Australia's AI governance architecture was designed for a different problem
AI governance in the Australian public sector has developed primarily as a response to one class of problem: automated decisions that affect the legal rights or entitlements of identifiable individuals. The instruments that result from that framing are coherent within it. They are not, however, designed to govern the use of AI in mass-broadcast public communications — and the gap between those two domains is now operationally significant.
The Interim Voluntary AI Safety Standard and its structural scope
The Australian Government's Interim Voluntary AI Safety Standard (Department of Industry, Science and Resources, 2024) is organised around ten guardrails, each of which addresses risk in the context of consequential, individualised automated decisions — welfare assessments, licensing determinations, enforcement actions. Guardrail 9, which concerns human oversight, is explicitly framed around the capacity to review and override decisions affecting named individuals. There is no provision, and no evident drafting intention, that extends to LLM-generated copy served to anonymous mass audiences via programmatic channels. The instrument does not exclude public communications by name; it simply never reaches them, because the problem it was designed to solve sits elsewhere.
Commonwealth Procurement Rules: automated decisions and their assumed shape
The Department of Finance's Commonwealth Procurement Rules (updated July 2024) address supplier conduct and data handling across a broad range of procurement categories. Their provisions on automated decision-making presuppose a discrete, reviewable decision with an identifiable affected party — a legal architecture inherited from administrative law. An algorithm that selects a visa applicant for secondary review, or that calculates a welfare payment, fits that model. An algorithm that selects which creative variant of a domestic violence awareness advertisement is served to which demographic cohort on a Tuesday afternoon does not fit it, because there is no single affected party, no reviewable decision, and no administrative-law trigger. The Rules do not fail here; they simply address a different geometry of risk.
OAIC guidance: privacy protections stop at targeting, not creation
The Office of the Australian Information Commissioner's Privacy and AI: Guidance for Government Agencies (2024) extends meaningful protections to the use of personal data in audience targeting — requiring agencies to assess privacy risk when personal data is processed by third-party AI systems, including ad platforms. This is a substantive protection. It does not, however, extend to the content-creation side of the equation. An agency that uses an LLM to generate the copy of a mental health campaign, reviews the output, and approves it for placement has discharged no obligation under current OAIC guidance to document the AI's involvement, the prompt that produced the output, or the review process applied. The guidance leaves agencies without a clear obligation to distinguish what a model generated from what a human authored — a distinction that is now practically and forensically important.
Platform-native AI bidding tools have outrun the procurement panel that approved them
The Digital Transformation Agency's procurement panels for digital advertising services include Google and Meta as approved suppliers, which means agencies can access the full capability set those platforms offer — including their most automated campaign products — without triggering additional governance scrutiny beyond standard supplier-conduct clauses. The operational implications of that panel architecture deserve careful examination.
What Performance Max and Advantage+ actually do
Google Performance Max and Meta Advantage+ are not simply media-buying efficiency tools. Both exercise autonomous operational control over creative asset selection, audience targeting parameters, bid strategy, and spend allocation across placements. In a non-AI campaign management context, each of those operational decisions would require documented human sign-off under standard campaign management practice. Per Meta's Advantage+ Shopping Campaigns: How Automation Works documentation (Business Help Centre, 2024), the Advantage+ system explicitly removes manual audience constraints that advertisers would otherwise set, and dynamically generates ad variations without requiring per-variation human approval. The system is designed to maximise performance metrics as defined by the advertiser; it is not designed to maintain fidelity to approved messaging frameworks, cultural safety requirements, or the clinical accuracy standards that apply to government health communications.
The infrastructure perimeter problem
Because Performance Max and Advantage+ operate inside platform infrastructure rather than inside agency systems, they fall outside the perimeter that most agency IT governance policies, data handling frameworks, and security accreditation regimes were written to cover. An agency's enterprise AI policy may require human review of AI-generated content produced in agency-controlled environments. That policy has no purchase on creative optimisation decisions made by a Meta algorithm inside Meta's infrastructure, using agency-provided assets, targeting agency-defined audiences. The governance perimeter and the operational perimeter have diverged, and no current Commonwealth instrument has addressed that divergence directly.
The accountability gap sits exactly where AI autonomy is highest and public stakes are greatest — government health and cohesion campaigns.
