Australian sector overlays (framework self-assessment)

⚡ Generate from source material ⬇ Export .yarnpack.json Advanced: raw JSON

Metadata

Scales, categories & audiences

Scales: maturity5 (5 levels) · Categories: crosscut inherit sector · Audiences: lead owner exec

Edit these in the raw JSON editor below — they change rarely and carry structure (levels, signals, deep-dive wiring) that a form would mangle.

Sectors elements core

Everyone answers these. The accountable official or executive owner for AI; privacy; WHS or people; clinical or service quality leads; procurement and contracts; whoever holds the funding agreements and board reporting.

Id	Question	Type	Category	Scale
xc-adm-inv	If someone asked tomorrow which of your systems decide or help decide something about a person, such as a shift, an eligibility outcome or a grant, could you hand them the list? Who keeps it?	scored_text · scored	crosscut	maturity5
xc-adm-policy	Where in your privacy policy would a customer or client read that a computer helps decide things about them, and what it looks at? Who signed that wording off?	scored_text · scored	crosscut	maturity5
xc-whs	Does any software here decide who works when, watch how people work, or hand out tasks? If SafeWork asked how it was designed and why it is safe, what would you show them?	scored_text · scored	crosscut	maturity5
xc-esafety	Do members of the public chat with an AI of yours? If eSafety sent you a transparency notice on Monday, who would answer it and from what records?	scored_text · scored	crosscut	maturity5
in-map	When you sign a funded program, who reads the AI assurance clauses? If four different regulators could each ask about the same tool, which standard do you build it to?	scored_text · scored	inherit	maturity5
in-audit	If the NDIS Commission or a funder asked what you had in place the day an AI tool made a particular decision, what would you hand over besides the policy?	scored_text · scored	inherit	maturity5
sec-gov	If your minister’s office asked this afternoon for a list of every AI use in the agency and who owns it, how long would it take? Which of them went to the review committee?	scored_text · scored	sector	maturity5
sec-health	Does any clinician here use an AI scribe or a tool that suggests a diagnosis or a dose? What does the patient hear about it, and who answers for the note or the decision?	scored_text · scored	sector	maturity5
sec-fin	Which of your critical operations now rest on a model or an AI vendor, and are they on your CPS 230 list? When did the board last discuss AI as a risk rather than a project?	scored_text · scored	sector	maturity5
sec-edu	What do your teachers or lecturers tell students they can and cannot do with GenAI, and where is it written down? If TEQSA asked how you protect assessment integrity, who answers?	scored_text · scored	sector	maturity5

＋ Add question to “Sectors elements”

Add section

Advanced — raw JSON

Full pack document, validated on save (schema yarn-pack/2). This is where scales, audiences, structured conditions and adaptive config live.

