WA Government AI Policy and Assurance Framework: A Practical Readiness Checklist

The WA Government AI Policy and Assurance Framework establishes how WA public sector entities must govern their use of artificial intelligence and automated decision-making. The framework applies across the full lifecycle of AI systems and covers systems that are procured from vendors, built internally, or adapted from third-party sources. It is not a voluntary standard or a maturity model to aspire to: it creates mandatory obligations that entities are expected to meet as part of their normal governance responsibilities. For most WA public sector entities, the gap between where they currently are and what the framework requires is larger than their leadership has recognised.

The framework's risk evaluation covers five dimensions: privacy, security, transparency, explainability, and contestability. Each dimension requires the entity to assess the risks present in each AI system and the controls that manage those risks. Privacy risk addresses what personal information the AI system accesses and how it handles it. Security risk addresses the attack surface the system creates and the protections in place. Transparency risk addresses whether the system's operation and outputs can be explained. Explainability addresses whether decisions the AI influences can be understood and communicated. Contestability addresses whether individuals affected by AI-assisted decisions have a meaningful avenue to seek review. For entities that have not previously assessed their AI systems against these dimensions, the first self-assessment will frequently surface risks that were not previously visible.

The self-assessment obligation applies at all phases of the project, not just at initiation. An entity that completes a self-assessment at procurement but does not revisit it as the system evolves, as the data it accesses changes, or as the way it is used by staff develops, is not meeting the requirement. The framework treats AI governance as an ongoing lifecycle obligation rather than a one-time approval. For entities running multiple AI systems at different stages of their lifecycle, this creates a recurring governance workload that needs to be built into operational practice, not managed as a series of one-off exercises.

The escalation criteria to the AI Advisory Board create a specific compliance obligation that many entities have not yet addressed. Any AI project with residual risk at mid-range or above, any project financed through the Digital Capability Fund, and any project with a total cost above five million dollars requires submission to the Advisory Board. The Advisory Board provides independent advice, but the submission itself is mandatory for projects in these categories. Entities that are planning or operating AI projects in this category need to understand whether submission is required and, if so, have a submission that accurately reflects the system's design, risk profile, and governance controls.

The AI Register obligation creates external accountability for AI governance at the entity level. Use cases drawn from completed self-assessments are submitted to the Office of Digital Government and maintained in a central register. This means that the quality and completeness of an entity's self-assessments is not a purely internal matter: it is visible to the Office of Digital Government and will form the basis of the entity's representation in the register. Entities that submit incomplete or inaccurate self-assessments are creating an externally visible record of inadequate governance.