Building software for NSW Government: the rules a vendor has to meet

How do NSW digital rules differ from the federal rules?

NSW agencies follow their own AI, assurance, cyber, privacy and procurement rules, which run in parallel with the Commonwealth’s and are not the same. A vendor that knows the DTA policy and BuyICT still has to learn a different set of instruments for NSW.

Area	Commonwealth	NSW
AI	DTA policy for responsible use of AI	NSW AI Operational Policy and the AI Assessment Framework
Project assurance	Commonwealth assurance arrangements	Digital Assurance Framework and Gateway Reviews
Cyber	PSPF and ASD’s ISM	NSW Cyber Security Policy 2026 to 2027
Privacy	Privacy Act 1988 and the NDB scheme	PPIP Act, HRIP Act and the MNDB scheme
Buying	BuyICT panels, AusTender	buy.nsw, ICT Services Scheme, ICT Purchasing Framework

For the federal side, see our government AI and software page, the DTA AI policy guide and the guide to selling software to Australian government. The rest of this page is NSW only.

When does the NSW AI Assessment Framework apply, and what will the agency ask you for?

All NSW Government agencies must comply with the NSW AI Operational Policy under Circular DCS-2026-02 and use the AI Assessment Framework (AIAF) when designing, developing, deploying, procuring or using systems with AI components. From 30 September 2026 the AIAF Platform is mandatory for registering and assessing AI use cases. Registration decides whether a full assessment is needed. Systems assessed as high or critical risk go to the AI Secretariat for review by the NSW AI Review Committee.

The assessment belongs to the agency, but much of the evidence comes from the vendor. A practical vendor evidence pack:

1. Use case description. What the system does, for whom, and what decisions it informs.
2. Model and data. Which models, where they are hosted, what data they see, and whether that data is used for training.
3. Human oversight. Where a person reviews or approves outputs, and how they can override them.
4. Testing. How accuracy, bias and failure modes were tested, with results.
5. Security and privacy. Hosting location, access control, logging, and any privacy or cyber review completed.
6. Change control. How model, prompt or data changes are managed, since the framework requires reassessment after significant changes.

The AIAF itself is aligned to Australia’s AI Ethics Principles, so evidence framed around fairness, privacy, transparency and accountability maps cleanly. Our AI governance service covers how we prepare this material.

Which projects trigger the Digital Assurance Framework?

All ICT and digital projects with an estimated total cost of $5 million or more, regardless of funding source, must be registered with the Department of Customer Service through the Assurance Portal, along with every Digital Restart Fund project regardless of value. Registered projects are given a Project Tier from 1 (highest risk and profile) to 5 and a Project Assurance Plan that sets which Gateway Reviews apply. Projects under $5 million can still be nominated for review if they are strategically important or of concern.

The DAF’s gates, as described in the framework:

Gate	Focus	What the vendor typically supplies
1 Strategic alignment	Right problem, aligned with strategy and architecture	Options analysis, architecture notes
2 Business case	Benefits and plan	Cost and effort estimates, delivery approach
3 Pre execution	Delivery readiness, pre tender review	Delivery plan, risk register
4 Tender evaluation	Delivery against requirements	Tender response, milestone evidence
5 Pre commissioning	Readiness to go live and change management	Test results, cutover and support plans
6 Post implementation	Benefits realised, lessons learned	Usage and performance data

The AIAF page notes that AI projects over $5 million, or funded by the Digital Restart Fund, also receive central oversight to confirm AIAF compliance. Most work a small vendor takes on sits below the threshold, but it often feeds a larger program that doesn’t.

What does the NSW Cyber Security Policy pass on to suppliers?

The 2026 to 2027 NSW Cyber Security Policy applies to NSW departments, agencies and statutory authorities, and requires them to manage cyber risk from third party service providers through contracts, monitoring and ongoing reviews. Under section 8.4.2, agencies must set clear security requirements in contracts and enforce them, review third party compliance on a risk basis, keep a complete list of providers, and define in the contract how they will respond if a provider falls short, such as break clauses or offboarding.

The policy embeds Essential Eight Maturity Level One controls as mandatory requirements 3.3 to 3.10, and requires agencies to report all cyber incidents to Cyber Security NSW through the Cyber Portal within 24 hours of detection and classification. Agencies report their assessment against the mandatory requirements, and an attestation, by 31 October each year. ASD published ASD Essentials on 15 October 2026 to evolve the Essential Eight, but ASD says organisations should keep meeting obligations that require Essential Eight implementation or reporting, so the NSW mandatory requirements apply as written until the policy changes.

