A convincing AI demonstration is only the start. Before committing to a pilot, purchase or rollout, make the business problem, evidence gaps and decision owners clear. This checklist helps agency teams and suppliers prepare for that conversation, with links to ExIQ’s existing guides for deeper reading.

Reviewed by Michael LeVene on 4 September 2026.

Start with the right policy

Commonwealth policy v2.0 took effect on 15 December 2025. It applies to non-corporate Commonwealth entities, with defence and national-intelligence exclusions. It is not a blanket requirement for every Australian business, state agency or council; check the rules that apply to your organisation. DTA policy implementation.

Under that policy, agencies must begin use-case assessments by 15 December 2026. Existing unassessed uses have a separate 30 April 2027 transition deadline. New uses require a documented scope decision during design; in-scope uses require impact assessment and agreed risk treatments before deployment. DTA assessment requirements.

Prepare a short decision brief

For each question, note the evidence you have, the gap to investigate and who will follow it up. “We don’t know yet” is a useful finding, not a reason to invent an answer.

  • What problem are we solving? Bring one specific workflow, its current pain points and the people affected.
  • What would a worthwhile improvement look like? Bring a baseline and a practical way to test benefit; label forecasts as estimates.
  • What options deserve investigation? Include changes to the existing process or software, not just a new AI product.
  • What information and access would be needed? Identify data types, required privacy or security classification, data owners and proposed permissions. Map storage, processing and access locations using the questions below; do not copy sensitive records into this worksheet.
  • What could go wrong, and how would people recover? Bring a few realistic failure scenarios and proposed human checks or fallback arrangements.
  • What remains uncertain? List questions for staff and vendors, untested assumptions, and evidence required for a decision.
  • Who makes the next decision? Identify the decision owner, next action, and what would justify proceeding, pausing or stopping.

This is ExIQ’s discussion aid, not an official assessment form or a compliance certification. An in-scope Commonwealth use still needs the DTA assessment tool or a qualifying agency process; this short checklist does not replace it. DTA assessment requirements.

Check privacy, data location and sovereignty

“Hosted in Australia” is only part of the picture. Check where data is stored, where the AI processes it, who can access it and which jurisdictions affect the provider. Australian hosting alone does not resolve overseas-access or foreign-jurisdiction risks. ASD procurement and outsourcing guidance.

  • What protection does the data need? Does it include medical or health records, financial information, personal contact or identity details, or confidential business information? Record the required classification and safeguards rather than treating every dataset alike.
  • Where must it stay? Must storage, backups and processing remain in Australian data centres, or are approved overseas locations permitted? Identify the applicable law, agency policy and contractual requirements; an Australian storage setting is not evidence that processing is also local.
  • Where does the AI work happen? Trace documents, prompts, retrieved excerpts, outputs and logs through the actual service. For example, a document could remain in an Australian database while excerpts are sent to an overseas AI model. Verify the selected product and configuration, not just the vendor’s advertised region.
  • Who can access it from overseas? Can offshore staff, support teams or subcontractors view or handle locally stored data? Check whether that access is permitted, how it is restricted and audited, and whether cross-border privacy obligations apply. OAIC cross-border disclosure guidance.
  • What can the provider retain or reuse? Check retention and deletion, human review and whether inputs or outputs may be used for model training. Ask whether personal details can be removed before processing. OAIC guidance on commercial AI products.

Overseas processing is not automatically prohibited, but it is not automatically acceptable either. Document the permitted arrangements with your privacy, security and legal advisers before using real data. OAIC guidance on sending personal information overseas.

Go deeper where you need to

Need help making sense of the options?

ExIQ’s investigations and recommendation reports help turn a broad AI idea into clearer decisions. If you need help understanding an existing workflow or evaluating possible improvements, tell us what you are trying to solve.