Third-Party AI Assessment
Get your AI approved before it becomes an RFFR finding
If you deliver services under a departmental contract, AI use has to be assessed and approved before it goes anywhere near departmental systems.
Then it has to stay approved. Continual monitoring for new AI systems allows assessment and approval without surprises.
This is a relatively new requirement for Right Fit for Risk (RFFR) certification and is now part of your re-accreditation.
Start with what you are already running
Before you think about an application, find out what needs an approval.
Put each AI tool you can think of through the Framework Assessment Tool and see where it lands.
Five minutes, free, and nothing is submitted anywhere.
If you want to see how your own apps stack up...
Run a free AI checkYour data stays in your browser. You can save your own copy.
I won't see your data unless you choose to send it to me.
You can run up to 10 AI tools through the checks.
Most providers are already using AI they have not declared
Most providers assume the obligation is to manage AI risk: run an assessment, write a policy, keep an eye on it. That is not what the Third-Party AI Assessment Framework says.
Published in September 2025, the Framework starts from prohibition. You may not use AI to deliver services on the Department’s behalf unless the technology is not banned for government use, your contract or deed explicitly permits it, a formal application has been lodged, and the Department has given written approval. One application per use case, before the use begins.
A deed that is silent on AI does not satisfy the second condition. Silence is not permission.
The internal use carve-out is narrower than it reads
The Framework does not apply to AI used for internal business purposes unrelated to service delivery, provided the system is fully isolated from all service-related systems and data. Most providers read that and relax.
Isolation has to be demonstrable. A tool sharing a tenant, a data store, an identity provider or an integration with your service delivery systems is not isolated, whatever the licence says.
There is also a genuine tension between the two published documents here. The Framework says that where isolation cannot be guaranteed, the AI must not be used. The Application Form says you must complete the form where a system is not directly related to service delivery but cannot be fully isolated. Both statements are in the published material and they do not sit comfortably together.
If that describes something you are running, the safe course is to stop running it on its current footing and put the question to the Department before choosing between ceasing use and applying. It is not a question you should have to resolve on your own.
What you get in an AI Assessment
Know what you are running
Discovery across your tenant, your case management system, staff-procured tools and your subcontractors. Every instance tested against the three gates and classified, with a register you can hand to an assessor.
Get the use cases approved
One application per use case, prepared properly: the initial check, the ethics and cyber review, the evidence pack, all eight sections drafted, then lodgement and any follow-up questions.
Keep it approved
The policy, register and stage gate that stop unapproved AI arriving, the lifecycle notifications the Department expects, and the AI component of your annual review.
How it works
- Scope: A conversation about your contracts, systems and sites, and confirmation of who holds the AI Lead or AI Accountable Officer role.
- Discover: Tenant and vendor review, a short staff survey, workshops, and an enquiry to your subcontractors.
- Test: Framework applied to every AI system found. An exposure rating for each item and a recommendation on what to do with that system.
- Report: A register, a findings report with a recommended action for each instance, a remediation plan for anything that has to stop, and a board briefing.
- Decide: Apply, stop, change or leave it as is. Your call, with the evidence in front of you.
Who it is for
- Disability employment providers whose Inclusive Employment Australia deed started in November 2025.
- Providers holding several deeds, where one quality and compliance person carries all of them.
- Training and skills providers where AI has reached assessment, marking or student support.
- Smaller single-program providers with no compliance function, who need to know what they are running before anything else.
If you are not sure whether the framework applies to you, ask. It is a short conversation, and it is better heard from me than found in an assessment.
Related resource
This work sits inside RFFR accreditation. If you are not yet accredited, or your accreditation needs attention, start there instead.