For Australian Government
DTA AI Policy — how Quant AI supports your compliance
A requirement-by-requirement mapping of the Policy for the responsible use of AI in government (v2.0, effective 15 December 2025) against Quant AI platform capabilities. With an honest split of what Quant does and what your agency must still own.
Scope: This page describes only our AI services. See our AI Transparency Statement for how Quant AI handles data, models, and safety. Last reviewed: April 2026.
Who this is for
The DTA's Policy for the responsible use of AI in government (v2.0, effective 15 December 2025) is mandatory for all non-corporate Commonwealth entities and recommended for corporate Commonwealth entities. If your agency is in scope, you have a set of obligations to meet at the agency level and the use-case level.
Quant is a platform vendor. Our job is to provide technical controls, evidence, and transparency that help your agency meet its obligations. Your agency still owns the policy, governance, and accountability decisions. This page is an honest mapping of the split.
How the policy is structured
The policy has three sections, each with mandatory requirements:
- Strategy and oversight — public transparency statement, strategic position, accountable officials, accountable use case owners, and an internal AI use case register.
- Preparedness and operations — a process for adopting AI use cases, staff awareness of Australia's AI Ethics Principles, staff and public pathways to report concerns, incident management, and mandatory staff training.
- AI use case impact assessment — assessing new and existing use cases against the in-scope criteria, conducting impact assessments for in-scope cases, registering and monitoring them, and additional governance for medium- and high-risk cases.
A use case is in scope if it could cause more than insignificant harm, materially influences administrative decisions, involves direct public interaction, uses personal or sensitive data or security-classified information, or is directed as elevated-risk by the DTA.
The responsibility split at a glance
Most of the policy applies to your agency. Quant's job is the technical substrate and the evidence trail.
Quant's responsibility
- Technical controls (guardrails, spend caps, model allowlists, tenant isolation)
- Immutable, auditable evidence of every AI interaction
- Australian data residency options
- Vendor transparency about how Quant AI works
- Security and platform incident response
Shared responsibility
- Use case register (we inventory agents, tools, workflows; you classify risk and ownership)
- Monitoring and re-validation of use cases over time
- Incident management (we provide signal and evidence; you own response)
- Alignment to the AI technical standard
Your agency's responsibility
- Your own AI transparency statement and strategic position
- Designating accountable officials and use case owners
- Impact assessments and risk classification
- Mandatory staff training on AI ethics
- Staff and public pathways to report concerns
- DTA reporting and high-risk use case governance
Section 1 — Strategy and oversight
| Requirement | Owner | What Quant provides | What your agency owns |
|---|---|---|---|
| 1.1 Public AI transparency statement — published per DTA Standard, reviewed annually, DTA notified. | Agency | Our AI Transparency Statement is published as a vendor reference artefact. You can cite it directly when describing your use of Quant AI in your own statement. | Draft and publish your agency's statement describing your use cases, risks, and mitigations. Review annually. Email the DTA when you publish or update. |
| 1.2 Strategic position on AI adoption — within 6 months of 15 Dec 2025. | Agency | This is your agency strategy. Quant has no role in writing it. | Write and communicate your strategic position to staff. |
| 1.3 Accountable officials — designated, DTA notified, per Standard for accountability. | Agency | No platform role — this is an organisational appointment. | Designate, document, and notify the DTA. |
| 1.4 Accountable use case owners ��� per in-scope use case, within 12 months. | Agency | Portal RBAC and activity logs record who created and who can modify each agent, tool, workflow, skill, orchestration, and trigger — operational evidence you can reference in your governance register. | Designate the accountable owner for each in-scope use case and record them in whatever system your agency uses as its register (portal metadata, GRC tool, spreadsheet, or records management system). |
| 1.5 Internal AI use case register — created within 12 months, shared with the DTA every six months. | Shared | The Quant portal inventories the operational building blocks of your AI use cases: agents, tools, skills, workflows, orchestrations, triggers, and Slack bots. Each entry carries metadata, permissions, and activity history. API access lets you pull this inventory into whichever system you use as your register of record. | Maintain your use case register in whatever system your agency uses for governance — portal metadata, GRC tool, spreadsheet, or records management system. Classify each use case, designate accountable owners, and format and submit to the DTA on the six-month cycle. |
Section 2 — Preparedness and operations
| Requirement | Owner | What Quant provides | What your agency owns |
|---|---|---|---|
| 2.1a Process for adopting AI use cases — risk-aligned, integrated with enterprise risk management. | Agency, with technical controls from Quant | Organisation-level master switch for AI, model allowlist or blocklist, mandatory guardrail preset applied across all surfaces, organisation-wide and per-user spend caps (daily and monthly), per-agent guardrail overlays. | Design and enforce the process — risk criteria, approval gates, sign-offs. |
| 2.1b Inform staff of Australia's AI Ethics Principles. | Agency | Not a platform function. | Communicate the principles to staff who design or implement AI use cases. |
| 2.1c Staff pathway to report AI safety concerns and incidents. | Agency | Not a platform function — staff use your agency's existing internal reporting channels (ticketing, email, line manager, incident system). We provide audit records on request to help with triage. | Provide the internal channel using your existing incident, feedback, or ticketing system; triage and remediate; escalate to accountable officials where needed. |
