Australia's Voluntary AI Safety Standard in practice

VAISS published September 2024

The Voluntary AI Safety Standard provides ten guardrails for organisations developing or deploying AI in Australia. It is voluntary, but it is the reference framework government and regulators expect businesses to be moving toward.

Mandatory guardrails proposed for high-risk AI

A separate proposals paper consulted on making the same guardrails mandatory for AI use in high-risk settings. The definition of 'high-risk' is the subject of ongoing consultation as of 2026.

Australia's AI Ethics Principles

The eight AI Ethics Principles published in 2019 remain in effect and underpin the VAISS. Businesses are encouraged to apply them across AI design, deployment and operation.

National AI strategy

AI policy sits within the Department of Industry, Science and Resources. National strategy emphasises safe and responsible adoption alongside economic opportunity.

G1 : Establish an AI governance and accountability process

Documented governance, with named accountability for AI decisions inside the organisation.

G2 : Establish a risk management process

Identify and assess AI risks to people, communities, society and the environment across the AI lifecycle.

G3 : Protect AI systems and implement data governance

Cybersecurity controls, data quality, and lineage applied to AI systems and the data that trains them.

G4 : Test AI models and systems, and monitor in deployment

Pre-deployment testing and ongoing monitoring against the intended use case.

G5 : Enable human control or intervention

Humans able to oversee, intervene in, override or disable AI systems at appropriate points.

G6 : Inform end-users about AI-enabled decisions, interactions and content

Disclosure of AI involvement to end users, including content generated or modified by AI.

G7 : Establish processes for people impacted by AI to challenge use or outcomes

Avenues for redress where an AI decision affects an individual.

G8 : Be transparent with other organisations across the AI supply chain

Information sharing with customers, suppliers, deployers and developers about how the AI works and its limitations.

G9 : Keep records to enable third-party assessment

Documentation of design, training data, testing, deployment and monitoring sufficient for external audit.

G10 : Engage with stakeholders, evaluate needs, and provide context

Stakeholder engagement integrated into AI lifecycle, including affected workforce and customers.

Developer

Builds and trains AI models. Carries the strongest obligations under G3, G4, G8 and G9.

Deployer

Integrates AI into business workflows. Carries strong obligations under G1, G2, G5, G6 and G10. Most Australian businesses fall here.

End user

Individual employee using AI tools. Operates within deployer-set policies. Personal use is generally not directly captured.

Supply chain transparency

Deployers should expect their AI vendors to provide the information needed to meet G8 obligations downstream. Vendor due diligence has become part of standard procurement.

OAIC guidance on AI products

The OAIC published guidance on privacy and the use of commercially available AI products. Of note: entering personal information into a general-purpose AI tool may constitute a use or disclosure under the APPs.

APP 8 cross-border disclosure

Many commercial AI products process data outside Australia. Deployers remain accountable for the acts of overseas recipients under APP 8.1 unless an exception applies.

APP 11 security obligations

Organisations must take reasonable steps to protect personal information from misuse, interference and loss. Feeding personal information into uncontrolled AI tools may breach this obligation.

Privacy impact assessment expected

OAIC guidance encourages a PIA before significant AI deployments touching personal information. The PIA becomes part of the VAISS G2 evidence.

Weeks 1 to 2 : Discovery

Inventory of current AI use across the business, including shadow AI. Map each tool to a deployer or developer role. Identify data flows touching personal information.

Weeks 3 to 4 : Governance

Establish an AI governance group with named accountability. Document the AI risk appetite. Adopt G1 and G2 in writing.

Weeks 5 to 6 : Policy and disclosure

Draft a plain-English AI use policy for staff. Address acceptable use, prohibited inputs, disclosure to customers under G6, and training expectations.

Weeks 7 to 8 : Operational controls

Implement G3 (data governance, security), G4 (testing and monitoring), and G5 (human oversight) for each significant AI deployment.

Months 3 to 6 : Embed and evidence

Move from documented to operating. Begin collecting the records required under G9 and the supply chain transparency under G8.

Months 6 to 12 : Mature and audit

First internal review of VAISS alignment. Position the business for any future mandatory guardrails that emerge from the consultation process.

Consultation on mandatory guardrails

The proposals paper canvassed making the same ten guardrails mandatory for high-risk AI, with definitions and enforcement mechanisms still under consultation.

Likely high-risk sectors

Indicative areas include AI used in employment decisions, credit assessment, healthcare, law enforcement and education. Final scope will follow consultation outcomes.

Alignment with international frameworks

Australian policy direction aligns broadly with the EU AI Act risk-based approach, while drawing on US NIST AI Risk Management Framework.

Sector regulators may move first

APRA, ASIC, ACCC and the OAIC have all signalled increased AI scrutiny within their existing remits. Sector-specific guidance is likely to outpace any horizontal AI law.

Position adopted now is broadly portable

Businesses with documented VAISS alignment are generally well placed to meet any future mandatory regime with marginal additional work.

What agentic AI changes

Unlike traditional AI that generates information for human review, agentic AI systems can make decisions, interact with tools, access enterprise systems and take actions with limited human intervention. That combination of autonomy, tool access and operational privileges creates opportunities for privilege escalation, prompt injection attacks, unintended behaviour, data compromise and cascading failures across interconnected systems.

ASD Secure-by-Design approach

ASD recommends limiting agent permissions to the minimum required, maintaining human oversight for high-impact actions, continuously monitoring agent behaviour and tool usage, implementing comprehensive logging and auditing, conducting regular red teaming and adversarial testing, validating third-party tools and integrations before deployment, deploying capabilities progressively with autonomy increasing only as assurance matures, and isolating agents with strict controls on system interactions.

How this maps to VAISS

Agentic AI security does not replace the ten guardrails. It extends them. Guardrail G3 (data governance and security) applies to agent tool access and permissions. Guardrail G4 (testing and monitoring) applies to agent behaviour and decision logging. Guardrail G5 (human control) applies to oversight of high-impact agent actions. Guardrail G9 (records) applies to agent audit trails. The guardrails are the framework; agentic AI is where they get stress-tested.

Start low-risk, expand slowly

ASD encourages organisations to introduce agentic AI in a measured and risk-informed manner, beginning with clearly defined, lower-risk use cases before expanding autonomy, privileges and operational scope. This is the same proportionate approach VAISS recommends for all AI deployment, applied specifically to the agentic layer.

Defence in depth still applies

ASD recommends a defence-in-depth approach: multiple overlapping layers of security controls across user inputs, tool integrations, data sources, model outputs and agent-to-agent communications. AI-specific security measures complement, not replace, established cyber security practices. The Essential Eight and the ISM still apply.