The complaint is common and fair: no framework, no in-house expert to build one, and no reliable way to verify whether a hired consultant knows what they are doing, so how can AI governance be audited when there is nothing to audit against? The answer is that the absence of a government-issued AI template is not a compliance holiday. Standard 4.1 requires governing persons to act diligently now; Standard 4.3 requires risks to be identified and managed, and Standard 4.4 requires continuous improvement. What those obligations demand of an RTO governing AI, and what they mean for governing persons, assessors and students, is the subject of this analysis.
No Template, No Holiday
At a recent ASQA webinar, a participant put the problem with striking clarity, describing an organisation with no framework, no expert to build one, and no way to verify whether a hired consultant actually knows what they are doing, and asking how AI governance can be audited when there are no frameworks to audit against. The question is legitimate, and the frustration is understandable. But the absence of a government-issued AI governance template does not suspend the obligations RTOs already hold. Standard 4.1 of the Outcome Standards requires governing persons to act diligently and lead a culture of integrity. Standard 4.3 requires risks to students, staff and the organisation to be identified and managed. Standard 4.4 requires systematic monitoring and continuous improvement. None of these pauses while the sector waits for a prescriptive AI framework that may never arrive in the form some providers expect.
|
The Absence of a Template Is Not a Holiday |
|
There is no government-issued AI governance blueprint, and there may never be one in prescriptive form. That does not create a compliance pause. Standard 4.1 requires governing persons to act diligently now, with the information and tools currently available. Diligent action in the face of a known and escalating risk does not look like waiting. It looks like building a proportionate, documented response and improving it as understanding develops. |
1. Why the Governance Gap Exists, and Why RTOs Cannot Wait
The regulatory landscape for AI in Australian vocational education is genuinely unsettled, but less empty than it appears. At its March 2026 sector workshops, ASQA shared draft AI Principles for the responsible use of AI in VET delivery, and was explicit that these will not be additional legislation but will tie into the existing requirements under the 2025 Standards. ASQA also publishes practice guides and, through its monitoring, treats AI in assessment as a question of authenticity and integrity rather than a separate regime, while the Department of Employment and Workplace Relations published the Standards themselves and accompanying policy guidance. No standalone AI governance standard exists under the National Vocational Education and Training Regulator Act 2011 or its subordinate instruments, and the principles ASQA has shared remain in draft. RTOs are therefore being asked to govern something for which no finalised, prescriptive blueprint has been issued.
This is not unique to AI. The Outcome Standards have always specified outcomes rather than methods, a design the Explanatory Statement to the Outcome Standards Instrument 2025 describes as shifting the sector from baseline compliance to continuous improvement in VET quality and integrity. The Standards require RTOs to demonstrate genuine commitment and capability to deliver quality VET, not to follow a prescribed procedural checklist. The absence of an AI-specific framework is therefore not a deficiency in the Standards. It is the Standards working as intended. The practical implication is significant: RTOs waiting for ASQA to prescribe a specific AI model before building one are misreading both the Standards and the environment. Standard 4.1 requires governing persons to act diligently and make informed decisions that facilitate compliance, and diligent action in the face of a known and escalating risk looks like building a proportionate, documented response using the expertise available now.
The better news is that the legislative framework RTOs already operate under provides a complete structural foundation for AI governance. The four Quality Areas of the Outcome Standards- training and assessment, student support, workforce and governance- map directly onto the dimensions of AI risk an RTO needs to manage. The challenge is not finding a framework. It is recognising that the framework already exists and populating it with AI-specific content.
2. Responsible-AI Principles and Their Legislative Anchors
The principles that recur across responsible-AI frameworks, in Australia's AI Ethics Principles, in international standards, and echoed in ASQA's draft AI Principles, converge on a small set: transparency, accountability, safety, fairness and ongoing monitoring. None of these carries the force of law in itself, but each maps directly onto an Outcome Standards obligation that does. Understanding that anchor is what makes an AI governance framework both practically useful and audit-defensible.
