If your supplier uses AI agents to deliver your work, you should know before they start, and you should have agreed in writing. That is the plain-language core of the Digital Transformation Agency (DTA) AI Model Clauses. This article reads that duty closely, says what it means for a supplier that delivers with agents, and lists what a buyer can ask.
This is not legal advice. Read the clauses themselves, and take advice from your own legal team or the Australian Government Solicitor.
What the clauses are
The DTA published the AI Model Clauses on 17 March 2025, prepared with the Australian Government Solicitor (AGS). Buyers are told to use them largely as drafted. A later version, v2.0, is reported to widen their scope. Our summary here relies on law-firm and AGS commentary, including the AGS Express Law note and a Hall & Wilcox summary. We could not open the primary pages when preparing this article, so check the wording against the DTA's own text before you rely on any detail below.
The duty in one sentence
As reported, where a supplier plans to use AI to deliver services, it must notify the buyer beforehand, with details of the AI system and its functionality, and obtain the buyer's prior written approval.
Three parts are worth separating.
1. Notify beforehand
The notice comes before the AI is used on the buyer's work, not after delivery and not in a footnote to an invoice. For a supplier, this means the decision to use agents has to be made at proposal or kick-off, not discovered halfway through.
2. Details of the system and its functionality
A notice that says "we use AI" is thin. The reported wording asks for details of the AI system and what it does. In practice a buyer needs to know:
- which models and tools are involved, and who provides them
- what the agents will do on this engagement (draft, analyse, write code, test)
- what the agents will not do
- what data the agents will see
- who reviews the output
The last two matter because the Policy for the responsible use of AI in government (v2.0, effective 15 December 2025) puts accountable officials and accountable owners on the agency side. An agency that has to name an accountable owner for a use case cannot do so if the supplier's use of AI is invisible.
3. Prior written approval
Approval is the buyer's decision, and it is in writing. Silence is not approval. For a supplier this creates a gate: no AI on the work until the approval is on file. It also means approval can be conditional, for example approved for drafting but not for handling personal information.
Why model choice is part of the picture
The same AGS note reports that Protective Security Policy Framework (PSPF) Directions 001 and 002 of 2025 treat DeepSeek and Kaspersky products as an unacceptable risk. Whatever your view of those directions, the practical point is that a government buyer may need to know which models sit behind a supplier's agents. A supplier that cannot say which models it uses cannot give a meaningful notice.
What a supplier who uses agents should do
An annotated reading leads to a short list of supplier duties.
- Decide before you start. Agent use is a delivery-model decision. Put it in the proposal.
- Describe the system and the work. Name the models, the tasks and the review steps.
- Wait for written approval. Do not treat a signed contract as approval for AI use unless it says so.
- Re-notify on change. If you swap a model or widen what agents do, the original notice no longer describes the work.
- Keep a person answerable. Approval is easier to give when a named human owns the output.
What we do by default
These are standing policies at xShopper, not aspirations.
- AI use is disclosed on every deliverable. Each document, code change or analysis says what the agents did.
- A named human lead is accountable for each engagement. Agents do the work under that person, who signs it off.
- We seek prior written approval before using AI on your work. We describe the work the agents will do and wait for your answer.
- Scope and acceptance criteria are fixed up front. The approval you give is for a defined piece of work.
We have not claimed, and do not claim, any certification or panel status in this article. If a buyer needs a particular assurance, ask us for the document, and we will say plainly whether it exists.
What buyers should ask
Whether or not your contract includes the model clauses, these questions make the duty real.
- Will you use AI agents on this work? If so, which tasks?
- Which models and tools, and who operates them?
- What data will they see, and where is it processed?
- Who is the named person accountable for the output, and what do they review?
- How will I be told if the tools or the tasks change?
- Where do I record my approval, and can I limit it?
- How is AI use shown on each deliverable?
- What do you refuse to hand to an agent?
A supplier that answers these quickly and in writing has probably thought about the duty. One that cannot is telling you something too.
The limits of this reading
We are a supplier, not a regulator or a law firm. Our reading is of secondary summaries, and the clauses may be adapted by your agency's contract template. Use this article to frame questions, and use your legal team to settle them.
How this article was written
Drafted with AI agents and reviewed by xShopper. Facts are linked to their sources; anything we could not confirm at a primary source is marked as such.