Australia's Voluntary AI Safety Standard (VAISS) gives organisations ten practical guardrails for using AI safely and responsibly. In October 2025 the National AI Centre published the Guidance for AI Adoption, which condenses the ten guardrails into six essential practices and widens the audience to developers as well as deployers. Both are voluntary and do not create new legal obligations, but buyers, boards and regulators increasingly use them as the yardstick. This guide explains each guardrail in plain English and shows what South Australian agencies, councils and businesses can do about it.
The ten guardrails at a glance
| Guardrail | What it asks of you | Practical first step |
|---|---|---|
| 1. Accountability | Establish governance, internal capability and a regulatory compliance strategy | Name an accountable executive and an owner for each AI system |
| 2. Risk management | Identify and mitigate risks with a repeatable process | Create an AI register and risk tiers |
| 3. Data governance and protection | Protect AI systems and manage data quality and provenance | Classify data and record lineage for training and retrieval data |
| 4. Testing and monitoring | Test models before release and monitor after deployment | Build evaluation sets and production monitoring |
| 5. Human control | Enable meaningful human oversight | Define when a person reviews, approves or can stop the system |
| 6. Transparency to users | Tell people about AI-enabled decisions, interactions and generated content | Add disclosure and labelling to services |
| 7. Challenge | Let affected people contest use or outcomes | Publish a route to appeal and a review process |
| 8. Supply chain transparency | Share information about data, models and systems with other organisations in the chain | Ask suppliers for model, data and testing information |
| 9. Records | Keep records so third parties can assess compliance | Maintain an evidence pack per system |
| 10. Stakeholder engagement | Engage stakeholders, focusing on safety, diversity, inclusion and fairness | Consult affected groups and test for unequal outcomes |
How the six essential practices relate
The Guidance for AI Adoption groups the same ground into six practices: decide who is accountable; understand impacts and plan accordingly; measure and manage risks; share essential information; test and monitor; and maintain human control. It comes in two parts. Foundations suits organisations that are new to AI or use it in low-risk ways. Implementation practices suit organisations with mature governance, technical development teams or higher-risk uses. If you adopted the ten guardrails, you can map your existing controls across rather than start again.
Where SA organisations should start
- Inventory. List every AI use, including AI built into software you already license. You cannot govern what you cannot see.
- Tier by risk. Judge impact on people, level of autonomy, data sensitivity and reversibility. A meeting summariser and an eligibility model need different treatment.
- Assign owners. Every system needs an accountable person who can answer for it.
- Set proportionate controls. Light controls for low-risk use, testing, human review and monitoring for higher tiers.
- Keep evidence. Records are what turn good intentions into something an auditor or tender evaluator can verify.
How it fits with other expectations
The guardrails align closely with the NIST AI Risk Management Framework, ISO/IEC 42001 and the AI Ethics Principles. South Australian agencies also work to SA Government guidance on generative AI and large language model tools, which asks agencies to establish an AI governance and compliance framework and refers to ISO/IEC 42001 as a reference. Regulated entities are expected to manage AI inside existing standards such as CPS 230 and CPS 234.
Read next: AI governance in practice and the governance operating model architecture.
How EITSAA helps
We help you design and evidence AI governance that matches your risk, from the register and policy through to technical guardrails and audit-ready evidence. Explore AI Governance & Assurance, talk to our team or call 0402 401 584.
This is general guidance, not legal advice. Check current requirements with the relevant authority and take advice on your own position.