Managing access to public generative AI tools
Public generative AI tools include well-known services like ChatGPT, Gemini and Claude, which users can access via web browsers, apps or embedded in other services. This guidance should be read alongside the Policy for the responsible use of AI in government and Protective Security Policy Framework Policy Advisory 001-2025 on OFFICIAL Information Use with Generative Artificial Intelligence. Agencies should adapt this advice to their specific risk profiles and operational requirements.
Strategic context
The Australian Government is focused on capturing the opportunity of AI, broadening our safe and responsible use of this technology while building public trust and confidence.
Generative AI capabilities are increasingly embedded across digital infrastructure including search engines, productivity applications and software platforms, often without explicit user notification. This ubiquitous integration creates both opportunities and governance challenges for government agencies.
Current operational realities include:
- AI literacy is becoming a fundamental expectation for all staff, requiring hands-on experience to develop essential capabilities.
- Restrictive policies drive significant shadow usage outside organisational oversight.
- Traditional technical controls may not address risks related to AI capabilities.
- Enterprise AI solutions can offer enhanced security controls suitable for handling classified government information.
Agencies must address security requirements and workforce capability development to unlock operational effectiveness in an AI-enhanced environment.
Key recommendations
- Enable staff to use public generative AI tools for government information classified up to OFFICIAL while prioritising enterprise AI solutions that are security-assessed for handling classified information.
- Adopt a risk-based approach to public generative AI access with a default posture of enabling where appropriate, based on staff roles and security clearance levels, and using technical controls like upload blockers, splash screens and data loss prevention tools.
- Develop AI literacy through training and hands-on experience with approved tools, establishing competency frameworks and cross-agency knowledge sharing. AI capability is increasingly essential for all government employees, and ignoring this shift risks professional stagnation and undermines our ability to adapt and respond to future public service needs.
- Build on existing foundational training to reduce generative AI risks by ensuring staff have a strong understanding of privacy, security, professional conduct and integrity expectations. Key mandatory training programs include APS Foundations Security Awareness and Privacy Awareness.
- Integrate AI governance with existing frameworks including usage monitoring, incident response procedures, human validation requirements, and documentation of AI use.
- Manage access to public generative AI in accordance with the Protective Security Policy Framework, including Policy Advisory 001-2025 on OFFICIAL Information Use with Generative Artificial Intelligence.
Complementary frameworks
This guidance has been designed to complement and strengthen existing frameworks, legislation and practices, enabling agencies to harness AI benefits while maintaining their obligations.
Established governance frameworks provide a strong foundation for AI adoption when supported by appropriate human capability and training. These frameworks enable agencies to confidently expand AI use.
Related AI frameworks are available here digital.gov.au/policy/ai/related-frameworks