DTA panel inclusion as implicit legitimation
There is a secondary governance problem in the panel architecture. When the DTA lists a platform capability on an approved panel, that listing functions, in practice, as an implicit signal of governance adequacy — agencies reasonably interpret panel inclusion as meaning the capability has been assessed and found consistent with Commonwealth obligations. For AI bidding tools that post-date the original panel assessment criteria, that signal is misleading. The panel was not designed to assess algorithmic autonomy in creative generation; it was designed to assess supplier financial capacity, security posture, and pricing structure. The gap between what the panel was designed to assess and what agencies now deploy under its authority is material.
LLM copy generation in public campaigns creates accountability voids that FOI cannot see into
Separate from platform-native AI optimisation, the use of large language models to generate draft campaign copy has become a standard practice across federal health, transport, and social services communications portfolios. This practice operates in a documentary vacuum that has significant implications for public accountability and independent scrutiny.
Record-keeping obligations were written before prompts existed
Commonwealth record-keeping obligations under the Archives Act 1983 and the National Archives of Australia's guidance on digital records require agencies to retain records that document significant decisions and their basis. When a communications officer uses an LLM to generate five variants of a campaign headline, reviews them, selects one, and submits it for approval, current record-keeping practice in most agencies would capture the approved headline but not the AI origin, the prompt, the discarded variants, or the review process applied. There is no mandatory record-keeping requirement specifying that content was AI-generated, who reviewed it, or what prompt produced it. The approved record and the AI-generated record are indistinguishable in the archive.
The FOI structural problem
Freedom-of-information requests for campaign creative assets — a mechanism used by parliamentary staff, journalists, and researchers to scrutinise government communications — can return the final approved copy without any indication that a model generated the first draft. Independent scrutiny of AI involvement is structurally impossible under current practice, not because agencies are withholding information, but because the information is not being captured in the first instance. The FOI mechanism cannot surface what the record-keeping system does not contain. This is not a legal deficiency in the FOI framework; it is a gap in the upstream documentation practice that renders the FOI framework functionally inert for this class of inquiry.
Cultural safety and accessibility obligations without audit mechanisms
Australian Government communications are subject to cultural safety obligations for content directed at Aboriginal and Torres Strait Islander communities, accessibility requirements under WCAG 2.1, and plain-language standards established by the Australian Government Style Manual. These obligations are written for human-authored content and assume a human author who can be held accountable for compliance. When LLM-generated copy proceeds through approval without the AI origin being documented, there is no audit mechanism to verify that the content was reviewed against cultural safety or accessibility standards in a manner that accounts for the specific failure modes of generative AI — including hallucinated references, inappropriate register, and demographic assumptions embedded in training data. Compliance is attested at the point of human approval, but the review process that would catch AI-specific failure modes is neither required nor documented.
The accountability gap sits exactly where AI autonomy is highest and public stakes are greatest — government health and cohesion campaigns.
The UK GDS and USDS have already drawn the boundary lines Australia has not
The absence of explicit AI governance obligations for public communications is not an inevitable condition of the current state of AI policy globally. Two comparable jurisdictions — the United Kingdom and the United States — have produced frameworks that address precisely this domain, and their design choices are instructive for what an Australian equivalent would need to contain.
UK GDS: named sign-off at senior responsible officer level
The UK Government Digital Service's AI and Automation in Government Services: Responsible Use Principles (2023) establishes an explicit human-in-the-loop requirement for any AI-generated content that will be published under a government brand, including paid media. The requirement is not expressed as a general aspiration for human oversight; it specifies named sign-off at senior responsible officer level before placement. This design choice is significant: it attaches institutional accountability to a named individual, creating a documentary trail that is visible to internal audit, parliamentary scrutiny, and FOI requests. The GDS framework also applies the same governance logic to AI-assisted communications as to AI-assisted service delivery, rejecting the implicit assumption in current Australian frameworks that communications is a lower-risk domain.
USDS: registers, review gates, and post-campaign disclosure
The United States Digital Service's AI Playbook for Federal Agencies (2023) goes further in its operational specificity. It requires agencies to maintain a register of AI tools used in public-facing communications, document the human-review gate applied to each output type, and include AI-use disclosure in post-campaign reporting to oversight bodies. The register requirement is particularly important: it creates a live inventory of AI tool deployment that enables audit bodies to assess the gap between what governance policies require and what operational practice delivers. The USDS framework does not treat AI tool disclosure as a punitive compliance burden; it frames it as a condition for the institutional confidence that allows AI tools to be used at appropriate scale.