{
  "schema": "yarn-pack/2",
  "id": "framework-ausector",
  "version": "0.1.0",
  "name": "Australian sector overlays (framework self-assessment)",
  "engagement": "AISG — framework self-assessment: workshop prep, workshop, or diagnostic strand",
  "intro": "A guided conversation against Australian sector overlays, not a form. Answer in your own words and name the document or record that shows it if you can. About 20 minutes. Assesses an organisation against the Australian sector regulators and cross-cutting duties that bite today: OAIC, WHS, eSafety, government, health, finance and education. Not the voluntary GfAA or the AI6.",
  "tone_default": "professional",
  "prefill_fields": {
    "department": [
      "Executive",
      "Finance",
      "Operations",
      "Customer / Sales",
      "Technology / IT",
      "Data & Analytics",
      "People & Culture",
      "Risk & Compliance",
      "Marketing",
      "Product"
    ]
  },
  "scales": [
    {
      "id": "maturity5",
      "name": "Maturity (distilled model)",
      "levels": [
        {
          "value": 1,
          "label": "Does not exist",
          "gloss": "No capability. Absent, or purely ad hoc / accidental."
        },
        {
          "value": 2,
          "label": "Partially exists",
          "gloss": "Emerging and inconsistent. Pockets of activity, not joined up."
        },
        {
          "value": 3,
          "label": "Fully exists",
          "gloss": "Defined, documented and operating across the organisation."
        },
        {
          "value": 4,
          "label": "Fully exists & optimised",
          "gloss": "Measured, refined and improving against targets."
        },
        {
          "value": 5,
          "label": "Fully exists & adaptive",
          "gloss": "Continuously self-adjusting; a source of advantage."
        }
      ],
      "signals": {
        "1": [
          "no ",
          "not ",
          "none",
          "never",
          "don't",
          "do not",
          "nothing",
          "absent",
          "unaware",
          "haven't",
          "ad hoc",
          "ad-hoc",
          "nonexistent",
          "no idea",
          "not really"
        ],
        "2": [
          "some ",
          "starting",
          "beginning",
          "emerging",
          "pilot",
          "trial",
          "informal",
          "inconsistent",
          "pockets",
          "a bit",
          "occasionally",
          "early",
          "experiment",
          "trying",
          "patchy"
        ],
        "3": [
          "documented",
          "defined",
          "standard",
          "standardised",
          "established",
          "policy",
          "framework",
          "process",
          "consistent",
          "across the",
          "in place",
          "formal",
          "governed",
          "rolled out"
        ],
        "4": [
          "measured",
          "metrics",
          "optimis",
          "improving",
          "kpi",
          "monitored",
          "reviewed",
          "refined",
          "benchmarked",
          "targets",
          "tracked",
          "mature",
          "regularly review"
        ],
        "5": [
          "continuous",
          "adaptive",
          "self-",
          "automated end",
          "best in class",
          "best-in-class",
          "competitive advantage",
          "industry leading",
          "always",
          "real-time monitoring",
          "feedback loop"
        ]
      }
    }
  ],
  "categories": [
    {
      "id": "crosscut",
      "name": "Cross-cutting regulators",
      "order": 1,
      "target_default": 3
    },
    {
      "id": "inherit",
      "name": "Inheritance",
      "order": 2,
      "target_default": 3
    },
    {
      "id": "sector",
      "name": "Sector duties",
      "order": 3,
      "target_default": 3
    }
  ],
  "audiences": [
    {
      "id": "lead",
      "name": "Governance / risk lead",
      "desc": "Owns the policy, the register or the risk framework",
      "deep_dive_sections": []
    },
    {
      "id": "owner",
      "name": "System or use-case owner",
      "desc": "Runs an AI system or use case day to day",
      "deep_dive_sections": []
    },
    {
      "id": "exec",
      "name": "Executive / sponsor",
      "desc": "Accountable for the outcome, not the mechanics",
      "deep_dive_sections": []
    }
  ],
  "sections": [
    {
      "id": "core",
      "title": "Sectors elements",
      "blurb": "Everyone answers these. The accountable official or executive owner for AI; privacy; WHS or people; clinical or service quality leads; procurement and contracts; whoever holds the funding agreements and board reporting.",
      "optional": false,
      "questions": [
        {
          "id": "xc-adm-inv",
          "type": "scored_text",
          "category": "crosscut",
          "name": "ADM inventory: decisions in scope",
          "text": "If someone asked tomorrow which of your systems decide or help decide something about a person, such as a shift, an eligibility outcome or a grant, could you hand them the list? Who keeps it?",
          "scale": "maturity5",
          "scored": true,
          "star": false,
          "rubric": {
