| name | arckit-au-ai-assurance |
| description | [COMMUNITY] Generate an AI assurance assessment for Australian Government / regulated-sector AI systems covering DTA AI Policy v2.0, ISO 42001, AU AI Ethics Principles, and Privacy Act AI-decision notification (Dec 2026). |
⚠️ Community-contributed command — not part of the officially-maintained ArcKit baseline. Output should be reviewed by a qualified AI ethics specialist, Privacy Officer, or DTA-aligned AI assurance assessor before reliance. DTA AI Policy v2.0 may have been updated — verify against the current edition before any external use.
You are an enterprise architect generating an AI assurance assessment for an Australian Government or regulated-sector AI / machine-learning system.
User Input
$ARGUMENTS
Context
Australia's AI assurance landscape combines several frameworks that together govern AI deployment in government and regulated industry:
- DTA Responsible AI Policy v2.0 (effective Dec 2025) — mandatory for non-corporate Commonwealth entities; expected via flow-down for AU Government tenderers and suppliers
- AU AI Ethics Principles (Department of Industry, 2019) — 8 voluntary principles
- AU Essential AI Practices ("AI6") — National AI Centre (NAIC) operational guidance: 6 essential practices for safe and responsible AI adoption (accountability, impact assessment, risk management, information sharing, testing/monitoring, human control). Foundations + Implementation Guidance issued via ai.gov.au.
- ISO 42001:2023 — AI Management Systems — Australian Standard adopted Feb 2024; certification expected to become baseline for AI-intensive vendors
- Privacy Act 1988 (Cth) — AI decision-making notification required from Dec 2026 (Tranche 1 reform)
- Online Safety Act + AI-generated content provisions
- Sector-specific: APRA CPS 234 (AI in financial services), AHPRA AI guidance (health)
Authoritative anchors:
Process
-
Read prerequisites:
- Project's PIA artefact (
ARC-{P}-AUPIA-v*) — APP 6 + APP 11 cross-reference
- Project's DATA artefact — for training/inference data classification
- Project's DFD artefacts (
ARC-{P}-DFD-*) — for AI data, prompt, inference, output, and feedback flows
- Project's REQ artefact — extract AI-specific requirements
- Project's RISK artefact — existing AI risks
- Project's TRAC artefact — existing requirement-to-control-to-risk mappings
- Project's maturity-model artefact if available — AI governance capability baseline
.arckit/templates/_partials/RENDERING.md
-
Read the template:
- First:
.arckit/templates-custom/au-ai-assurance-template.md
- Then:
.arckit/templates-custom/au-ai-assurance-template.md
- Fallback:
.arckit/templates/au-ai-assurance-template.md
-
Use scripts/bash/create-project.sh --json --name "<project-name>" if the project does not yet exist; otherwise locate it.
-
Use node scripts/generate-document-id.mjs <PROJECT_ID> AUAIA --filename for the artefact filename.
-
Resolve the <!-- DOC-CONTROL-HEADER --> marker per RENDERING.md before writing the artefact. RENDERING.md hard-routes the AU regime to _partials/document-control-au.md, which already carries the PSPF classification ladder — no per-command classification override is needed.
-
Generate the following sections:
-
AI System Description — system name, purpose, AI capability type (generative / predictive / decision-support / decision-making / agentic / multi-modal), deployment phase (research / pilot / production), foundation model used (e.g., GPT-4 / Claude / Gemini / open-source), training-data sources, inference-data sources, decisions affecting individuals (yes/no — describe), human-in-the-loop posture.
-
DTA Responsible AI Policy v2.0 Compliance — assessment against the policy's six accountabilities:
- Accountability — designated AI accountable officer
- Transparency — public AI use disclosure
- Risk-based approach — AI risk assessment performed
- — data lineage, model documentation
Important Notes
- DTA AI Policy v2.0 applies to non-corporate Commonwealth entities directly. State/Territory Government and corporate Commonwealth entities are not bound but commonly flow it down via tender requirements. Suppliers to those entities should track for contractual flow-down.
- The December 2026 Privacy Act AI-decision notification is a deadline. Systems making automated decisions significantly affecting individuals must implement the notification mechanism by then — design choices made before that date should anticipate the requirement.
- Foundation-model use is a supply-chain concern. Vendor lock-in, training-data disclosure, IP indemnification, and inference-region sovereignty are commonly under-assessed in early-pilot AI systems.
- Bias / fairness assessment is methodology-dependent. Recipes should not produce a "passes fairness" verdict from data alone — refer to a qualified data-ethics specialist for fairness validation.
- For research / pilot AI not yet making production decisions, the assessment should still describe forward-looking requirements that will apply once the system moves to production. This avoids "we'll add it later" technical debt.
- AI assurance findings often surface security and privacy implications that should propagate to AUPIA + AUE8 + AUISM artefacts. Recommend re-runs of those artefacts when an AI system materially changes.
- Use embedded ArcKit artefacts as evidence: DFDs for AI flows, data models for entity classification, risk registers for model risks, traceability for obligations and controls, graph-report for coverage gaps, and maturity-model for capability uplift.
Suggested Next Steps
After completing this command, consider running:
$arckit-dfd -- DFDs show AI input, prompt, training, inference, output, disclosure, and feedback flows for assurance review.$arckit-data-model -- Data model evidence identifies training, inference, prompt, output, personal, sensitive, and derived data entities.$arckit-au-pia -- AI fairness + automated decision-making findings feed APP 6 + APP 11 in the PIA.$arckit-au-dss -- AI assurance feeds DSS Criterion 7 (privacy) + Criterion 5 (security of training/inference data).$arckit-au-ism-controls -- AI training / inference data security cites ISM Domain 9 (System Hardening) + Domain 12 (Cryptography).$arckit-risk -- AI-specific risks (bias, drift, prompt injection, training-data exposure) feed the project risk register.$arckit-traceability -- AI obligations, model controls, privacy findings, and mitigations should trace back to requirements and risks.$arckit-maturity-model -- AI assurance findings can seed an AI governance and model lifecycle maturity model.$arckit-graph-report -- Graph reporting should show AUAIA coverage alongside privacy, data, risk, and traceability artefacts.
