NSW AI Assessment Framework

Risk and scope 1 of 4

• Risk classification, not covered
• Prohibited practices, not covered
• Risk management system 4 controls
• Impact assessment, not covered

Data and privacy 0 of 4

• Data governance and quality, not covered
• Data subject rights and consent, not covered
• Cross-border data transfer, not covered
• Copyright and training data, not covered

Transparency and records 1 of 4

• Transparency and disclosure to users, not covered
• Labelling of synthetic content, not covered
• Technical documentation, not covered
• Record keeping and logging 2 controls

Technical safeguards 0 of 4

• Human oversight, not covered
• Accuracy, robustness and cybersecurity, not covered
• Bias and non-discrimination, not covered
• Testing and evaluation, not covered

Assurance and lifecycle 1 of 4

• Conformity assessment and certification, not covered
• Registration and notification 2 controls
• Incident and breach reporting, not covered
• Post-market monitoring and corrective action, not covered

Rights and protected groups 0 of 4

• Automated decision-making rights, not covered
• Children and vulnerable groups, not covered
• Biometric identification and surveillance, not covered
• Whistleblowing, complaints and redress, not covered

Roles and organisation 2 of 6

• Supply chain and provider-deployer duties, not covered
• General purpose and foundation models, not covered
• Accountability and governance roles 3 controls
• Training and AI literacy, not covered
• Public sector use and procurement 2 controls
• Innovation support and sandboxes, not covered

Enforcement and sectors 0 of 5

• Enforcement, penalties and regulators, not covered
• Sector rules: health, not covered
• Sector rules: finance and insurance, not covered
• Sector rules: employment, not covered
• Sector rules: education, not covered