From policy to proof: Why Australia’s new AI standards start with your data foundation

For years, AI across Commonwealth, State, and Territory agencies has largely lived in the realm of pilot projects, proof-of-concepts, and isolated departmental experiments. But with central oversight now anchored in the Department of the Prime Minister and Cabinet, the message to public sector leadership is clear: deploying AI is no longer just a technical challenge, it is a governance imperative.

With greater central oversight and a strengthened Policy for the Responsible Use of AI in Government, the conversation is increasingly moving from experimentation to accountability.

But I think the biggest mindset shift is actually to stop starting the conversation with AI. Departments and agencies shouldn't start with the technology, they should start with the business outcome they're trying to create.

For the government, that might mean improving citizen services, reducing the time required to respond to an FOI request, helping an officer find information faster, improving policy decisions or reducing administrative workload.

What information do we need to achieve that outcome? Where is it? Who has access to it? Is it current? Is it appropriately classified? And most importantly, can we trust it?

This is why AI is no longer simply a technology challenge. It’s an information governance and accountability challenge. Innovation can no longer outpace accountability.

The hidden bottleneck: Public sector "data debt"

When agency leaders discuss AI readiness, the conversation often jumps straight to Large Language Models (LLMs), compute power, or vendor selection. But in my conversations with Senior Executive Service leaders and Chief Data Officers across ANZ, the real bottleneck isn't the AI model itself, it’s the data feeding it.

The government has decades of information sitting across EDRMS platforms, email, shared drives, business applications, scanned documents, physical records, microfiche, legacy media and older digital environments.

You can invest in an incredibly sophisticated AI platform, but if you connect it to fragmented, duplicated or poorly governed information, you're simply allowing AI to find and process bad information faster.

According to recent research from Iron Mountain and Vanson Bourne on AI Maturity in the Public Sector, nearly three-quarters of public sector organisations admit they are not highly effective at making their unstructured data trustworthy for AI applications.

In the new regulatory landscape, this "data debt" carries severe consequences:

• Copyright & IP exposure: Under the new national standards, feeding unverified or scraped Australian creative and intellectual property into AI pipelines without clear provenance creates immediate compliance and legal risks.
• Privacy breaches: Ingesting citizen records into generative AI models without automated Personally Identifiable Information (PII) redaction harms public trust and goes against national safety guidelines.
• Algorithmic hallucinations: Redundant, obsolete, trivial (ROT), duplicated or inaccurate information can lead AI systems to retrieve the wrong information while still producing an answer that sounds extremely convincing.

Put simply, AI is only as trustworthy as the data feeding it. Deploying AI over fragmented or poorly governed information guarantees flawed outputs and accelerates compliance risk.

Request an AI readiness assessment

Moving from policy to proof: A practical framework

To navigate this shift safely, agency leadership must treat data readiness as a strategic prerequisite rather than a post-deployment audit. Government already operates within significant information management, privacy, security, records management and procurement frameworks. The opportunity is to connect AI governance into those existing disciplines rather than build another governance function alongside them. Aligning your agency with the new Australian Standards for AI comes down to four critical pillars:

1. Establish rigorous data provenance

Before any dataset enters a Large Language Model (LLM) or Retrieval-Augmented Generation (RAG) architecture, its lineage must be mapped. Agencies need automated content classification to verify data origins, purge ROT data, and ensure training pipelines strictly respect IP and consent frameworks.

2. Embed automated privacy safeguards

Citizen safety and trust are non-negotiable. Modern AI governance requires automated, policy-driven PII redaction at scale, combined with mandatory human-in-the-loop checkpoints for high-stakes decisions before public outcomes are finalised.

3. Ensure sovereign and sustainable infrastructure

Compliance extends beyond the software layer. Incoming standards set clear expectations around grid responsibility, water efficiency, and local hosting. Agencies must ensure their cloud and physical storage partners operate within 100% renewable-powered, onshore data facilities while maintaining accredited IT asset lifecycle practices.

4. Connect AI governance to existing government obligations

Government agencies already operate within established frameworks spanning the Archives Act, Privacy Act, Protective Security Policy Framework (PSPF), ASD Information Security Manual (ISM), records management, procurement and data governance.

AI doesn't replace those obligations. It increases both the opportunity and responsibility associated with them.

As AI becomes embedded into workflows, citizen interactions and everyday decision-making, AI strategy, information management, cyber security, privacy, risk and business leadership must come into the same conversation.

How ready is your agency?

Buying an AI software platform is relatively easy. Becoming an AI-enabled organisation is much harder.

AI maturity shouldn't simply be measured by how many AI tools an agency has deployed. Our research shows only 35% of public sector organisations are considered advanced in AI maturity. At the same time, 60% of decision-makers agree that a unified strategy for operationalising and activating physical and digital information is critical.

At Iron Mountain, we’re helping government entities across Australia bridge the gap between policy mandates and practical execution. Our Intelligent Document Processing and Governance platforms Iron Mountain InSight® DXP empowers agencies to unlock the value of physical and digital assets, scrub sensitive data automatically, and maintain verified data lineage, ensuring AI deployment remains secure, compliant and audit ready.

Don't start with AI. Start with the outcome.

Understand the information you need to achieve your outcome, verify its trustworthiness, implement the right governance around it and importantly, bring your people with you. The future of government AI isn't about prioritising speed over compliance, it's about building trust from the foundation up.