|
Responsible-AI Principle |
Outcome Standards Anchor |
|
Transparency: AI use is disclosed, and students are informed |
Standard 2.1 (information provided to students is clear, accurate and current, and pre-enrolment information sets out the obligations on students) |
|
Accountability: humans remain responsible for AI-assisted decisions |
Standard 4.1 (governing persons act diligently and make informed decisions); Standard 1.4 (assessors make individual assessment judgements); the Credential Policy (only credentialled persons may make assessment judgements) |
|
Safety: AI must not put students or staff at risk |
Standard 4.3 (risks to students, staff and the organisation are identified and managed); Standard 2.6 (the wellbeing needs of the cohort are identified and addressed) |
|
Fairness: AI must not disadvantage or discriminate |
Standard 1.4 (the fairness principle of assessment); Standard 2.4 (reasonable adjustments for students with disability); Standard 2.5 (a safe and inclusive learning environment) |
|
Ongoing monitoring: AI use is monitored and reviewed |
Standard 4.4 (systematic monitoring and evaluation to support continuous improvement, drawing on data from the named sources including VET regulators) |
The mapping has a direct practical use. An RTO building an AI governance framework is not starting from scratch. It is extending existing compliance systems to a new risk category. The AI policy sits inside the Standard 4.3 risk management system; the student disclosure obligation inside the Standard 2.1 information system; the assessment accountability obligation inside the Standard 1.4 assessment system; and the staff capability obligation inside the Standard 3.2 workforce system. The framework is already built. The AI-specific content needs to be added to it.
|
Extending, Not Inventing |
|
An RTO building an AI governance framework is not inventing a new compliance system. It is extending the systems it already operates- risk management, student information, the assessment system and workforce development- to cover a new and escalating risk. ASQA's own signal is that its draft AI Principles will tie into the existing Standards rather than add a separate regime. The work is population, not construction. |
3. Standard 4.1: Integrity, Accountability and the Governing Person's Duty
Standard 4.1 is the foundation of RTO governance. It requires the organisation to operate with integrity and maintain accountability, and its performance indicators require governing persons to be fit and proper, to be suitable to oversee the operation of the organisation, to act diligently and make informed decisions, and to lead a culture of integrity, fairness and transparency. Each has direct implications for AI. A governing person who leads a culture of integrity must understand the risks AI introduces to that integrity, particularly in assessment, and must have taken steps to address them. One who acts diligently and makes informed decisions must have access to relevant information about how AI is used in the organisation and must have made a considered decision about acceptable use. One who is suitable to oversee the organisation must be capable of recognising when AI use is creating compliance risk and taking corrective action.
These indicators are not satisfied by delegating AI governance to a junior staff member or an external consultant without active governing person engagement. They require the people at the top of the organisation to be meaningfully involved in the AI risk conversation. This does not mean governing persons must be AI technical experts. It means they must ensure appropriate expertise is engaged, that its output reaches them in a usable form, and that they make documented decisions in response. The webinar question, about how AI governance can be audited without a framework, assumes ASQA has no standard against which to measure performance. Standard 4.1 is that standard. In a performance assessment, ASQA can ask governing persons what they understand about AI use in their organisation, what risks they have identified, what decisions they have made, and how they monitor whether those decisions are applied. An organisation whose governing persons cannot answer has a Standard 4.1 problem, whether or not a specific AI regulation exists.
|
Standard 4.1 Is the Test |
|
ASQA does not need a dedicated AI regulation to assess whether governing persons are acting diligently in relation to AI risk. Standard 4.1 supplies the test. The audit question is whether the people responsible for overseeing the organisation have identified the risk, made informed decisions about it, and led the response with integrity. A governing body that has done none of these cannot rely on the absence of an AI-specific rule. |
4. Standard 4.3: Risk Mapping AI Use Across the Organisation
Standard 4.3 requires RTOs to identify, manage and review risks to VET students, staff and the organisation itself, and it is the operative provision for AI risk governance. Risk mapping AI use means working through every area in which AI is used or could be used, and for each area identifying the nature of the risk, its likelihood and consequence, and the controls that mitigate it. The methodology is standard; only the subject matter is new. Four risk domains are primary.
The first is assessment integrity. This is the most immediate AI risk in VET, and it runs in two directions. Students using AI to generate assessment responses create authenticity risks under Standard 1.4, as a preceding article in this series examined. But RTOs also face risk from staff using AI to generate assessment materials, mark student work, or assist in competency judgements without adequate human oversight. Both directions must be mapped, because the consequence is severe: a qualification issued on assessment not conducted in accordance with Standard 1.4 is a qualification without integrity, and the AQF certification it supports is not a reliable record of competency, creating risk for the student, the employer who relies on it, and the RTO whose registration depends on compliant assessment.
The second is privacy and data governance. When staff use commercial AI tools, including large language models operated by offshore companies, they may transmit personal information about students, staff or the organisation to systems outside Australia. This engages the Privacy Act 1988 and the Australian Privacy Principles governing cross-border disclosure, and creates commercial and reputational risk where data retention and security practices are unclear. Under Standard 4.3, the RTO must identify this category and hold controls: clear policies on what information may be processed through external tools, staff training on data classification before use, vendor due diligence on privacy and security, and a review cycle that keeps the vendor assessment current.
