This webpage details some key considerations to be observed when managing records in relation to AI systems and outputs.

It is not intended to outline how to implement or use AI in your agency comprehensively.

What is AI?

AI is a range of systems that use algorithms to performs tasks or produce outputs that would normally require human involvement.

A few of the most common AI system types are:

Generative AI uses a range of learning models to create new content based on instructions provided to them. The content it creates can be text, images, video, audio and/or code. Generative AI can create this content using a specified dataset or content published online (also known as training data).

Generative AI example: chatbots and text-to-image generators like Microsoft’s Copilot and Google’s ChatGPT.

Automation AI technologies perform tasks and actions that would usually be performed manually by a human.

Automated AI example: using Siri and Alexa to play a song or turn on the lights.

Machine learning and other decision-making AI technologies make decisions based on existing information created and managed by subject matter experts (this is also known as training data). These AI systems usually require tailored algorithms that are built specific to the organisation’s needs.

Combination AI technologies can do all of the above: create content, form decisions on that content, and then perform actions on that content within specific parameters and by using available limited data sets.

Information Management Requirements

In the conduct of government business, agencies are required to keep accurate records to comply with the State Records Act 1997 (SR Act) and to meet business and legislative requirements. This also applies to the development and use of AI.

These “official records” are defined in the SR Act as a ‘record made or received by an agency in the conduct of its business’.

Just like any other project or program undertaken by your agency, official records in relation to AI are required to be created, captured and managed to provide evidence of decisions made and events that have occurred.

Why is this important?

Ensuring your agency properly manages such records will identify:

  • if AI technology was used to influence the decision, take the action or generate the content
  • if the content produced through AI technologies is accurate and relevant
  • what the agency has done to mitigate any negative impacts
  • the outputs and decisions AI generate are explainable, auditable and transparent.

AI official records

There are two main types of official records created in relation to AI:

  1. Records that support all elements of the systems lifecycle including development, implementation, management and disposal. They should also include records that address bias, intellectual property and accuracy. Examples include:
    • project planning
    • risk assessment
    • system design and algorithm development
    • testing protocols and outcomes
    • system policies and procedures, including ownership, responsibility and attribution
    • dataset(s) to be accessed and used by the system (training data) and
    • system assessment and monitoring schemes.
  2. Content generated by the AI system including the prompts or instructions used to retrieve it.

State Records Standards

As is the case with all official records created and received by your agency, the records created as described in the above examples must be managed in accordance with Standards issued under the SR Act. This ensures their value, ownership, accessibility and retention is maintained.

See our Information Management Strategy and Standards page for all State Records Standards.

Our Standards hold your agency accountable for the care and management of official records, including:(external site) (external site)

Your agency must create and keep official records to support business objectives, meet compliance obligations and mitigate risk.

The purpose and function of machine learning/automation AI systems is to process data, not manage it. Therefore, the systems themselves are not expected to meet the requirements established by the Managing Digital Records in Systems Standard or Metadata Standard.

However, the data used to train the AI system should be a duplication of source data that is stored in a system that is compliant with these standards.  This will ensure the source of truth is not inadvertently manipulated.

All other official records relating to an AI system mentioned above, including the decisions made and content generated, must be store in compliant systems as well.

Disposal of AI models, training data and decision logs must be managed in accordance with Records Disposal Schedules or General Disposal Schedules.

A privacy impact assessment should be conducted if an AI system collects and/or processes personal information.

Access and discovery processes should be in place for the purpose of administrative disclosure and applications received under the Freedom of Information Act 1991.

Version controls must be applied to AI models so that updates and changes made over time are transparent. A mechanism must be in place to track changes to training data and revalidate models periodically.

Page last updated: 17 April 2025