Update: the new ESAF quietly settles one question about "fully isolated"

What DEWR's 4 September External Systems Assurance Framework adds to the AI rules, and what it still leaves open

Two recent posts on this site covered DEWR's Third-Party AI Assessment Framework: the default answer is no, and what "fully isolated" actually means. Both still stand.

This is a short update, because on 4 September 2026 the Department published the updated External Systems Assurance Framework, the document behind Right Fit For Risk accreditation, and for the first time it carries its own section on AI in service delivery. It takes effect on 1 October 2026 and has been written into the Workforce Australia Guidelines, which makes it a contractual obligation rather than departmental guidance.

The section does not define isolation. It does add detail, and it changes the wording in two ways worth noting.

The contradiction is resolved, in favour of the form

The earlier post pointed out that the Framework said AI that cannot be isolated "must not be used", while the Application Form said it must be the subject of an application. The ESAF settles this. Its wording is that if isolation cannot be ensured, "the AI must not be used unless approved by the Department". Non-isolated internal AI now has a clear path: apply, and do not use it until approval arrives. That is the Form's reading, and it is now the one that carries contractual weight.

"Systems and data" becomes "all aspects of the delivery of Services"

The 2025 Framework required internal AI to be "fully isolated from all service-related systems and data". The ESAF drops "fully" and requires it to be "isolated from all aspects of the delivery of Services". Losing "fully" changes nothing in practice. Widening the object might. "Systems and data" invites a technical answer of the kind set out in the earlier post: separate tenant, separate identity, separate data stores, no integrations.

"All aspects of the delivery of Services" also reaches the people and the process. A tool that is technically separate but sits on the same account a consultant uses for participant appointments, or into which staff paste service content, is harder to call isolated under the new words than under the old. The four technical tests remain the right starting point. They are no longer the whole answer.

Providers are responsible for ensuring any AI Use Case being used for such purposes is isolated from all aspects of the delivery of Services. If isolation cannot be ensured, the AI must not be used unless approved by the Department.

What else the ESAF adds

The rest of the section firms up conditions that were previously implied.

•     DEWR adopts the standard machine-based system definition of AI, so the argument that a given feature is "not really AI" is closed off.
•     DeepSeek and Kaspersky products are named as banned, citing Home Affairs Directions 001-2025 and 002-2025.
•     AI bots may not record meetings with the Department. Recording meetings with participants needs prior written approval under the Framework.
•     Use cases must not involve automated decision-making and must keep detailed records.
•     Applications go to securitycompliancesupport@dewr.gov.au with the contract manager copied in, and the request "must address in detail" how each condition is met, which is a higher bar than completing the form.
•     Introducing AI into service delivery remains a change of circumstances requiring notice within five business days.

One scope note. The AI section applies only to programs administered by DEWR. The Department has said a separate version of the ESAF will apply to Skills, DSS and NIAA programs, so providers across portfolios should check which text governs each deed.

What changes in practice

Not much, if you have already done the work the earlier posts recommended. Keep the AI inventory and the documented isolation boundary. Add a line to each isolation assessment that covers people and process, not only the technical separation. Move anything you cannot call isolated into the application pile rather than the "switch off and hope" pile, since the ESAF now gives it a route. And expect the RFFR team to contact you about your new assurance category before 1 October.

The gap I raised in August is still there. DEWR has not said what isolated means. But it has said what happens when you cannot show it, and that is progress.

If you would like a second opinion on your isolation boundary before the new ESAF takes effect, write to hello@governanceworks.com.au or visit governanceworks.com.au.