery.
Not all questions or controls will apply to every AI use case. The supporting information section of the framework outlines the department’s expectations.
Providers are not expected to implement every control listed. The department conducts a holistic assessment of the appropriateness and sufficiency of the safeguards, governance and controls in place, based on the nature and context of the use case.
If an Accredited Third-Party Employment and Skills (TPES) System has already been approved, does a provider still need to complete an AI application form?
Yes. Accreditation of a TPES System does not automatically cover each provider’s specific AI use case. Every implementation must be assessed individually to ensure it aligns with the department’s ethical principles, security requirements and program requirements.
Providers must complete the AI application form so the department can review how the system is being used in their context — even if the underlying system has already been approved.
Do providers need to reassess AI use each time new functionality is added to existing software?
While the department recognises that providers are continually exploring new ways to support participants, including through emerging software features, any decision to develop or offer a new service that incorporates AI must be accompanied by a completed Third-Party AI Assessment Application Form.
This ensures each use case is assessed against the department’s ethical principles, security requirements and program requirements, regardless of whether the AI functionality is part of an existing system.
What is an ‘isolated system’?
An isolated system is one used only for internal tasks, with no access to departmental data or DEWR administered service delivery systems. It must be both physically and logically separated.
This includes systems used by providers to deliver services for other jurisdictions, where those systems are not connected to DEWR infrastructure or involved in DEWR service delivery. For example, an internal payroll system with no access to jobseeker data or departmental infrastructure would be considered isolated.
Do providers need an AI Accountable Officer?
No. Providers must nominate an AI Lead responsible for the system and compliance with the framework. This supports the department in having an identified contact person to streamline communication for the assessment(s).
While not mandatory, the department recommends appointing an AI Accountable Officer as a way to demonstrate strong AI governance practices.