Guidance for AI Adoption: A Summary for Legal Teams
A summary of the Australian Government’s Guidance for AI Adoption, how it replaced the Voluntary AI Safety Standard and what it asks of you.
- Published
- Updated
The Guidance for AI Adoption is the Australian Government’s voluntary framework for managing AI use through six governance practices. It helps organisations assign responsibility and assess risks, then put controls around how people use AI.
For legal teams, the guidance provides a way to turn a general AI policy into decisions about particular tasks. The same system can carry different risks when drafting an internal email and when processing confidential client documents.
Who Issued the Guidance and Its Status
The Australian Government’s National AI Centre issued the Guidance for AI Adoption in 2025. The government’s release announcement describes its two levels of guidance and supporting templates.
The guidance is voluntary. Following it does not grant permission to handle client information or remove an organisation’s existing legal duties. Our guide to AI regulation in Australia explains the wider legal framework.
The foundations guidance fits organisations starting with AI or using it in lower-risk ways. Teams building systems or managing complex, higher-risk uses need the more detailed implementation guidance. Choose the depth of controls according to the use and its consequences, rather than the organisation’s size alone.
From the Voluntary AI Safety Standard
The newer guidance reorganises the earlier standard’s ten guardrails into six practices. The Department of Industry, Science and Resources describes this relationship on its Voluntary AI Safety Standard page.
The department still makes the older standard available and directs readers to the newer guidance. That is an evolution of voluntary governance guidance, rather than the repeal of legislation.
A legal team with a policy built around the ten guardrails can retain useful controls. Map the existing controls to the six practices and identify anything missing. Renumbering a policy alone does not show that anyone follows it.
For example, an existing requirement for a solicitor to approve an AI-assisted draft can remain. The updated procedure needs to identify that solicitor’s authority and explain what happens when the draft fails review.
The Practices It Recommends
The guidance recommends responsibility for AI, assessment of its effects and risks, information sharing, testing and continuing human control. The National AI Centre’s implementation guidance explains the controls behind each practice.
Six Practices in a Legal Workflow
| Practice | What it asks an organisation to do | Possible evidence in a legal team |
|---|---|---|
| Accountability | Assign people with authority to govern AI and define responsibilities across suppliers. | A named system owner and an approval process. |
| Impacts | Understand who AI affects and provide ways to raise concerns or challenge outcomes. | An impact assessment and an escalation contact. |
| Risk management | Assess the proposed use and maintain controls as risks change. | Recorded risks, control owners and incident procedures. |
| Information sharing | Keep an AI register and explain relevant AI use to affected people. | A register entry and appropriate client or staff communications. |
| Testing and monitoring | Test against defined acceptance criteria and monitor performance during use. | Test results and a schedule for reviewing failures. |
| Human control | Give trained people the ability to oversee, intervene in or stop AI use. | Review responsibilities and a workable fallback process. |
Each practice concerns an ongoing activity. A register shows which systems exist, while testing shows whether a particular system performs acceptably for its intended use. Neither record substitutes for the other.
Applying It in a Legal Team
Apply the guidance to a defined task, with a named owner and evidence that the controls work. A policy that approves a product for every purpose misses differences between uses. An AI risk assessment can document the proposed task before the team decides whether to approve it.
Consider a hypothetical firm proposing to use AI to prepare first drafts of advice from client documents. The following procedure applies the guidance to that use:
- Define the permitted task. Record the document types the system can receive and which outputs a solicitor must approve before use.
- Assign responsibility. Name the approving partner and identify who can suspend the workflow if it produces unacceptable results.
- Review information handling. Examine the provider’s terms for retention, model training and access by other parties. Assess confidentiality and privacy before supplying client material.
- Test the intended work. Use permitted sample material with known answers. Compare the draft with its sources and record missing facts or unsupported legal propositions.
- Confirm the controls operate. Have a supervising solicitor reject a defective test draft and demonstrate the fallback process. Approve the workflow only when the recorded acceptance criteria are met.
- Monitor after approval. Review failures and reassess the use when the provider, model or task changes. Suspend it when the controls no longer manage the risks identified.
In Queensland, the Queensland Law Society’s AI guidance connects AI use to practitioners’ confidentiality and supervision duties. Firms elsewhere must apply their own conduct rules and any relevant court directions.
For a board report, describe the actual position: which uses are approved, who owns them and which controls still need work. Keep the approval record with its supporting tests so a new use or supplier change triggers a documented decision.
FinTrace
Statements in. Evidence out.
FinTrace turns your bank statements into one searchable Excel ledger and a written findings report, with every finding cited to its source page.
FinTrace
See how FinTrace works