Australia publishes the Voluntary AI Safety Standard with 10 guardrails

The Voluntary AI Safety Standard (VAISS) is non-binding guidance that sets out ten guardrails for organisations developing and deploying artificial intelligence in Australia.

Australia's government released the standard in 2024, with the Department of Industry, Science and Resources recording a publication date of 5 September 2024.

What it is

VAISS also includes definitions, links to tools and resources, and information on how AI interacts with other business guidance and regulations.

The guardrails apply to all organisations throughout the AI supply chain, and they include transparency and accountability requirements across the supply chain.

Being voluntary, the standard does not create new legal duties about AI systems or their use.

What it requires

Guardrail one calls on organisations to establish, implement and publish an accountability process including governance, internal capability and a strategy for regulatory compliance.

Guardrail three requires organisations to protect AI systems, and implement data governance measures to manage data quality and provenance.

Guardrail five asks organisations to enable human control or intervention in an AI system to achieve meaningful human oversight across the life cycle.

Guardrail six requires organisations to inform end-users regarding AI-enabled decisions, interactions with AI and AI-generated content.

Guardrail nine requires organisations to keep and maintain records to allow third parties to assess compliance with guardrails.

The department says this means Australian businesses can be sure that if they comply with the Voluntary AI Safety Standard, they will also comply with international laws.

Adopting all ten guardrails is meant to create a foundation for safe and responsible AI use and to make it easier for an organisation to comply with any potential future regulatory requirements in Australia and emerging international practices.

What security leaders should do

Treat the ten guardrails as a mapping exercise against existing AI governance, risk management and data-protection programs, since the structure tracks familiar security-governance functions such as accountability, risk assessment, testing, monitoring and record-keeping. Because adoption is voluntary and creates no new legal duties, leaders should position VAISS alignment as evidence of AI assurance for boards, customers and regulators rather than as a compliance deadline. Most organisations act as deployers relying on externally built AI systems, so early effort is best directed at the guardrails covering AI system protection and data governance, human oversight, and supply-chain transparency with vendors. Building the record-keeping evidence the standard describes now can reduce the work needed later if voluntary guidance in Australia is followed by mandatory AI requirements.