AI Governance in the APS: What the ANAO Audits Tell Us

October 1, 2026

Blogs

AI Governance in the APS: What the ANAO Audits Tell Us

Thursday, 1 October 2026

Key takeaways

The ANAO has conducted performance audits of AI governance at the Australian Taxation Office (2024-25) and IP Australia (2025-26), finding both entities had only partly effective arrangements
Common findings include incomplete AI inventories, gaps in accountability arrangements, weak integration of governance into project lifecycles and limited performance monitoring of AI models
The DTA’s Policy for Responsible Use of AI v2.0 requires all in scope use cases to have designated accountable owners and completed impact assessments by December 2026
The JCPAA’s inquiry “Proceed with Caution” recommended mandatory governance rules and extending WHS frameworks to AI workplace risks
Leaders responsible for AI adoption in government need to understand what auditors expect, because the ANAO’s audit program for 2025-26 identifies AI governance as a priority theme

The Australian National Audit Office (ANAO) has made AI governance a priority audit theme. Its 2024-25 performance audit of AI governance at the Australian Taxation Office (ATO) found the ATO had partly effective arrangements supporting the design, development and deployment of its AI models. The ATO agreed with all seven recommendations. In 2025-26, the ANAO audited AI use at IP Australia and again found partly effective arrangements. Together, these audits establish what the ANAO expects from AI governance across the Australian Public Service (APS) and what gaps are most likely to attract scrutiny.

What did the ANAO find at the ATO?

The ATO had extensive experience with AI, operating models across compliance analytics, risk profiling and taxpayer communications. Despite this maturity, the audit found weaknesses in three areas. First, accountability arrangements were not fully established. While the ATO appointed a Chief Data Officer as its accountable official in November 2024, enterprise wide responsibilities over the AI governance framework and for individual AI models were not clearly defined. Second, the ATO did not have an enterprise wide approach to monitoring the performance of its AI models, although a project to introduce one was underway with a target of December 2026. Third, information management was insufficient to support transparent and accountable AI adoption.

The Mandarin analysis of the audit findings noted that governance arrangements alone do not always produce clear accountability. A steering committee that owns adoption is not automatically accountable for every individual AI use case: the chatbot advising citizens, the model supporting compliance decisions or the tool summarising case files.

What did the ANAO find at IP Australia?

The IP Australia audit found similar themes. The entity had partly effective arrangements, with gaps in how governance processes were integrated into project lifecycles and in the completeness of its AI inventory. IP Australia established an AI and Automated Decision Making (ADM) Inventory in February 2025, but the audit found it was being developed iteratively rather than operating as a comprehensive register. The ANAO’s annual audit work program overview identifies AI as a cross cutting risk, noting that previous audits identified deficiencies in data management and data governance arrangements that are fit for purpose for AI.

What do these audits tell leaders about what the ANAO expects?

Five expectations emerge across both audits. The first is a complete AI inventory that identifies every AI system in use, its purpose, its risk level and its accountable owner. The second is designated accountability at use case level, not just at the enterprise governance level. The third is documented risk assessment for each AI use case, aligned with the DTA’s AI Impact Assessment Tool. The fourth is performance monitoring arrangements that track whether AI models are producing accurate, fair and reliable outputs over time. The fifth is information management practices that create an auditable record of how AI was used in decision making.

The ATO’s response to the audit agreed with all seven recommendations and framed its commitment as ensuring human oversight over AI use and that decision making adversely impacting taxpayers is always made by a human. This principle of human in the loop accountability is the thread connecting both audit reports.

What is the policy framework leaders must implement?

The DTA’s Policy for Responsible Use of AI v2.0, effective from December 2025, requires non corporate Commonwealth entities to designate accountable officials, publish AI transparency statements, conduct impact assessments for in scope use cases and maintain internal AI registers. The Joint Committee of Public Accounts and Audit (JCPAA) inquiry report “Proceed with Caution,” tabled in November 2024, recommended mandatory governance rules and extending the WHS framework to AI workplace risks. By the end of 2026, every in scope Commonwealth AI use case must have a designated accountable owner with a completed impact assessment.

How can leaders build AI governance capability?

AcademyGlobal (AG), the Chartered Institute of Procurement & Supply (CIPS) Centre of Excellence for Australia, New Zealand and Southeast Asia, delivers programs that build the leadership and governance capability that AI accountability demands. AG’s Leadership & Management Skills programs address how leaders manage accountability, make decisions under complexity and build the governance structures that the ANAO expects to find. For professionals responsible for the digital and technology dimensions of AI adoption, AG’s Digital as Procurement Enabler program covers how to evaluate, procure and govern technology solutions responsibly.

The ANAO’s message is clear: AI governance is not a technology team responsibility. It is a leadership obligation. The auditors are looking for evidence that leaders understood the risks, assigned accountability and maintained the records that demonstrate responsible use.

Frequently asked questions

What has the ANAO found about AI governance in the APS?

Audits of the ATO and IP Australia both found partly effective arrangements. Common gaps include incomplete AI inventories, unclear use case accountability, limited performance monitoring and insufficient information management.

What does the DTA policy require by December 2026?

All in scope AI use cases must have designated accountable owners, completed impact assessments and entries in the entity’s internal AI register. Transparency statements must be published and updated annually.

Is AI governance a leadership responsibility or a technology responsibility?

A leadership responsibility. The ANAO expects accountable officials at use case level, not just IT governance committees. Leaders must be able to demonstrate they understood the risks and assigned accountability.

What is the JCPAA’s “Proceed with Caution” report?

The November 2024 inquiry report recommended mandatory governance rules for public sector AI, extending WHS frameworks to AI workplace risks and adding AI questions to the APS Employee Census.

Where can leaders build AI governance capability?

AcademyGlobal’s Leadership & Management Skills programs build the accountability, decision making and governance skills that AI adoption requires at the leadership level.

References

Artificial Intelligence Audit Governance Leadership Public Sector Risk Management