The third is workforce capability and accountability. Standard 3.2 requires trainers and assessors to undertake continuing professional development to maintain current skills and knowledge, and AI literacy is now part of those skills. An assessor who cannot recognise AI-generated content, does not know how to respond to a suspicion, and is unclear on the authenticity obligations is not equipped to discharge their Standard 1.4 responsibilities, which makes the capability gap both a Standard 3.2 risk and a Standard 4.3 systemic vulnerability. The accountability dimension matters equally: Standard 4.2 requires the roles and responsibilities of the people the organisation engages to be documented and well understood, and an RTO in which it is unresolved who is responsible for AI-related decisions- the governing persons, the compliance team, the training manager or the individual assessor, has an accountability gap that undermines its Standard 4.1 and 4.2 compliance.
The fourth is reputational and regulatory risk. An RTO whose AI governance failures surface through an audit finding, a complaint, a media report or a regulatory action faces reputational damage that is difficult to reverse, because the sector runs on confidence; employer partnerships, referral networks and funding relationships all turn on it, and AI governance is a current, high-profile regulatory concern. These dimensions belong in the risk register as Standard 4.3 risks to the organisation, with likelihood and consequence ratings and documented controls, including the AI governance framework itself as a primary control.
|
Map Both Directions of the Assessment Risk |
|
Assessment integrity risk runs two ways: students using AI to produce work that is not their own, and staff using AI to generate materials, mark, or inform competency judgements without adequate oversight. A risk map that captures only student misuse misses half the exposure. Both must appear in the Standard 4.3 register, with controls, because both can produce a qualification that does not reliably evidence competency. |
5. Building the Framework: Minimum Components of a Defensible AI Policy
An AI governance framework does not need to be long or complex. It needs to be specific, proportionate, documented, and connected to the Standard 4.3 risk system and the Standard 4.4 improvement cycle. Seven components are the minimum.
The first is a scope statement defining what the policy covers: generative writing tools and large language models, AI-assisted image and media generation, translation and paraphrasing tools, AI marking or feedback tools in learning platforms, AI-generated assessment materials, and AI-driven analytics applied to student or operational data. The scope should be broad enough to cover tools that do not yet exist but are likely to be adopted, and specific enough to guide staff on what is covered.
The second is the categorisation of permitted, restricted and prohibited uses. A workable model is a three-tier approach: permitted without restriction, such as AI used for administrative drafting that involves no personal information; permitted with disclosure and oversight, such as AI-assisted feedback supervised by a credentialled trainer; and prohibited, such as using AI to make or substantially inform a competency determination, or processing student personal information through an offshore tool without adequate privacy safeguards. The three tiers are not the only model; what matters is that the categorisation is clear, that staff can place a proposed use, and that the approval and oversight processes for restricted uses are documented and operational.
The third is student disclosure and consent. Standard 2.1 requires information to students to be clear, accurate and current and to be provided before enrolment. If the RTO uses AI tools that process student data, or has an AI use policy for students including any disclosure requirements in assessment, that must be communicated through the existing Standard 2.1 system. The AI policy does not create a new obligation; it provides the content the existing system must carry.
The fourth is accountability and decision rights. The framework must specify who is responsible at each level: governing persons approve the framework, set the risk appetite and allocate resources; operational managers ensure compliance in their areas; individual staff use tools within the defined parameters and escalate concerns; and assessors retain personal accountability for every competency judgement, regardless of whether AI was used in any part of the process. Documenting these lines satisfies the Standard 4.1 accountability obligation, the Standard 4.2 roles and responsibilities requirement, and the Standard 4.3 risk obligation at once.
The fifth is professional development. The framework must specify the AI literacy training required of each staff category. Assessors need training on recognising AI-generated content, the Standard 1.4 authenticity obligations and how to meet them, the process for responding to authenticity doubt, and the documentation required when a concern is raised and resolved. Governing persons need training on the legislative obligations, the organisation's AI risk profile, and how to interpret AI incident data. Operational staff need training on the permitted, restricted and prohibited uses, data classification before use, and the escalation process. This sits inside the Standard 3.1 obligation to facilitate access to professional development and the Standard 3.2 obligation for assessors to maintain current skills, so the AI literacy requirement is part of the core PD obligation, not an add-on.
The sixth is incident response. The framework must define what counts as an AI-related incident, suspected student misuse in assessment, inappropriate staff use, privacy breaches from tool use, and AI-generated content errors affecting training or assessment, and for each specify who is notified, the investigation steps, how affected people are informed, the remediation available, and how the incident is recorded in the risk system. Incidents affecting student competency outcomes must run through the Standard 2.7 complaints and Standard 2.8 appeals frameworks with procedural fairness, and privacy incidents may trigger obligations under the Privacy Act, including mandatory notification under the Notifiable Data Breaches scheme in Part IIIC where a serious breach has occurred. The incident process must cross-reference these existing frameworks rather than stand alone.