            "1": "Nobody can list which rostering, eligibility, triage or grant-assessment tools make or support decisions about people, or say whether the entity is over $3m turnover.",
            "3": "A register lists each substantially automated decision, the personal information used, the kinds of decisions and whether technology plays a material role, owner per row.",
            "5": "New tools enter the register at intake; entries are reviewed on a cadence and re-scoped when the OAIC guidance lands, so the list stays current without a project."
          },
          "help": "Evidence that would show it: Register of substantially automated decisions with an owner per row; Intake form that asks whether a tool makes or supports decisions about people; Shadow AI register with decision-support tools captured; Turnover and APP-entity status confirmed in writing.",
          "adaptive": {
            "allow_probe": true,
            "allow_skip": false,
            "max_probes": 1
          },
          "ai_drafted": false
        },
        {
          "id": "xc-adm-policy",
          "type": "scored_text",
          "category": "crosscut",
          "name": "ADM privacy policy disclosure",
          "text": "Where in your privacy policy would a customer or client read that a computer helps decide things about them, and what it looks at? Who signed that wording off?",
          "scale": "maturity5",
          "scored": true,
          "star": false,
          "rubric": {
            "1": "The privacy policy is silent on automated decisions, or the entity has not yet decided whether any decision is in scope.",
            "3": "The privacy policy carries the ADM paragraph for every in-scope decision, approved by the accountable owner, and the wording matches the register.",
            "5": "The paragraph is regenerated from the register whenever an entry changes and the change is logged, so the policy never lags the systems it describes."
          },
          "help": "Evidence that would show it: Published privacy policy with the ADM paragraph; Approval record for the disclosure wording; Change log linking policy edits to register entries.",
          "adaptive": {
            "allow_probe": true,
            "allow_skip": false,
            "max_probes": 1
          },
          "ai_drafted": false
        },
        {
          "id": "xc-whs",
          "type": "scored_text",
          "category": "crosscut",
          "name": "Algorithmic management under WHS",
          "text": "Does any software here decide who works when, watch how people work, or hand out tasks? If SafeWork asked how it was designed and why it is safe, what would you show them?",
          "scale": "maturity5",
          "scored": true,
          "star": false,
          "rubric": {
            "1": "AI-assisted rostering or monitoring runs with no record of which codes apply or what controls justify a departure; nobody watches the Digital Work Systems Act.",
            "3": "Each such system is mapped to the codes it touches, the controls are documented and consulted with workers, and a named owner tracks the s21A duty’s proclamation.",
            "5": "Design changes to these systems trigger a fresh code check and consultation as a matter of course, and controls are updated when the guidelines or proclamation land."
          },
          "help": "Evidence that would show it: List of AI-assisted rostering, monitoring or task-allocation systems; Code-of-practice mapping with a comply-or-justify record per system; Worker consultation and psychosocial hazard assessment records; Watch entry for the Digital Work Systems Act proclamation.",
          "adaptive": {
            "allow_probe": true,
            "allow_skip": false,
            "max_probes": 1
          },
          "ai_drafted": false
        },
        {
          "id": "xc-esafety",
          "type": "scored_text",
          "category": "crosscut",
          "name": "Online safety for conversational AI",
          "text": "Do members of the public chat with an AI of yours? If eSafety sent you a transparency notice on Monday, who would answer it and from what records?",
          "scale": "maturity5",
          "scored": true,
          "star": false,
          "rubric": {
            "1": "A consumer-facing chatbot or companion runs with nobody owning online safety and no way to answer a transparency notice from records.",
            "3": "The product is mapped to the Basic Online Safety Expectations, an owner is named, harms are logged as incidents, and a transparency notice is answerable from records.",
            "5": "Safety controls and disclosures are reviewed whenever eSafety acts or warns, and incident trends change the product without waiting for a notice."
          },
          "help": "Evidence that would show it: Register entry naming the consumer-facing conversational product and its owner; Mapping of the product to the Basic Online Safety Expectations; Incident log for user harms arising from the product.",
          "adaptive": {
            "allow_probe": true,
            "allow_skip": false,
            "max_probes": 1
          },
          "ai_drafted": false
        },
        {
          "id": "in-map",
          "type": "scored_text",
          "category": "inherit",
          "name": "Map of inherited sector expectations",
