AI Governance in Government Comms Has No Owner

The central problem of AI governance in Australian government communications is not that no one has thought about it. It is that three separate policy instruments have each addressed a portion of the problem, and their combined coverage — by design or by oversight — leaves an unoccupied space precisely at the intersection where ministerial risk is highest: AI-generated paid content delivered at scale through third-party platforms and media agencies.

What each framework was designed to do — and what it was not

The Australian Government Voluntary AI Safety Standard, published by the Department of Industry, Science and Resources in 2024, establishes ten guardrails for responsible AI deployment across government and industry. It is structured around principles of accountability, transparency, and human oversight, and it represents the most comprehensive statement of AI governance intent the Commonwealth has produced. What it does not do is assign communications-specific accountability roles. The Standard is addressed to organisations as entities; it does not descend to the level of named officers, delegations, or campaign-level approval chains. Its voluntary status compounds this: an agency can attest compliance without ever designating a human being responsible for reviewing an AI-generated advertisement before it reaches a citizen's feed.

The APS Interim Generative AI Policy, issued by the Australian Public Service Commission in August 2023, covers employee use of generative AI tools within the workplace. Its scope is explicit and, for present purposes, critically limiting: it addresses the conduct of APS employees using AI tools in their own work. It is silent on paid media production, on dynamic creative optimisation platforms operated by contracted media agencies, and on AI tooling embedded in vendor technology stacks that agencies procure but do not operate. The fastest-moving component of government AI adoption in communications — the automated selection, generation, and delivery of paid creative assets — operates entirely outside this policy's remit. That is not an oversight. It is a documented scope exclusion that has not been compensated for elsewhere.

The DTA Digital Service Standard — specifically criteria 12 and 13, which require agencies to identify and manage risk and to operate sustainable delivery models — predates the current generative AI adoption cycle in paid creative workflows by several years. Criteria 12 and 13 were written in a context where AI risk meant algorithmic decision-making in service delivery, not dynamic creative generation at the campaign layer. They provide no operational definitions applicable to AI-generated advertising copy, AI-selected audience segments, or AI-assembled video variants. Applying them to contemporary AI content governance requires interpretive extension that no agency has formally documented.

The Senate Select Committee's non-answer

The Senate Select Committee on Adopting Artificial Intelligence, in its 2024 interim report, acknowledged what any careful reader of the three instruments above would conclude: oversight responsibilities are fragmented across APS entities in a manner that creates systemic accountability gaps. The Committee's response to this finding was to defer to agency-level discretion. Given that agency-level discretion is precisely the mechanism that has produced the current vacuum, the deferral is not a solution — it is a restatement of the problem in committee language.

"No Australian agency can currently name the officer accountable when AI-generated paid content causes a public incident. That is not a policy gap — it is a role design failure."

Describing the current situation as a policy maturity problem implies that the solution is more guidance, more frameworks, or more time for the sector to develop norms. That framing is incorrect, and it is consequential because it directs attention toward the wrong intervention. The problem is not that policy is immature. It is that no role in any agency's organisational structure is currently defined, delegated, and obligated to own the accountability chain for AI-generated paid content.

The three-way disclaimer that produces a governance void

In practice, when an agency deploys a generative AI tool in a paid media campaign, three organisational units each have a plausible and internally consistent basis for declining ownership of the associated risk. Communications branches treat AI tools as a vendor matter: the tool is procured, the vendor is contracted, and content quality is understood to be a function of the brief and the approval process that communications already operates. ICT branches treat content as categorically out of scope: their mandate covers system security, data handling, and technology risk, not editorial or reputational review of campaign creative. Legal and procurement teams defer to each other — legal requires a policy standard before it can draft enforceable clauses, and procurement cannot set content standards without a policy mandate.

The result is not that anyone is acting in bad faith. Each unit's disclaimer is rational within its own governance logic. The problem is structural: the combined effect of three rational disclaimers is that no one owns the risk.