Proportionality as the shared design principle
Neither the GDS nor the USDS framework treats AI-assisted communications as categorically different from AI-assisted service delivery in terms of governance logic. Both apply a proportionality principle: the higher the public-interest stakes of the content, the more rigorous the human-review requirement. A routine agency social media post and a national vaccine campaign are not governed identically; the framework scales with consequence. This proportionality design would translate directly to an Australian context, where the distinction between routine digital communications and high-stakes public health or social cohesion campaigns is already embedded in the Communications and Marketing Framework administered by the Department of Finance.
The institutional risk absorption problem
Australia's absence of an equivalent obligation produces a specific governance pathology: the individual communications director, not the framework, is currently absorbing the institutional risk of AI deployment decisions. When a communications director approves LLM-generated copy for a mental health campaign, or permits Performance Max to optimise spend allocation across demographic segments, they are making a consequential governance decision in the absence of a framework that tells them what standard of care applies. That is neither a defensible nor a scalable governance architecture. It concentrates risk at the individual level and distributes accountability nowhere.
The accountability gap is sharpest where campaign stakes are highest
The structural gap in AI governance would be a manageable theoretical concern if it applied uniformly across the full spectrum of government communications. It does not. The campaigns most likely to use AI-assisted copy generation and platform-native AI bidding are precisely those where the public-interest stakes are highest and the consequences of messaging error are most significant.
Public health campaigns and the engagement-accuracy tension
Public health campaigns — vaccine uptake, mental health crisis-line promotion, pandemic response, harm-reduction messaging — are among the most resource-intensive communications activities in government, and they are increasingly managed with performance-driven AI bidding tools that optimise for engagement metrics. The tension here is substantive: AI copy optimisation that maximises click-through or message recall may produce variants that diverge from the clinically or ethically approved messaging approved by the relevant health authority. A headline that performs well on engagement metrics is not necessarily a headline that a Chief Medical Officer would approve, and the platform optimisation system has no mechanism to apply clinical accuracy as a constraint. The human-review gate that would catch that divergence is not mandated by any current Commonwealth instrument.
Social cohesion campaigns and embedded bias risk
Social cohesion and counter-disinformation campaigns carry a specific integrity risk that platform-native AI tools are structurally unequipped to manage. An LLM trained on general web data may reproduce contested framings, demographic assumptions, or cultural register errors that a human communications expert — particularly one with subject-matter expertise in the relevant community — would identify and reject. Platform-native creative optimisation does not flag these errors; it serves the variant that generates the strongest engagement signal, regardless of whether that variant contains a framing that is contested, inappropriate, or counterproductive to the campaign's stated objective. The absence of a mandated human review gate for this content category is a structural risk, not a remote one.
The Service NSW precedent and the federal non-response
The NSW Audit Office's 2023 review of digital government at Service NSW noted the absence of AI-use disclosure standards in campaign delivery as an emerging risk, specifically identifying the gap between the capabilities deployed and the governance frameworks available to assess them. That finding was made in the context of a state-level review with limited jurisdictional reach. It has not produced a mandatory response at either state or federal level in the intervening period. The absence of a policy response to a named audit finding from an independent oversight body is itself a governance data point: the risk has been identified and classified, and the institutional response has been to continue voluntary arrangements.
Why voluntary standards alone cannot close this gap
The standard response to identified gaps in AI governance in Australia has been to point to the Interim Voluntary AI Safety Standard as the operative framework and to emphasise that mandatory requirements are under development. That response does not adequately address the accountability problem in public communications, for reasons that are structural rather than a matter of timing.
Voluntary frameworks produce uneven accountability across identical activities
The Interim Voluntary AI Safety Standard explicitly describes itself as a bridge to future mandatory requirements. Voluntary compliance, however, creates an uneven risk environment: agencies with mature digital governance teams, dedicated AI ethics capacity, and senior leadership commitment to the standard self-impose rigour; agencies with capacity constraints, high staff turnover, or competing operational priorities do not. The result is inconsistent public accountability across the same class of communication activity — a federal health campaign managed by one agency may be governed to a high standard of AI transparency; an equivalent campaign managed by a different agency may not be, and there is no instrument that makes that inconsistency visible or correctable.