What a vendor should expect and prepare:

• a security schedule in the contract, and a questionnaire mapped to the mandatory requirements
• incident notification terms short enough for the agency to meet its 24 hour obligation
• evidence of the Essential Eight controls on any environment you operate for the agency
• support for the agency’s annual assessment, including details of any requirement you manage on its behalf

Our Essential Eight and ASD Essentials guide explains the controls for custom software, and how they map to the new framework.

How do the PPIP Act, HRIP Act and MNDB scheme affect your build?

NSW agencies are bound by the Privacy and Personal Information Protection Act 1998 (PPIP Act), and by the Health Records and Information Privacy Act 2002 (HRIP Act) for health information, rather than by the Commonwealth Privacy Act’s APPs. The IPC notes that the HRIP Act also reaches private sector organisations holding health information, which matters for vendors who host it.

Since 28 November 2023, the Mandatory Notification of Data Breach (MNDB) scheme in Part 6A of the PPIP Act requires an agency to notify the Privacy Commissioner and affected individuals of an eligible data breach. The agency has 30 days from becoming aware of a possible breach to assess it, must notify the Commissioner immediately once a breach is eligible, and must keep an internal breach register and a public data breach policy.

Design implications:

• audit logs good enough to show exactly which records were accessed
• a quick way to produce the list of affected individuals and their contact details
• vendor incident reporting that lets the agency start its 30 day assessment on day one
• clear separation of health information so HRIP obligations can be applied to it

How do NSW agencies buy software?

The ICT Services Scheme is a whole of government mandated arrangement for buying ICT goods and services, and agencies must use the ICT Purchasing Framework under Procurement Board Direction PBD-2025-03. The scheme is always open: a supplier first becomes a registered NSW Government supplier, then applies. Registered suppliers can take low risk contracts up to $150,000 (ex GST) using Core&; advanced suppliers can take higher risk contracts over $150,000, using Core& or MICTA/ICTA. Core& covers low risk ICT procurements up to $1 million (ex GST), and MICTA/ICTA covers high risk work or work over $1 million.

The SME and Regional Procurement Policy adds direct routes. Agencies may negotiate directly with an SME or regional supplier up to $150,000, and under PBD 2023-03 with small and medium businesses for goods and services, excluding construction, up to and including $250,000, even where mandated arrangements are in place. The policy defines an SME as an Australian or New Zealand enterprise with fewer than 200 full time equivalent employees. Local councils are not covered by that policy; see our local government software page for council buying.

AWLabs is not on the ICT Services Scheme or any NSW Government panel. An agency could only engage us directly through an exemption that fits its own procedures, or alongside a scheme supplier.

Should you design with the NSW Design System?

For NSW Government Masterbrand products, the NSW Design System marks its core styles, including logo, colour, typography, iconography and pictograms, as required. It provides components with code examples and a Figma UI kit, aligned with the NSW Government Brand Framework. Digital NSW’s design standards also ask services to comply with WCAG 2.2 at level AA, and AAA where achievable.

Confirm at the start whether the product sits on the Masterbrand or an agency brand, then build on the design system’s components rather than restyling them. It saves design time and makes accessibility review easier.

What does a typical NSW engagement look like?

Most first engagements with an agency are a discovery and prototype or a tightly scoped AI pilot, sized to fit a direct procurement route and built to produce assurance evidence as well as software. These are indicative AUD planning ranges, ex GST, not quotes. For context, Expeed publishes $40,000 to $150,000 for mid complexity custom software in Australia.

Engagement	Includes	Indicative range
Agency discovery and prototype	User research, service design, NSW Design System prototype, architecture options	$40,000 to $120,000
AI pilot with AIAF evidence	Working pilot, evaluation, evidence pack, privacy and cyber inputs, handover	$80,000 to $250,000

With AWLabs, the sequence is a Development Consult, a paid Discovery Audit, then a fixed price Schedule of Work with three options: The Minimum, The Recommended and The Complete. Senior engineers lead every build, with updates every Tuesday and Friday, Sydney business hours. We are based in Five Dock, Sydney. We have not yet delivered a project for a NSW agency, hold no security clearances or IRAP assessment, and are not on any NSW panel or scheme, so we say so before any agency spends time on us.

This page is general information, not legal or procurement advice.