The AGIMO precedent and what it teaches

This configuration is not unprecedented in Australian digital government history. The period before the creation of the Digital Transformation Agency — and before the consolidation of functions that had previously been distributed across AGIMO, the Department of Finance, and agency ICT branches — was characterised by precisely this kind of distributed non-ownership. Digital service quality and citizen experience accountability were nominally everyone's concern and operationally no one's. The DTA's creation in 2015, and its subsequent evolution, was not primarily a policy intervention. It was a role architecture intervention: it assigned named accountability for digital service delivery to a specific organisational unit with a clear mandate.

The current AI governance gap in communications is structurally analogous. The solution is similarly architectural rather than documentary.

Why the distinction between policy gaps and structural gaps matters operationally

A policy gap can be closed by drafting new guidance. Once the guidance exists, the gap is formally closed regardless of whether the guidance is operationalised. A structural gap — a missing role, a missing delegation, a missing accountability instrument — persists even when guidance exists, because the guidance has no named recipient obligated to act on it. The Voluntary AI Safety Standard is a policy instrument. It exists. The structural gap it fails to close continues to exist alongside it, unaffected by the Standard's publication.

Abstract governance arguments benefit from a concrete operational scenario. The following is not hypothetical in structure — it reflects the incident patterns documented in the USDS 'AI in Public Benefits' report (2023) and the types of campaign risk that government communications practitioners are already managing informally.

The incident scenario: dynamic creative at scale

An agency deploys a paid social campaign using a dynamic creative optimisation platform operated by its contracted media agency. The platform — using a combination of AI-generated copy variants and automated audience targeting — selects and serves a creative variant that contains a factual misstatement about eligibility criteria for a government program, or that uses imagery or framing that a specific community finds culturally insensitive. The variant is served to several hundred thousand citizens before a complaint triggers a review.

At this point, the incident does not arrive with a clear chain of custody. The platform vendor's position is that it served content approved by the media agency. The media agency's position is that it operated within the brief and the approved creative framework provided by the agency. The campaign manager within the agency approved the creative framework but not each AI-generated variant — the platform's operating model makes variant-level approval operationally impossible at scale. The SES communications lead approved the campaign strategy and the master creative assets, but the AI variant generation occurred downstream of that approval.

Under current arrangements, all four parties have plausible deniability. None has a documented accountability chain that terminates in a named officer with a formal obligation to have reviewed AI-generated variants before deployment.

Asymmetric ministerial exposure

Ministers are answerable to Parliament for all government communications regardless of the production method. This is not a novel principle — it is established constitutional convention. What is novel is that the production method now includes AI systems that generate content variants at a rate and volume that no approval chain designed for human-produced creative can practically review. The asymmetry is this: ministerial accountability at the top of the chain remains absolute, while the accountability chain below it has a documented gap at precisely the point where AI-generated content receives — or fails to receive — formal risk clearance.

The USDS documentation of cascading accountability failure

The US Digital Service's 'AI in Public Benefits' report (2023) documents comparable failures in citizen-facing service delivery contexts. Across multiple case studies, the report found that the absence of a designated responsible officer meant that AI-driven errors propagated for extended periods — in some cases months — before any single actor had both the authority and the obligation to halt deployment. The pattern was consistent: when accountability is distributed across vendor, agency, and departmental layers without a named focal point, the system's default behaviour under error conditions is continued operation rather than intervention. Each party waits for another party to act. No party has a formal obligation to act unilaterally.

The relevance to Australian government communications is direct. The USDS cases involved benefits determination systems with AI components; the Australian exposure involves paid content delivery systems with AI components. The accountability architecture failure is identical in form.

The governance gap described above is not merely reputational or operational. At the point of procurement, it becomes legally consequential — specifically, it determines whether agencies have any post-incident recourse against vendors whose AI tools produced the error.

What current panel contract frameworks cannot compel

Procurement officers writing AI clauses into whole-of-government communications panel contracts currently have no standard to reference for AI-generated content specifically. The DTA Digital Service Standard's criteria 12 and 13 require agencies to identify and manage risk, but they were drafted before generative AI adoption in paid creative workflows and provide no operational definitions that translate to contract language. Specifically, they do not define what constitutes AI-generated content for contractual purposes, what disclosure obligations attach to its use, or what audit rights agencies retain over vendor AI tooling decisions.