The seventh is the monitoring and review cycle, addressed in the next section.
|
Minimum Framework Components |
|
A defensible AI governance framework must address: scope; permitted, restricted and prohibited uses; student disclosure and consent; accountability and decision rights; professional development; incident response; and a monitored review cycle. Each connects to an Outcome Standard the RTO already meets, which is why the framework extends existing systems rather than creating a parallel one. |
6. How Standard 4.4 Keeps the Framework Current
The pace of change in AI capability means any framework written today will need updating within months, and Standard 4.4 is the mechanism that manages this. It requires the RTO to monitor and evaluate its performance, to use the outcomes to inform continuous improvement, and to have mechanisms to lawfully collect and analyse data, including feedback from VET students, staff, industry, VET regulators, State and Territory training authorities, and employers of current or former students. Applied to AI, the framework becomes a living component of the quality system rather than a static document, and the improvement cycle should be built around those same named sources. Student feedback shows whether the disclosure and use policy is understood and whether the integrity process feels fair. Staff data shows whether the framework is applied consistently and whether professional development is lifting capability. Industry and employer feedback shows whether the approach aligns with current practice. Regulator data, including ASQA guidance, sector audit findings and publications, shows whether the framework remains consistent with regulatory expectations.
That regulator limb matters especially for AI. Because Standard 4.4 names VET regulators as a data source, ASQA guidance on AI, even when not prescriptive, should be brought into the monitoring and review cycle. A practice guide, a webinar, a regulatory newsletter, the draft AI Principles, or a published audit finding from another RTO are all regulator information that an RTO is expected to receive, analyse and use. RTOs that attend ASQA events, read its publications and feed that into their improvement cycles are demonstrating Standard 4.4 compliance in a way that those waiting passively for a prescriptive rule are not.
|
Standard 4.4 Makes the Framework Live |
|
An AI governance framework reviewed at least annually by the governing persons, informed by real data, AI incident reports, staff compliance information, student feedback and regulator guidance, and updated in response to both internal performance and external developments, demonstrates exactly what the Outcome Standards intend: a genuine commitment to quality beyond baseline compliance. A framework written once and filed does not. |
7. A Sample AI Policy Structure RTOs Can Adapt
The following is a structure, not a complete policy. It is a skeleton an RTO populates with content specific to its qualification mix, cohort, delivery modes and risk profile.
|
Policy Section |
Content Requirement and Legislative Anchor |
|
Purpose and scope |
State the purpose: to govern AI use across the RTO in accordance with Standards 4.1, 4.3 and 4.4. Define the tools and activities covered and who the policy applies to: governing persons, staff, contractors, students and third parties |
|
Principles |
State the responsible-AI principles (transparency, accountability, safety, fairness, ongoing monitoring) and map each to the Standard it enacts in the organisation's operations |
|
Permitted uses |
List the tools and activities staff and students may use without restriction, including conditions such as not processing personal information through offshore tools |
|
Restricted uses |
List the tools and activities requiring documented approval or oversight, and specify the approval process, oversight requirements and documentation retained |
|
Prohibited uses |
List what is not permitted under any circumstances, for example using AI to make or substantially inform a competency judgement, processing sensitive personal information through a commercial AI tool, or generating fraudulent training records |
|
Student obligations |
Set out disclosure of AI use where required, compliance with assessment integrity requirements, and the consequences of non-disclosure, linked to the Standard 2.1 pre-enrolment information obligation |
|
Staff accountability |
Map accountability to specific roles, governing persons, compliance officer, training managers and individual assessors, referencing Standard 4.1 and the Standard 4.2 roles and responsibilities obligation |
|
Professional development |
Specify AI literacy training by role, with minimum frequency, content and how completion is recorded, referencing Standard 3.2 |
|
Incident response |
Define incident categories and the response for each, including notification, investigation, communication, remediation and recording, cross-referencing Standards 2.7 and 2.8 and the Privacy Act |
|
Monitoring and review |
Specify the review cycle, data sources, responsible party and update process, referencing Standard 4.4, and state that the policy is updated in response to ASQA guidance, sector developments and internal performance data |
An RTO that populates this structure with content appropriate to its context, and has it approved by governing persons, holds a document that addresses Standard 4.1 (governing persons are diligent and have made informed decisions), Standard 4.2 (roles and responsibilities are defined), Standard 4.3 (risk is identified and controlled) and Standard 4.4 (a monitoring and review system exists). It also holds a document it can present at audit as evidence of managing AI with the genuine commitment to quality the Standards intend.
