AI Policy Implementation

Understand the practical requirements, timeframes, and compliance obligations for implementing AI policy inside a public sector agency.

Define the scope of an agency-specific AI policy or framework, so it is specific, usable on the ground, and aligned to the agency’s AI ambitions, risk profile and operating context.

Concept Briefing

Unpacking June/December 2026 mandatory requirements, OECD benchmarks, and three AI maturity stages — experimenting, scaling, and embedding. Introducing the DTA AI impact assessment tool as a mandatory compliance obligation: what it is (a structured 12-section risk and impact assessment), what it produces (an inherent risk rating of low, medium, or high for each use case), and the 15 December 2026 implementation deadline. The tool is the diagnostic input that feeds accountability, prioritisation, and oversight decisions covered in Modules 2, 3, and 4.

Expert Debrief

Unpacking Robodebt’s failure: why automating processes to remove human cost strips away vital governance safeguards and why getting accountability structures right must come before deploying AI. Connecting the DTA tool: a completed impact assessment would have flagged the risks, but without a named person accountable for outcomes, the assessment would have been filed and ignored.

Personal Canvas Update

Attendees map their department’s maturity stage, identify which of their agency’s active or planned AI use cases are in scope of the DTA mandatory impact assessment requirement, and establish initial policy safeguards.

Module Learning Outcome:

Identify the governance artefacts needed for implementation, including AI registers, reporting lines, roles, accountabilities, escalation pathways, assurance checkpoints and evidence trails.

Concept Briefing

The role of committee oversight and its limitations. Establishing a single named executive who owns the outcome — not a committee, not a shared responsibility, but one person whose name is on the decision. Introducing AI policy structures: accountability organised around services or outcomes (not internal divisions), centralised vs decentralised decision-making, accountability layers from the team delivering the work up to the executive owning the portfolio, and rapid escalation pathways.

Connecting the DTA tool’s risk ratings to the accountability structure. The risk rating determines which level owns the decision: low-risk use cases are governed at the team level within existing authority; medium-risk use cases are owned by a named person at the product level who engages directly with the CISO, privacy team, and legal as subject matter inputs; high-risk use cases are owned at the portfolio level because they implicate agency-wide standards — PSPF, APP, the AI policy itself.

Group Breakout

Small groups analyse Scenario 2 and answer accountability mapping questions. Where time permits, Scenario 5 (reserve) is also used.

Expert Debrief

AI failure modes and the cost of slow decisions — how committee-based governance inflates the time between identifying a risk and acting on it. Where Scenario 5 has been used: how a single named person at the product level engages directly with the portfolio-level owner of cross-cutting standards (privacy, PSPF, AI policy) rather than routing through a working group, and how operating rules written into contracts and instruction sets enforce those standards at the point of execution.

Personal Canvas Update

Attendees assign a single named person accountable for outcomes on active departmental AI initiatives. For each initiative, map the DTA risk rating (low, medium, or high) to the accountability level that should own it — team, product, or portfolio.

Module Learning Outcome:

Assess AI use cases through a practical purpose, relevance, benefit, risk, data quality, ROI and public value lens before deciding whether to proceed, pause, redesign or reject.

Concept Briefing

The DTA impact assessment tool answers “have we identified the risks” — it does not answer “should we do this” or “is this delivering value.” This module covers the value question. Measuring outcomes, not just outputs — using Evidence-Based Management (EBM) to assess whether AI investments are delivering real value. Structuring a four-sentence investment case that includes a pre-committed decision rule (what you will do if results come in above or below threshold). Sequencing execution based on the cost of waiting — the value lost every week in a high-value initiative sits in the queue. The DTA risk rating acts as a pre-filter: use cases rated at high inherent risk require additional governance actions under the AI policy before they enter the economic prioritisation queue.

Group Breakout

Small groups review Scenario 3 to size proposals and calculate a value-per-week prioritisation score (Cost of Delay Divided by Duration, or CD3).

Group Playback

Tables present their investment cases, outcome measurement findings, and sequencing decisions.

Expert Debrief

Deconstructing sunk-cost fallacy and implementing decision rules agreed before the pilot starts — Pivot (change direction), Pause (wait for more data), Persevere (continue as planned), or Pull (stop and reallocate).

Personal Canvas Update

Attendees draft four-sentence investment cases for two active agency proposals. For each, confirm the DTA risk rating is complete and note the additional governance actions required if rated high.

Module Learning Outcomes:

Recognise and manage key AI implementation risks, including privacy, cyber security, data management, bias, false positives, supplier risk, sovereignty, ethical use, human oversight and public trust.

Develop a step-by-step AI policy implementation roadmap that starts small, uses case studies and proof points, supports culture change, and balances compliance with responsible AI uptake.

Concept Briefing

Push decisions down to the team — except where the action can’t be undone. The DTA tool’s risk rating determines where the irreversibility boundary sits. For low-risk use cases, the boundary is far downstream and the team governs through its own instruction sets. For medium-risk use cases, the product-level owner defines which specific actions require human sign-off before execution — data leaving the jurisdiction, retention period expiry, model retraining on citizen data. For high-risk use cases, the portfolio-level owner sets the boundary and certain actions may require executive sign-off. Governing what AI agents are and aren’t allowed to do through version-controlled instruction sets that encode the irreversibility boundary. Learning that questions the system design, not just the results — and the three-step structural sequence: diagnose the accountability gap, assign nmed ownership, then pilot under observation.

Group Breakout

Small groups unpack Scenario 4 to isolate technical failure points.

Group Playback

Tables outline their human oversight thresholds and instruction set revisions.

Expert Debrief

Establishing "Start Small and Public" pilots — visible, low-risk, time-limited — and safeguarding the professional capability pipeline so junior staff continue building judgement as routine tasks automate. Human change beyond “communications and training” — why adoption fails when agencies treat change as a broadcast problem rather than a capability, identity, and workflow redesign problem, and what the 90-day pilot needs to include to bring people along rather than drag them forward.

Personal Canvas Update

Attendees finalise their 90-day pilot roadmap and canvas actions. For each pilot, confirm the irreversibility boundary placement based on the DTA risk rating and name the person accountable for enforcing it.