The practical consequence is that, without enforceable AI content clauses, agencies cannot compel media agencies or technology vendors to disclose when AI tools have been used in content production. Post-incident audits become structurally impossible: the agency cannot establish what was AI-generated, which model produced it, what training data informed its outputs, or what guardrails the vendor applied. The evidentiary basis for accountability — the precondition for any form of contractual or administrative consequence — does not exist.

The state-level inconsistency problem for national campaigns

Several state governments have begun addressing this gap through bespoke contract insertions. According to publicly available procurement documentation, Service Victoria and the NSW Customer Service directorate have each inserted AI disclosure clauses into recent communications contracts. These clauses vary in scope and enforceability, and they have not been adopted at the Commonwealth level or standardised across jurisdictions. For agencies running nationally distributed campaigns — which is most Commonwealth agencies — the result is an uneven risk surface: the same AI-generated content asset may be subject to disclosure requirements in Victoria, partial requirements in New South Wales, and no requirements at the Commonwealth layer.

The post-incident audit impossibility

The absence of AI content clauses in Commonwealth panel contracts does not merely create a prospective risk — it has retroactive consequences for any incident that has already occurred during a campaign where AI tooling was in use. Without contractual disclosure obligations, agencies investigating a past incident cannot compel vendors to produce records of AI model outputs, variant selection logs, or audience targeting decisions made by automated systems. The audit trail that a Senate estimates process or a freedom of information request might eventually seek does not exist, and no current contract requires that it be created.

The argument that resolving the AI governance gap requires new legislation, new organisational units, or significant additional resource is not supported by the available international evidence. The most directly applicable model — the UK Government Communication Service's 2024 generative AI guidance — demonstrates that named accountability can be established through administrative redesign within existing role structures.

The AI content lead: a named officer, not a new role

The GCS 2024 guidance introduces the concept of a designated 'AI content lead' per campaign. This officer is accountable for reviewing AI-generated creative outputs against three criteria before paid deployment: editorial standards (accuracy, tone, and appropriateness), platform policy compliance, and ministerial risk thresholds as defined in the campaign brief. Critically, the GCS model did not create new roles. It assigned AI content accountability to existing senior communications officers through a documented addendum to campaign planning templates — a change to a process instrument, not to an organisational chart or a staffing budget.

The mechanism is administratively straightforward: the campaign planning template — the document that already exists at the start of every GCS-managed campaign — was amended to include a named AI content lead field, a declaration of AI tools in use, and a sign-off requirement before paid deployment of AI-generated or AI-assisted assets. The named officer assumes accountability through the act of signing the template. No new legislation, no new position classification, no new reporting line.

"The UK GCS model proves accountability does not require new legislation: it requires a name on a delegation instrument and a risk register that someone is obliged to sign."

The escalation path: making the chain visible

The GCS approach also establishes a clear and documented escalation path. AI content decisions that exceed the campaign AI content lead's authority threshold — defined by campaign spend, audience reach, and ministerial sensitivity category — are escalated to the Director of Communications, whose sign-off is required before deployment proceeds. This creates a visible chain that satisfies two requirements simultaneously: internal audit requirements, which need a documented approval trail, and parliamentary accountability expectations, which require that a named officer can be identified as having approved content before it was deployed.

The escalation path is not novel in principle — it mirrors the existing clearance structures that GCS and APS communications branches already operate for sensitive ministerial communications. The GCS innovation is extending that existing structure to cover AI-generated content, rather than treating AI-generated content as categorically different from and therefore outside the existing approval framework.

International models are instructive, but domestic precedents are operationally more useful because they demonstrate that named AI accountability functions can be absorbed within APS role classification structures, SES delegation frameworks, and existing Audit and Risk Committee reporting lines.

The ATO data stewardship model as a template

The Australian Taxation Office's data ethics governance model assigns named data stewards to specific data product categories. A data steward at the SES Band 1 or EL2 level holds formal accountability for the integrity, appropriate use, and governance of a defined category of data output — including AI-assisted outputs within that category. The steward is not a new role created for data governance purposes; the accountability function was assigned to existing positions through position description amendment and a formal delegation instrument from the Commissioner.