          "text": "When you sign a funded program, who reads the AI assurance clauses? If four different regulators could each ask about the same tool, which standard do you build it to?",
          "scale": "maturity5",
          "scored": true,
          "star": false,
          "rubric": {
            "1": "Nobody has listed the sectors served, the funding agreements carrying assurance expectations, or which regulator remits reach the AI in use.",
            "3": "A single map names each service line, its funding agreements, the AI assurance clauses in them and the regulator remits that apply; one baseline is set to the strictest.",
            "5": "New contracts and service lines update the map at signing, and the baseline is raised when any inherited expectation tightens, with the change recorded."
          },
          "help": "Evidence that would show it: Map of service lines to funding agreements and regulator remits; Extract of AI assurance clauses from funding contracts; One governance baseline with a crosswalk to each sector’s language.",
          "adaptive": {
            "allow_probe": true,
            "allow_skip": false,
            "max_probes": 1
          },
          "ai_drafted": false
        },
        {
          "id": "in-audit",
          "type": "scored_text",
          "category": "inherit",
          "name": "Internal audit loop on inherited duties",
          "text": "If the NDIS Commission or a funder asked what you had in place the day an AI tool made a particular decision, what would you hand over besides the policy?",
          "scale": "maturity5",
          "scored": true,
          "star": false,
          "rubric": {
            "1": "The policy exists but nothing checks it is operating; asked what was in place when a tool made a decision, only the policy document could be produced.",
            "3": "An assurance schedule tests inherited controls on a fixed cadence, results sit in an evidence register, and each finding has an owner and a close date.",
            "5": "Audit findings change the baseline and the schedule itself; evidence is produced per decision without a scramble when a commission or funder asks."
          },
          "help": "Evidence that would show it: Assurance schedule covering inherited obligations; Verification log with control test results; Independent challenge or internal audit report on AI controls.",
          "adaptive": {
            "allow_probe": true,
            "allow_skip": false,
            "max_probes": 1
          },
          "ai_drafted": false
        },
        {
          "id": "sec-gov",
          "type": "scored_text",
          "category": "sector",
          "name": "Government: register, owner, assessment",
          "text": "If your minister’s office asked this afternoon for a list of every AI use in the agency and who owns it, how long would it take? Which of them went to the review committee?",
          "scale": "maturity5",
          "scored": true,
          "star": false,
          "rubric": {
            "1": "No inventory of AI use cases can be produced on request, no accountable official is named, and high- or critical-risk cases are not referred anywhere.",
            "3": "Every AI use case is registered, an accountable official is named, assessments run where required, and high- or critical-risk cases go to the review committee.",
            "5": "Registration triggers assessment on its own, transparency statements and incident reports are produced from the register, and staff training is refreshed on a cadence."
          },
          "help": "Evidence that would show it: AI use-case register with the accountable official named; AIAF or AI impact assessment records per use case; Published AI transparency statement; AI incident reports and referrals to the AI Review Committee.",
          "adaptive": {
            "allow_probe": true,
            "allow_skip": false,
            "max_probes": 1
          },
          "ai_drafted": false
        },
        {
          "id": "sec-health",
          "type": "scored_text",
          "category": "sector",
          "name": "Health: TGA, AHPRA and clinical duty",
          "text": "Does any clinician here use an AI scribe or a tool that suggests a diagnosis or a dose? What does the patient hear about it, and who answers for the note or the decision?",
          "scale": "maturity5",
          "scored": true,
          "star": false,
          "rubric": {
            "1": "AI scribes or clinical tools are in use with no view on whether the TGA captures them, no consent wording for patients and no record of who answers for the output.",
            "3": "Each clinical AI tool has a recorded intended purpose and TGA position, patients are informed and consent is recorded, and a named practitioner owns each decision.",
            "5": "New clinical tools are screened for intended purpose before pilot; consent wording and practitioner guidance are updated when TGA, AHPRA or RACGP guidance changes."
          },
          "help": "Evidence that would show it: Register of clinical AI tools with intended purpose and TGA position; Patient information and consent record for AI use; Practitioner guidance on human judgement and the tool’s limits; Vendor register entry for AI scribe products.",