| 2.1d Public pathway to report concerns — appropriate to the agency's AI use. | Agency | The public-facing surface belongs to your agency. We can support you with audit evidence when triaging public reports. | Provide a public web form or email; route reports to the right team. |
| 2.1e Incident management — aligned to ICT incident management; overseen by a governance body or senior executive. | Shared | CloudWatch alarms on guardrail and governance failure modes; SNS alerting; immutable WORM audit trail for forensics. Quant notifies customers of platform-side incidents that affect them. | Incident response plan; severity classification; post-incident review; DTA notification where applicable. |
| 2.2 Mandatory staff training on AI — within 12 months. | Agency | Our product documentation supports agency-authored training (how guardrails behave, how the governance layer works, model capabilities and limits). Quant is not a learning management system. | Deliver training, track completion, refresh on a regular cadence. |
| 2.3 AI Technical Standard for Australian Government — strongly recommended. | Shared | Many technical-standard requirements (fairness, transparency, accountability) map to platform features: guardrails, contextual grounding, attribution, audit, model governance. A clause-by-clause mapping is on our roadmap. | Apply the standard to your use cases; verify the mapping fits your risk profile. |
| 2.4 AI procurement guidance — strongly recommended. | Agency | We respond to standard procurement questionnaires: residency, retention, training-data posture, breach process, IRAP status. IRAP assessment complete — contact us for the current summary. | Run procurement per DTA guidance; evaluate responses against your criteria. |
Section 3 — AI use case impact assessment
| Requirement | Owner | What Quant provides | What your agency owns |
|---|---|---|---|
| 3.1 Assess all new use cases against in-scope criteria; existing use cases assessed by 30 April 2027. | Agency | The assessment is an agency judgment. The platform is where the outcome lives: once you have classified a use case, it sits against a specific agent, tool, or workflow in the portal. | Document the assessment at design stage; record the outcome. |
| 3.2 Impact assessment for in-scope use cases — using the DTA tool or an equivalent internal process, finalised before deployment. | Agency | The impact assessment is an agency governance artefact that lives in your records or GRC system, not in the portal. Guardrail presets, spend caps, model allowlists, and custom filter policies are off-the-shelf risk treatments you can apply once the assessment has identified the risks. | Run the assessment, store it in your governance or records system, apply risk treatments, finalise before deployment. |
| 3.3 Register, monitor, re-validate in-scope use cases over time. | Shared | Per-request audit records, usage dashboards, spend tracking, and guardrail event metrics give you a live signal of how a use case is behaving. Material changes to agent configuration, model selection, or guardrail posture are recorded. | Set review cadence; act on signals; revise assessments. |
| 3.4 Medium-risk use cases — consider board or senior executive governance. | Agency | We supply the usage and audit data your board or executive needs to review. | Decide whether additional governance applies; run it. |
| 3.5 High-risk use cases — mandatory board or executive governance, report to the DTA, annual review minimum. | Agency | Evidence and usage data your accountable officials use to compile the annual review and DTA report. | Governance body oversight; compile and submit the DTA report; run the annual review at minimum. |
| 3.6 Out-of-scope use cases — comply with privacy, security, and other obligations; reassess if scope or usage changes. | Agency | All platform controls remain available even where the policy does not require them — a useful safety net. | Reassess when scope, usage, or operation materially changes. |
How Quant helps with the in-scope criteria
Appendix C of the policy lists the criteria that bring an AI use case into scope. None of these are automatic classifications — they are judgments your agency makes. The platform helps you handle them once you have made the call.
- Personal or sensitive data (Privacy Act 1988) — the OFFICIAL and OFFICIAL:Sensitive guardrail presets detect and block or redact Australian identifiers (Tax File Number, Australian Business Number, Medicare number) and common PII categories (email, phone, name, credit card, IP address, URL). On top of this, custom filter policies give you rule-based block or redact controls on input, output, or both — with built-ins for Australian driver licences, passports, and common secrets and tokens, plus the ability to author your own rules and make them mandatory across your organisation. See the transparency statement for detail.
- Security classified information (PSPF) — the PROTECTED guardrail preset adds denied topics (military operations, intelligence sources, critical infrastructure, cabinet documents), denied terms (AUSTEO, AGAO, classified, secret), and the strictest contextual grounding thresholds.
- Materially influences administrative decisions — every prompt, response, and tool call is logged with full user, token, organisation, model, and session attribution, giving you a forensic trail if an ADM review is later required.
- Direct public interaction — every AI call is tagged with the interface it came from (API Gateway, HTTP streaming, WebSocket, Slack, workflow, orchestration), so you can identify which use cases are public-facing from audit data alone.
- Potential for harm — guardrail trigger events are metered; audit content hashes allow you to reconstruct what was asked and what was returned, even if the content itself is not stored.
Evidence Quant can provide on request
- Audit record extracts for your organisation, filtered by date range, user, token, or session, with pre-signed download links.
- A snapshot of the guardrail configuration in force for your organisation at any point in time.
- A residency attestation — which AWS region(s) your organisation's inference traffic used.
- Retention attestation — showing Object Lock compliance mode and seven-year retention for AI audit records.
- The current IRAP assessment summary.
- Responses to standard agency procurement questionnaires.
Requests go to security@quantcdn.io.
Related: Quant AI Transparency Statement · Questions: security@quantcdn.io