This model is directly applicable to AI content governance in communications. The accountability function does not require a new organisational unit or a new classification. It requires a defined output category (AI-generated paid content), a named officer at an appropriate classification level, a formal delegation establishing the officer's authority and obligation, and a reporting line to the agency's accountability structures.

The ABS statistical integrity model: extending existing remits

The Australian Bureau of Statistics has similarly designated statistical output integrity officers whose remit has been extended to cover AI-assisted analysis outputs. According to publicly available ABS governance documentation, this extension was implemented through position description amendment — not through new headcount — and the extended remit operates within the existing SES Band 1 accountability framework. The key design principle is that AI accountability attaches to the output category, not to the specific tool or model used to produce the output. As AI tooling evolves — as new models are adopted, as platforms change their AI capabilities — the governance architecture remains stable because it is anchored to the output rather than to the technology.

This principle has direct implications for communications governance design. An AI content accountability function that is defined around the output category 'AI-generated or AI-assisted paid communications content' will remain relevant and structurally stable regardless of whether the agency is using a dynamic creative optimisation platform, a large language model for copy generation, or an AI-assisted media buying system. The accountability structure does not need to be redesigned each time the tool changes.

Drawing on the GCS campaign model, the ATO data stewardship structure, and the accountability requirements of the Public Governance, Performance and Accountability Act, an interim governance model for AI-generated paid content can be designed and implemented administratively — within a single budget cycle, without legislative reform, and without new headcount.

The AI Content Accountability Officer: role design and delegation

The model designates an AI Content Accountability Officer (ACAO) at the EL2 level within each agency's communications branch. The ACAO holds a formal delegation from the Secretary — or, in smaller agencies, from the SES Band 2 communications lead — to approve or escalate AI-generated paid content above defined risk thresholds. Risk thresholds are defined by three criteria: campaign spend above a nominated dollar value, audience reach above a nominated impression threshold, and subject-matter sensitivity categories as defined in the agency's ministerial communications protocol.

The delegation instrument is compatible with existing accountable authority frameworks under the PGPA Act. It does not create a new statutory office or a new class of delegation. It assigns a specific function — AI content risk clearance — to an existing classification level through an existing delegation mechanism. The ACAO is not a new position; it is an existing EL2 communications officer whose position description is amended to include the ACAO function, consistent with the ATO and ABS precedents described above.

The three enabling instruments

The ACAO role requires three enabling instruments, each of which can be created administratively:

1. A standardised AI content risk register aligned to the Voluntary AI Safety Standard's ten guardrails. The register records, for each campaign: the AI tools used in content production, the nature and extent of AI generation (copy, imagery, targeting, creative selection), the risk assessment against each applicable guardrail, and the ACAO's clearance decision or escalation record. The register is a living document updated at each campaign milestone.
2. An AI content disclosure clause for insertion into panel contract standing offer notices. The clause requires vendors and media agencies to disclose, at the campaign commencement stage, all AI tools to be used in content production; to maintain logs of AI-generated outputs and variant selection decisions; and to provide those logs to the agency within a defined period following any compliance request or incident notification. This clause gives the agency the contractual basis for post-incident audit that currently does not exist.
3. A quarterly attestation to the agency's Audit and Risk Committee confirming that all paid AI-generated content in the period was reviewed against the risk register, that all material risk findings were escalated in accordance with the delegation instrument, and that no AI-generated content above the defined thresholds was deployed without ACAO clearance. The attestation creates the reporting trail required for both internal audit and parliamentary accountability purposes.

What this model does not resolve — and why that is acceptable

This interim model is deliberately bounded. It addresses AI-generated and AI-assisted paid communications content specifically. It does not address AI in organic social content, internal communications, policy document drafting, or ministerial correspondence. Those are distinct governance problems with distinct risk profiles, and they warrant separate treatment. The bounded scope is a feature, not a deficiency: it allows the model to be operational quickly, to be tested against real campaign cycles, and to generate the operational learning that informs eventual broader governance design.