The documentary trace problem
Voluntary compliance leaves no documentary trace of non-compliance; that is not a governance framework, it is an absence of one.
Mandatory frameworks — procurement rules, legislative instruments, binding standards — create documentary obligations that produce evidence of both compliance and non-compliance. An agency that fails to meet a mandatory AI-use disclosure requirement leaves a traceable gap in its procurement documentation, its campaign reporting, or its audit records. An agency that chooses not to apply a voluntary standard leaves no documentary trace of that choice. Parliamentary oversight committees, the Australian National Audit Office, and public-interest journalism cannot identify the gap, because the gap produces no record. Voluntary frameworks are not simply less rigorous than mandatory ones; they are structurally opaque to the oversight mechanisms that the Australian public sector relies upon.
The Robodebt precedent and the limits of sector goodwill
The Robodebt Royal Commission examined a case in which automated decision-making in a high-stakes public-sector context proceeded without adequate legal authority, without sufficient human oversight, and without the documentary record that would have made external scrutiny possible. The commission's findings were not primarily about the technology; they were about the governance architecture — specifically, the assumption that goodwill, professional judgment, and internal review were adequate substitutes for binding oversight requirements. The Australian public sector's tolerance for voluntary AI governance in high-stakes contexts has been tested by that experience, and the conclusion that mandatory frameworks are necessary in consequential domains is now embedded in the commission's public record. Public communications — particularly health, social cohesion, and election-integrity campaigns — meet any reasonable threshold of consequence.
Voluntary compliance leaves no documentary trace of non-compliance; that is not a governance framework, it is an absence of one.
A working map of the regulatory gap, instrument by instrument
The following table maps the five most relevant Commonwealth instruments against the specific governance requirements that an adequate AI governance framework for public communications would need to contain. The purpose is not to assess the instruments as failures in their own terms — each addresses the problem it was designed for — but to make the gap visible in precise, instrument-level terms.
| Instrument | Administering body | Covers AI in service delivery? | Covers LLM copy generation in campaigns? | Covers platform-native AI bidding? | Requires AI-use disclosure to oversight body? |
|---|---|---|---|---|---|
| Commonwealth Procurement Rules (July 2024) | Department of Finance | Partially — supplier conduct and data handling | No explicit provision | No explicit provision | No |
| Interim Voluntary AI Safety Standard (2024) | Dept of Industry, Science and Resources | Yes — primary scope | No | No | No — voluntary instrument |
| OAIC Privacy and AI Guidance (2024) | Office of the Australian Information Commissioner | Partially — data handling | No — stops at targeting, not creation | Partially — personal data in targeting only | No |
| APS Framework for AI | Australian Public Service Commission | Yes — conduct and ethics in APS decision-making | No explicit provision for campaign content | No | No |
| DTA Trusted Digital Identity Framework | Digital Transformation Agency | Yes — identity and authentication contexts | No — out of scope by design | No | No |
A structural assumption, not an oversight in any single instrument
The pattern in the table above reflects a structural assumption shared across all five instruments: that AI governance is a service-delivery and administrative-law problem, not a communications and public-persuasion problem. Each instrument is internally coherent within that assumption. The gap is not correctable by amending any single instrument at the margin; it requires an explicit policy decision that public communications — including campaign copy generation and algorithmic media buying — constitute a domain requiring dedicated AI governance provisions.
Three pathways to closing the gap and their trade-offs
Closing the gap requires a deliberate policy choice between at least three available mechanisms, each with different implementation timelines and enforceability characteristics.
| Mechanism | Administering body | Enforceability | Implementation timeline | Principal limitation |
|---|---|---|---|---|
| Amendment to Commonwealth Procurement Rules — add AI-use disclosure obligations for communications suppliers | Department of Finance | Binding on non-corporate Commonwealth entities | 6–18 months (rule amendment process) | Does not reach state and territory agencies or GBEs without separate instruments |
| Specific addendum to the AI Safety Standard covering public communications | Dept of Industry, Science and Resources | Voluntary unless incorporated by reference in contracts | 3–9 months (standard addendum process) | Remains voluntary; does not resolve documentary trace problem |
| Finance and DTA joint circular — AI-use requirements for campaign procurement | Department of Finance + DTA | Binding as a Finance circular for relevant entities | 2–6 months (circular process, no legislative vehicle required) | Circular authority is narrower than rule authority; subject to future revision without public process |
Audit questions procurement officers can insert into campaign briefs now
Pending the policy decisions that a mandatory framework requires, procurement officers managing government communications campaigns can materially reduce institutional risk by inserting a structured set of AI-use questions into campaign briefs and supplier response requirements. The questions below are designed to create the documentary record that current practice does not produce, and to position the agency for compliance when mandatory requirements do arrive.
