The National AI Centre's Guidance for AI Adoption, Read for a 50-Person Business

The National AI Centre's Guidance for AI Adoption sets out six essential practices for using AI responsibly. A 50-person business should use its Foundations version. Start by naming an AI owner, writing a short policy, screening each use and listing your AI tools. Then add testing and human oversight.

This is general information, not legal advice.

What is the National AI Centre's Guidance for AI Adoption?

This is the Australian Government's guidance for responsible AI use, published by the National AI Centre in October 2025. The guidance updates and replaces the 2024 Voluntary AI Safety Standard. Its ten guardrails became six essential practices. Two versions exist, matched to how far an organisation has gone with AI.

The government describes the practices as helping organisations "put appropriate governance, oversight and transparency in place". They align with Australia's AI Ethics Principles and with international standards. So the same work carries over if larger customers later ask about your AI governance.

According to law firm Allens, the guidance "updates (and replaces) the VAISS". The standard's "10 voluntary guardrails" were condensed into the six practices. That matters if your board or an investor once asked about the guardrails. The six practices are now the reference point.

It is guidance, not legislation. Your existing obligations, such as privacy and consumer law, still apply to anything AI does in your name. The guidance helps you show you have thought about them.

Which version should a 50-person business use?

Most should use Foundations. It is written for teams that are starting out with AI or using it in low-risk ways. It also suits those new to AI governance. The implementation guidance is for organisations that build or customise AI, manage higher-risk uses or need stronger technical controls.

The test is your use, not your size. A 50-person firm drafting proposals and summarising calls with Claude or ChatGPT sits comfortably in Foundations. The same firm using AI to screen job applicants or decide customer credit is in higher-risk territory. For those uses, read the implementation guidance.

In the guidance's words, "the same AI tool can create different risks depending on how you use it". Its example is drafting marketing emails versus assessing job applications. So you can run Foundations for most of the business and the fuller version for one or two specific uses.

What are the six essential practices?

The six practices are: decide who is accountable, understand impacts and plan accordingly, and measure and manage risks. Then share essential information, test and monitor, and maintain human control. Each has "getting started" actions for early adopters and "next steps" for later. Together they form a baseline for responsible use.

The National AI Centre publishes templates for the policy, the risk screen and the register. Start from those rather than a blank page. The guide to writing an AI policy template shows how to keep the policy to one page.

What does the guidance ask a small business to do first?

Name a senior leader as AI governance owner and write a short AI policy. Screen each AI use for risk, and list every tool in a register. Test before relying on a tool, and make sure a person oversees anything with real stakes. Keep a record of each step, as the guidance asks.

The owner comes first for a reason. According to the Foundations guidance, AI complexity "can create gaps where no one takes clear responsibility for outcomes". That person should have "enough authority and understanding of AI capabilities and risks to oversee all AI use in your organisation". In a 50-person business, that is usually a founder or an operations lead.

The register catches more than most teams expect. The guidance says it should include AI "embedded in other systems, like human resources and customer engagement tools". Your CRM, help desk and recruitment software may all have AI features switched on already.

Testing also applies to things you buy. The first testing action is simply to "ask for proof". A supplier should be able to show how its system was tested.

Where do growing businesses usually fall short?

They tend to check outputs internally but stop there. Few tell customers when AI is involved or give people a way to raise concerns. Fewer build override points into their workflows. Oversight usually depends on whoever happens to read the output, rather than a named approver at a defined step.

The National AI Centre's own survey shows the pattern. Among SMEs using AI, the most common safeguard is checking outputs before they affect customers. Even so, "approximately half of current users have this in place". Transparency with customers and formal ways to raise concerns "lag significantly". That leaves roughly half without it as a standing safeguard.

Trust is also what holds non-adopters back. In the same survey, about 65% of non-adopters cited distrust of AI decisions or a preference for human control. Practice six answers that directly. It asks for "clear intervention points where humans can pause, override, roll back or shut down AI systems". Approval gates do exactly that, as the guide to human approval workflows explains.

How do you put the guidance into practice in a month?

Work through it in four weekly steps. Name the owner and adopt a policy, then build the register. Next, screen each use and set approvals. Finally, test and schedule a review. A 50-person business can reach the Foundations baseline this way without a governance team. After that, move to the "next steps" actions as use grows.

1. Week one: owner and policy. Name the AI governance owner. Adapt the policy template and share it.
2. Week two: register. List every AI tool and AI feature in use, who uses it and what data it touches.
3. Week three: screen and approve. Run each use through the risk screen. Name who approves anything sent, published or spent.
4. Week four: test and review. Trial new uses on real work, record the results and set a monthly review.

Keep it proportionate. The guidance itself says to adapt each practice "to fit your organisation's size, use cases and risk profile". The guide to AI governance for growing businesses shows how these practices fit with privacy and policy.

Skein builds human control into the system: connections start read only, and a named person approves anything published, sent or spent; the AI leadership page shows where that work starts. That suits a growing B2B business whose staff already use AI and whose leaders want governance that keeps up. A business building its own models for high-risk decisions needs the implementation guidance and specialist legal advice first.

Frequently asked questions

What is the Guidance for AI Adoption?

This is the Australian Government's guidance on responsible AI use, published by the National AI Centre in October 2025. It replaced the Voluntary AI Safety Standard, turning ten guardrails into six essential practices. A Foundations version suits early adopters, and a fuller implementation version covers higher-risk use.

What are the six essential AI practices?

There are six: deciding who is accountable, understanding impacts and planning accordingly, and measuring and managing risks. The rest are sharing essential information, testing and monitoring, and maintaining human control. Each has getting started actions for early adopters, plus further steps for more complex or higher-risk use.

Is the Guidance for AI Adoption mandatory?

It is guidance rather than legislation, so it does not create new legal duties on its own. Existing laws, such as privacy and consumer law, still apply to anything AI does for your business. Following the practices helps show you have managed those obligations sensibly. Check specific obligations with a lawyer.

Does the guidance apply to small businesses?

Yes. The Foundations version is written for organisations starting to use AI or using it in low-risk ways. That covers most small and mid-sized businesses. It says you need not do everything at once, and should adapt each practice to your size, uses and risk.

What replaced the Voluntary AI Safety Standard?

The Guidance for AI Adoption replaced it. Published by the National AI Centre in October 2025, it updated the Voluntary AI Safety Standard. The standard's ten voluntary guardrails became six essential practices. There is a Foundations version for early adopters and an implementation version for complex use.

Related reading