Guidance is easy to agree with and hard to apply. This article takes the six practices in Australia's Guidance for AI Adoption and places each at a concrete step in an engagement where AI agents do the work under a named human lead. It is written for delivery leaders who have to show, not just say, that a practice is followed.
This is not legal advice, and it is not a claim of compliance with anything. It is our reading of how the practices can show up in delivery.
The guidance in brief
The Guidance for AI Adoption was published by the Department of Industry, Science and Resources (DISR) with the National AI Centre (NAIC) on 21 October 2025. It supersedes in part the Voluntary AI Safety Standard of September 2024, which had ten guardrails. The Guidance sets out six practices: an accountable person, impact assessment, risk management, information sharing, testing and monitoring, and human control. An Implementation version is reported to align with ISO/IEC 42001 and the NIST AI Risk Management Framework. The primary page is industry.gov.au/publications/guidance-ai-adoption. We could not open it when preparing this article and have taken the practice wording from law-firm summaries, so check the exact names against the source.
Government buyers also work under the DTA's Policy for the responsible use of AI in government, v2.0, effective 15 December 2025, which asks agencies to name accountable officials, assign an accountable owner per use case and document an impact assessment at design stage. The practices below sit comfortably beside those expectations.
The six practices, step by step
An agentic engagement has a recognisable shape: scope, approval, set-up, agent work, human review, acceptance, handover. Here is where each practice lands.
1. Accountable person: at scope
Delivery step: Before work starts, one named human lead is written into the statement of work. That person owns the output, signs the deliverables and is the buyer's point of contact when something is wrong.
Evidence a buyer can ask for: the lead's name and role in the contract, and their sign-off on each deliverable.
2. Impact assessment: at approval
Delivery step: Before agents touch anything, we describe what they will do, what data they will see and what could go wrong. That description goes to the buyer for prior written approval. For a government buyer it can feed their own assessment at design stage.
Evidence: the written description and the buyer's recorded approval.
3. Risk management: at set-up
Delivery step: We limit what an agent can reach, using least privilege, and decide what is reversible. Guidance from the Australian Signals Directorate and its partners (1 May 2026, "Careful adoption of agentic AI services") is reported to advise least privilege, human checkpoints, reversibility and limits on blast radius, and to keep agents to low-risk, non-sensitive tasks until practices mature. See the NCSC NZ page and an A&O Shearman summary. Practically, that means a list of what we will not hand to an agent, agreed before work begins.
Evidence: the access list, the exclusions, and how a change can be undone.
4. Information sharing: on every deliverable
Delivery step: Each deliverable states that AI was used and what the agents did. The same disclosure applies when a buyer asks how a result was produced.
Evidence: the disclosure line on each deliverable, and a written answer to "how was this made?".
5. Testing and monitoring: at review and acceptance
Delivery step: Agent output is checked by a person before it reaches you. For code, tests are required before handover. For analysis and documents, claims are checked against cited sources. Acceptance criteria are fixed at scope, so "done" is something you can verify rather than something we assert.
Evidence: test results, source citations, the review record and the signed acceptance against the criteria. Agents can be wrong, and we say so; the control is the review, not a promise of zero errors.
6. Human control: throughout
Delivery step: A person can stop, redirect or override the agents at any point, and a person decides what is accepted. The named lead is that person.
Evidence: a record of who reviewed and approved each stage.
A short checklist
Use this at kick-off, whether the supplier is us or someone else.
- Is a named human lead accountable, in writing?
- Have you received a description of what the agents will and will not do?
- Have you approved it in writing before work began?
- Is the data the agents see limited and documented?
- Does each deliverable say what AI did?
- Are acceptance criteria fixed, with tests or source checks named?
- Who reviews agent output, and where is that recorded?
- Can a person stop the work and undo a change?
- Do you know which models and tools are used and who operates them?
- Is there a process for re-approval when any of the above changes?
Where this stops
Mapping practices to steps is not certification. We do not claim ISO/IEC 42001 or any other certification here, and a mapping document is not an audit. What it gives a buyer is something to inspect: each practice, the step where it happens and the record it leaves.
Buyers should also be aware of the wider context. Vendor-sponsored surveys report that many Australian organisations are using AI faster than they are governing it. For example, Konica Minolta and Omdia are reported to have found 83% use AI and 21% have a formal governance framework. Those samples differ between surveys and are secondary reports, so treat them as a prompt to ask questions, not as a benchmark.
How this article was written
Drafted with AI agents and reviewed by xShopper. Facts are linked to their sources; anything we could not confirm at a primary source is marked as such.