Questions to be answered by suppliers at brief stage
The following questions should be included in campaign brief documents issued to creative and media agencies, and in procurement documentation for platform-direct campaign management arrangements:
- Which AI tools — including LLMs, generative image models, and platform-native AI products — will be used to generate, optimise, or select creative assets for this campaign? Provide the name, version, and platform of each tool.
- For each AI tool identified, describe the human-review gate that applies before AI-generated or AI-selected content is served to the public. Identify the role (not the individual) responsible for that review.
- How will AI-generated content be distinguished from human-authored content in the campaign record, for the purposes of FOI compliance and internal audit?
- If platform-native AI bidding tools (including but not limited to Google Performance Max or Meta Advantage+) will be used, specify: (a) which automated functions will be enabled; (b) what audience targeting constraints, if any, will be applied to limit algorithmic autonomy; and (c) who holds named accountability for reviewing platform-generated asset variations before campaign launch.
- How will the agency be notified if platform AI systems generate and serve creative variants that were not individually reviewed and approved before placement?
- What provision will be made for post-campaign documentation of AI tool use, suitable for inclusion in campaign reporting and available for review by internal audit, the ANAO, or a FOI applicant?
Specific treatment for platform-native AI tools in brief specifications
Platform-native AI tools require explicit treatment in brief specifications because their default configurations are designed for commercial advertisers, not public-sector accountability requirements. Brief specifications for campaigns using these tools should address the following:
- State explicitly whether algorithmic creative optimisation is permitted, and if so, under what constraints. Where messaging accuracy is a clinical, legal, or cultural safety requirement — as in public health, First Nations communications, or legal services campaigns — the brief should specify that AI creative optimisation is not permitted without prior named human approval of each variant.
- Specify the audience targeting constraints that will be applied regardless of platform AI recommendations. The OAIC's 2024 guidance on privacy and AI requires agencies to assess privacy risk when personal data is processed by third-party AI; this assessment should be documented and attached to the brief.
- Require the media supplier to provide, at campaign close, a structured AI-use declaration that identifies which tools generated or optimised which portion of the campaign, the proportion of total spend managed by algorithmic versus human bid decisions, and any instances where platform AI served variants outside the approved creative set.
The post-campaign AI-use declaration: a minimum viable audit trail
The post-campaign AI-use declaration is the single most important documentary tool available to agencies operating without a mandatory framework. It does not require a new policy instrument or a legislative amendment; it requires a clause in the campaign contract or agency-supplier service agreement. The declaration should include, as a minimum, the following structured fields:
- List of AI tools used in content generation, with confirmation of the human-review gate applied to each.
- Proportion of campaign copy (by asset count and by impression volume) that was generated or substantially modified by an AI tool.
- Proportion of media spend managed by algorithmic bidding systems without per-decision human review.
- Any instances where platform AI generated and served creative variants outside the approved asset set, with description of how those instances were identified and addressed.
- Confirmation that AI-generated content was reviewed against applicable cultural safety, accessibility, and accuracy standards, with identification of the reviewer role.
This declaration, retained as part of the campaign record, creates the audit trail that current practice does not produce and that a future mandatory framework will almost certainly require in some form. Agencies that begin collecting this record now are building institutional knowledge of their AI deployment patterns at the same time as they reduce their exposure to the accountability gap identified in this article. For agencies managing Google Ads campaigns or Meta advertising programs, the declaration structure above can be incorporated into standard end-of-campaign reporting with minimal supplier friction. Procurement officers seeking a broader view of how AI governance intersects with campaign delivery architecture may also find the agency case studies on the SoudCoh site relevant to their briefing process.
SoudCoh's government communications practice can audit your agency's current campaign briefs against the gap map in this article and draft AI-use disclosure clauses ready for insertion into your next procurement. Contact the practice via the contact page or review the practice overview for engagement details.