How to complete a NSW AI Assessment Framework self-assessment

If your agency is running an AI system, or planning to, the NSW AI Assessment Framework (AIAF) is not optional. Under NSW Circular DCS-2024-04, every NSW Government agency has to apply both the AI Ethics Policy and the AIAF across the full life of any AI system, whether or not it sits inside a formal project. So the question for most agency officers is not whether to govern AI. It is how to complete the AIAF and keep it current.

This page walks through those steps and shows where Aicura Essentials does the doing. For the full framework explainer, see Aicura's NSW AIAF framework page. This page is the agency-facing slice: how an officer works through the self-assessment.

What the NSW AIAF is, in one paragraph

The AIAF is a risk self-assessment framework for NSW Government agencies. It is designed to guide agencies through the ethical design, development, procurement, deployment and use of AI, in line with the mandatory AI Ethics Principles set out in Circular DCS-2024-04. It is written for project and executive sponsors, technical leads and data governance leads, and it is meant to be used across all stages of a system's life, from planning through to operation. Aicura's framework page covers the principles and the assurance context in full.

How to complete the self-assessment, section by section

The AIAF workbook has four sections. Three are mandatory and one is optional but recommended.

Section 1, Instructions (mandatory). Confirm the right expertise is involved and capture the system's details, which are a description, the responsible officer and the date completed.

Section 2, Assessment (mandatory). Answer the 16 assessment questions. Your answers produce the overall risk level and list the mandatory assurance activities the framework requires of you, which can include a Privacy Impact Assessment, a Human Rights Impact Assessment or a cybersecurity review.

Section 3, Deep Dive (optional but recommended). Work through the additional focus questions to surface further risks and link them to good-practice controls. Any additional risks you identify are added to the Risk Register.

Section 4, Post-Assessment Actions (mandatory). Record sign-off in the Audit Record, save the file into your agency's records management system, and register high or critical-risk systems in your agency's AI register. High or critical-risk systems also have to be referred to the AI Secretariat, which coordinates the AI Review Committee (AIRC) review. Re-run the AIAF whenever a system's features, datasets, purposes or decision contexts change.

Digital NSW publishes the AIAF as an Excel workbook, and that Excel version is the current version agencies complete. A system-based version is in development.

Where Aicura Essentials does the doing

The AIAF tells you what to produce. Aicura Essentials is the tool that helps you produce it and hold it in one place.

Aicura is your AI Register. It holds the AI in use across the agency as the record, versions each system as it changes and prompts you when something needs another look. That register is what Section 4 asks you to keep for high and critical-risk systems, sitting in one place rather than scattered across spreadsheets and inboxes.

Aicura runs AIAF-aligned assessments, so you answer the questions against a named system in the register rather than a standalone file. The further risks you surface in the Deep Dive sit in your Risk Register, and Aicura generates the derived controls and governance policies that follow, ready for your review rather than built by hand.

The assurance activities the framework calls for, such as a Privacy Impact Assessment or a Human Rights Impact Assessment, remain your agency's work to complete. Aicura surfaces that the framework requires them and keeps the record of your assessment together with them.

The boundary: guidance, not certification

This line matters for government readers, so it is worth stating plainly. Aicura supports your agency's own AIAF work. It does not certify the agency, audit it or determine whether a system passes the AIAF. It does not stand in for the AI Review Committee or the AI Secretariat. Your agency's accountable officer owns the assessment, the risk level the framework produces and the sign-off recorded in the Audit Record. Aicura guides and surfaces. The decision is the agency's.

Keeping the AIAF current is the ongoing job

The AIAF is not one-and-done. The framework calls for ongoing assessment from a system's inception through to operation, and a re-run whenever a system's features, datasets, purposes or decision contexts change. As an agency's AI estate grows, that becomes a standing job rather than a single filing.

This is the part Aicura Essentials is built for. Aicura is the register that holds the agency's AI systems as a living record, and each assessment stays linked to the system it belongs to. As your estate changes you keep the register's contents current, and when a system changes you re-run the assessment against the version in front of you. Aicura is the system of record that holds, versions and prompts, so the work between the one-off filings stays in one place.

Frequently asked questions

What is the NSW AI Assessment Framework?

The NSW AI Assessment Framework (AIAF) is a risk self-assessment framework that NSW Government agencies use to identify, document and mitigate the risks of designing, developing, procuring, deploying and using AI. It is mandatory for all NSW Government agencies under Circular DCS-2024-04, which requires agencies to apply both the AI Ethics Policy and the AIAF.

Who has to complete the NSW AIAF?

The AIAF is mandatory for all NSW Government agencies, across the full AI lifecycle and whether or not the AI is part of a formal project. It is written for project and executive sponsors, technical leads and data governance leads.

How do you complete a NSW AIAF self-assessment?

You complete the AIAF workbook, which has four sections. You confirm the right expertise and capture the system's details, answer the 16 assessment questions that produce the overall risk level and the required assurance activities, work through the optional Deep Dive, then record sign-off, save the file into your records system, register high or critical-risk systems and refer high or critical-risk systems to the AI Secretariat.

Is there a NSW AIAF template?

Yes. Digital NSW publishes the AIAF as an Excel workbook, which is the current version agencies complete. A system-based version is in development.

When do you have to submit to the NSW AI Review Committee?

When your completed self-assessment produces a high or critical risk level. You send the completed self-assessment to the AI Secretariat, which coordinates the AI Review Committee (AIRC) review.

How often do you need to redo the AIAF?

The AIAF is not one-and-done. You re-run it whenever a system's features, datasets, purposes or decision contexts change, and across the solution lifecycle from inception through to operation.

Does Aicura certify or sign off a NSW AIAF assessment?

No. Aicura supports your agency's own AIAF work. It does not certify the agency, audit it or determine whether a system passes the AIAF. Your agency's accountable officer owns the assessment and the sign-off.

Run your AIAF work in Aicura Essentials

Register the agency's AI systems, run AIAF-aligned assessments against them and keep the record current as your AI use grows. Sign up at app.aicura.com.au/signup.

A note on this page

This page explains how NSW Government agencies work through the NSW AI Assessment Framework. The authoritative source is Digital NSW, at the NSW AI Assessment Framework page and NSW Circular DCS-2024-04. Where this page and the primary source differ, the primary source governs. This is general information, not legal advice. For how the framework applies to a specific system, consult your agency's accountable officer and, where needed, your own legal and privacy advisers.