8. Addressing the Consultant Question
The participant who raised the concern about unverifiable consultant expertise identified a real governance challenge. An RTO that engages an external consultant to build its AI framework does not automatically satisfy Standard 4.1 by doing so. A governing person who delegates AI governance to a consultant without maintaining active oversight, asking informed questions, receiving comprehensible output and making independent decisions has not acted diligently. They have outsourced a governance responsibility, which the Standard does not permit.
This does not mean external expertise should be avoided. In many cases it should be sought, because AI governance involves legal, technical and regulatory knowledge not every leadership team holds, and engaging a consultant with demonstrable expertise in VET compliance, data privacy and AI governance is prudent. What matters is how the engagement is structured. The governing person's responsibility is to brief the consultant on the organisation's specific context and risk profile, to require output specific to that context rather than a generic template, to evaluate the output against the organisation's own assessment of its risks, to make independent decisions about what the framework contains, and to ensure it is integrated into operational systems rather than filed as a standalone document. A consultant who produces a generic policy without engaging with the RTO's qualification mix, cohort, delivery modes and existing compliance systems has not provided what the Standard 4.1 diligence requirement demands, and accepting such a document without scrutiny is itself a failure of diligence.
Conclusion: The Framework Is Already in the Building
The honest answer to the webinar question is that the framework the RTO is looking for is already in the building, distributed through the Standards it meets every day. Governing AI is not a new compliance regime awaiting a government template. It is Standard 4.1 diligence applied to a new risk, Standard 4.3 risk management extended to a new category, Standard 2.1 disclosure carrying new content, Standard 3.2 professional development covering a new literacy, and Standard 4.4 keeping all of it current. ASQA has signalled as much: its draft AI Principles will tie into the existing Standards, not add a separate one. So the RTO that says it has no framework is mistaken. It has four Quality Areas of the framework and a risk it has not yet mapped into them. The diligent response is not to wait for a blueprint that confirms what the Standards already require, but to populate the framework that exists, have the governing persons own it, and let Standard 4.4 keep it alive. An organisation that does this can answer the auditor's questions about AI before they are asked, because it will have made AI governance part of how it already works.
|
Key Takeaways for RTOs |
|
1. The absence of a prescriptive government AI framework is not a compliance pause. Standards 4.1, 4.3 and 4.4 require RTOs to act diligently, identify and manage risk, and run continuous improvement now. ASQA's draft AI Principles tie into the existing Standards rather than form new legislation. |
|
2. The responsible-AI principles, transparency, accountability, safety, fairness and ongoing monitoring, each map onto an Outcome Standards obligation. Governing AI is the application of existing Standards to a new risk, not a new obligation. |
|
3. Standard 4.1 requires governing persons to be actively engaged. Delegation to a consultant or junior staff member without active oversight does not satisfy the diligence and accountability requirements. |
|
4. Risk mapping under Standard 4.3 must cover assessment integrity (in both directions), privacy and data governance, workforce capability, and reputational and regulatory risk. |
|
5. A minimum framework addresses scope; permitted, restricted and prohibited uses; student disclosure; accountability mapping; professional development; incident response; and a monitored review cycle, with roles and responsibilities anchored in Standard 4.2. |
|
6. Standard 4.4 keeps the framework current: it must be incorporated into the RTO's monitoring system and updated in response to internal performance data and regulator guidance, including ASQA's AI material. |
|
7. Where an external consultant is engaged, governing persons must ensure context-specific output, evaluate and approve the framework independently, and integrate it into operational systems. |
References and Further Reading
National Vocational Education and Training Regulator (Outcome Standards for NVR Registered Training Organisations) Instrument 2025 (F2025L00354), Standards 1.4, 2.1, 2.4, 2.5, 2.6, 2.7, 2.8, 3.1, 3.2, 4.1, 4.2, 4.3 and 4.4, and the Explanatory Statement. https://www.legislation.gov.au
Australian Skills Quality Authority (2026). Sector workshops on the responsible use of AI in VET, including draft AI Principles. https://www.asqa.gov.au
Australian Skills Quality Authority (2026). Artificial Intelligence Transparency Statement, and Practice Guides for Quality Area 4: Governance. https://www.asqa.gov.au
Privacy Act 1988 (Cth), the Australian Privacy Principles and Part IIIC (Notifiable Data Breaches scheme). https://www.legislation.gov.au
Department of Industry, Science and Resources. Australia's AI Ethics Principles. https://www.industry.gov.au