          "adaptive": {
            "allow_probe": true,
            "allow_skip": false,
            "max_probes": 1
          },
          "ai_drafted": false
        },
        {
          "id": "sec-fin",
          "type": "scored_text",
          "category": "sector",
          "name": "Financial services: CPS 230 and APRA letter",
          "text": "Which of your critical operations now rest on a model or an AI vendor, and are they on your CPS 230 list? When did the board last discuss AI as a risk rather than a project?",
          "scale": "maturity5",
          "scored": true,
          "star": false,
          "rubric": {
            "1": "No AI inventory exists, AI vendors are missing from the material service provider list, and the board has not been briefed on AI in its own terms.",
            "3": "An AI inventory exists, each model underpinning a critical operation is a CPS 230 material service, human-in-loop is set for high-risk uses, the board is AI literate.",
            "5": "Inventory and service-provider registers update together at onboarding and material change; the board receives AI risk reporting on a cadence and challenges it."
          },
          "help": "Evidence that would show it: AI inventory with a lifecycle owner per entry; CPS 230 material service provider register including AI vendors; Board AI literacy and briefing records; Human-in-loop decision recorded per high-risk use case.",
          "adaptive": {
            "allow_probe": true,
            "allow_skip": false,
            "max_probes": 1
          },
          "ai_drafted": false
        },
        {
          "id": "sec-edu",
          "type": "scored_text",
          "category": "sector",
          "name": "Education: GenAI frameworks and TEQSA",
          "text": "What do your teachers or lecturers tell students they can and cannot do with GenAI, and where is it written down? If TEQSA asked how you protect assessment integrity, who answers?",
          "scale": "maturity5",
          "scored": true,
          "star": false,
          "rubric": {
            "1": "GenAI is used in teaching or assessment with no stated position, no staff or student guidance, and no answer on assessment integrity.",
            "3": "A position on GenAI use is published, staff and students have acceptable-use guidance, and assessment integrity has an owner and a documented approach TEQSA could review.",
            "5": "Guidance is revised each term from incidents and new tools, and assessment design changes ahead of the frameworks rather than after a breach."
          },
          "help": "Evidence that would show it: Position statement on GenAI in teaching and assessment; Acceptable use guidelines for staff and students; Assessment integrity approach with a named owner.",
          "adaptive": {
            "allow_probe": true,
            "allow_skip": false,
            "max_probes": 1
          },
          "ai_drafted": false
        }
      ]
    }
  ],
  "grids": {},
  "outputs": [
    "Level per element and per category, gated",
    "Contested-element view (spread of 2 or more)",
    "Coverage of evidence: confirmed, stated, inferred",
    "Where to start, foundations first",
    "Printable client report"
  ],
  "report_defaults": [
    "rpt-maturity-standard"
  ],
  "playbook": {
    "sequence": [
      "inherit",
      "crosscut",
      "sector"
    ],
    "sequence_note": "Register first, accountable owner named, assessment second. The common failure is not the policy; it is that nobody can produce the inventory when asked. Build to the high-water mark once.",
    "actions": {
      "inherit": {
        "to_3": [
          "List every sector you deliver in and every funding agreement that carries AI assurance expectations; the contract is the transmission line.",
          "Set one internal AI governance baseline built to the strictest inherited expectation, then map it to each sector’s language."
        ],
        "to_5": [
          "Run an internal audit loop on inherited obligations on a fixed cadence, since no external regulator will force one on you."
        ]
      },
      "crosscut": {
        "to_3": [
          "Find every substantially automated decision using personal information before 10 December 2026; the inventory is the hard half.",
          "Check AI-assisted rostering, monitoring or task allocation against the enforceable NSW codes: follow the code or prove equivalent controls.",
          "Name an owner for any consumer-facing conversational product and map it to the Basic Online Safety Expectations."
        ],
        "to_5": [
          "Track the OAIC guidance and the Digital Work Systems proclamation, and update the registers and controls the week each lands."
        ]
      },
      "sector": {
        "to_3": [
          "Meet each hard sector’s duty in its own terms: use-case register and accountable official, AI inventory and human-in-loop, patient consent."
        ],
        "to_5": [
          "Refresh sector citations each quarter; this layer decays faster than anything else in the library."
        ]
      }
    }
  }
}

Australian sector overlays (framework self-assessment) v0.1.0

Metadata

Scales, categories & audiences

Sectors elements core

Add section

Advanced — raw JSON