South Australian agencies and councils are buying AI-enabled products and services, and their tender documents are catching up. Suppliers should expect questions on how AI is governed, not only what it can do. This guide sets out what buyers are likely to ask and how to prepare responses that are specific and verifiable.
The policy backdrop
South Australian Government agencies are guided by the SA Government guideline on generative AI and large language model tools, which encourages an agency AI strategy and governance and compliance framework, documented risks, and alignment with the state’s AI ethics policy and Australia’s AI Ethics Principles. At the federal level, the Policy for the responsible use of AI in government requires agencies to maintain use case registers and impact assessments for in-scope uses. Councils and other buyers often draw on the same material, along with the Guidance for AI Adoption. Agencies cascade these expectations to suppliers through RFT questions and contract terms.
Questions to prepare for
| Topic | What the buyer is likely to ask |
|---|---|
| Policy and accountability | Do you have a responsible AI policy? Who is accountable for this system? How do you assess risk? |
| Transparency | Which models and sub-processors do you use? What are the known limitations? How are users told they are dealing with AI? |
| Data and residency | Where is data stored and processed, including inference? Is our data used to train models? How is personal information protected? |
| Security | How do you align to the Essential Eight and SA ISMF? How do you defend against prompt injection and data leakage? |
| Testing and monitoring | What evaluation and red-team evidence do you hold? How do you detect drift and degradation? |
| Human oversight | When does a person review or override? How can affected people challenge outcomes? |
| Incidents | How do you detect, notify and respond to AI incidents? |
| Change and exit | How are model changes managed and communicated? What is the exit and data return plan? |
Data residency for AI
Residency for AI is more than where a database sits. Check where inference runs for the exact model and endpoint, whether cross-region inference is enabled, where logs and prompts are retained and where support staff access them. Choose in-region endpoints when residency matters and record the provider’s data-use terms. See Australian data residency for SA Government ICT.
Prepare an AI assurance pack
Hold a reusable pack: AI policy, register entry and risk tier, architecture and data flow, model and sub-processor list, evaluation and red-team summary, human oversight design, privacy impact assessment, incident process and exit plan. Responses backed by documents read far more credibly than assertions. Do not claim certifications or assessments you do not hold. If you work towards ISO/IEC 42001, say that accurately.
Reading the tender
Watch for clauses on transparency about AI use, restrictions on training with agency data, audit rights, notification of model changes and liability for outputs. Raise clarification questions early. Related guidance: winning SA Government ICT tenders and SA ISMF for ICT suppliers.
How EITSAA helps
We help you design and evidence AI governance that matches your risk, from the register and policy through to technical guardrails and audit-ready evidence. Explore AI Governance & Assurance, talk to our team or call 0402 401 584.
This is general guidance, not legal advice. Check current requirements with the relevant authority and take advice on your own position.