The model also does not pre-empt future legislative or whole-of-government standard development. The risk register structure is aligned to the Voluntary AI Safety Standard, meaning that if the Standard is codified or its accountability provisions strengthened, the agency's existing register provides an implementation foundation rather than an inconsistent precedent. Agencies that operate paid media campaigns across multiple channels can adapt the register structure to cover each channel's specific AI tooling without redesigning the governance architecture.

The case for interim action rather than deferred action rests on three empirical observations, each of which is supported by documented precedent in Australian digital government history.

The adoption curve is not waiting for the governance timeline

The Senate Select Committee process and the ongoing review of the Voluntary AI Safety Standard operate on timelines measured in years. Generative AI adoption in government paid media workflows is already operational and accelerating. Dynamic creative optimisation platforms with embedded AI are standard offerings on whole-of-government communications panels. AI-assisted media buying — automated audience targeting, bid optimisation, and placement selection informed by machine learning models — is the default mode of operation for most major digital advertising platforms that agencies use routinely.

The governance gap is not a future risk. It is a present condition that is widening in real time. Each campaign cycle that completes without an accountability structure in place adds to the stock of undocumented AI content decisions, unaudited vendor AI tooling, and unenforced panel contract obligations that a future incident review will need to reconstruct.

Governance vacuums are not neutral — they are filled by vendor defaults

Historical precedent from the pre-DTA period is instructive here. The governance vacuum that characterised digital service delivery accountability in the AGIMO period was not a neutral absence. It was actively filled: by vendor-designed defaults that optimised for platform capability rather than citizen outcome; by informal precedents established by individual agency decisions that were not subject to cross-agency review; and by risk-averse inaction that deferred decisions until they were forced by incident rather than made proactively.

Each of those fill mechanisms created path dependencies. When the DTA was eventually established and began asserting whole-of-government design standards, it encountered not an empty space but an ecosystem of entrenched vendor arrangements, informal workarounds, and agency precedents that were resistant to change. The cost of that path dependency — in renegotiation, in re-platforming, in the effort required to establish new norms against existing practice — was substantially higher than proactive governance architecture would have been.

The same dynamic is in motion now in AI content governance. The longer the vacuum persists, the more thoroughly it is filled by vendor defaults — AI guardrail settings established by platform providers, disclosure norms set by media agency terms of service, risk thresholds defined by campaign managers without formal delegation. These defaults are not designed for government accountability requirements. They are designed for commercial efficiency. Reversing them after they have become embedded practice is harder than establishing the correct defaults prospectively.

Interim governance improves eventual legislative design rather than constraining it

The argument that interim administrative governance measures prejudice future legislative or whole-of-government standard development is not supported by the available domestic evidence. The APS Data Governance Framework — which assigned data accountability functions to named officers through administrative instruments, established data risk registers, and required periodic attestations — operated for four years before its provisions were partially codified. During that period, agencies that operated under the Framework developed practical operational experience that directly informed the eventual legislative design. The interim operation improved the quality and specificity of the subsequent codification; it did not constrain it.

The same pattern is observable in the development of the APS privacy framework, the protective security policy framework, and the records management obligations under the Archives Act — all of which operated through interim administrative instruments before being formalised, and all of which were strengthened rather than complicated by the period of administrative operation.

Agencies that implement the interim ACAO model described above will be better positioned when a whole-of-government AI content standard eventually arrives: they will have operational registers, tested delegation instruments, and a body of campaign-level governance experience that informs rather than conflicts with the emerging standard. Agencies that wait will begin from zero — at a point when the standard is already in force and compliance is not optional.

For agencies seeking to understand their current exposure before that point arrives, the paid social delivery chain, the content production workflow, and the digital asset approval process are each entry points for an AI governance review. The documented experience of agencies that have begun this process — even informally — consistently shows that the accountability gap is both more extensive and more quickly closed than initial assessments suggest.

SoudCoh works with government communications teams to design AI content governance frameworks and draft enforceable AI disclosure clauses for panel contracts — contact us to review your agency's current accountability chain before your next campaign deployment.