FOI 24/25-1217

OFFICIAL

Use of Artificial Intelligence, Generative AI, and Machine Learning — Interim Policy

Version 1.0 — April 2024 OCIO

ndis.gov.au

ndis

Use of Artificial Intelligence, Generative AI, and Machine Learning Interim Policy 1

OFFICIAL

Policy Summary

The National Disability Insurance Agency (NDIA or the ‘Agency’) requires all staff (including contractors and partner staff) to implement and adhere to the Agency Policies and Procedures. This document establishes the policy for Use of Artificial Intelligence, Generative AI, and Machine Learning in the Agency.

Document Control

Approval Status Log

Use of Artificial Intelligence, Generative AI, and Machine Learning Interim Policy 2

OFFICIAL

Table of Contents

Use of Artificial Intelligence, Generative AI, and Machine Learning – Interim Policy………………………………………………………………………………………….1

Policy Summary……………………………………………………………………………………………………………………………………………………………………………2

1. Introduction……………………………………………………………………………………………………………………………………………………………………………4

2. Purpose…………………………………………………………………………………………………………………………………………………………………………………..4

3. Applicability……………………………………………………………………………………………………………………………………………………………………………4

   3.1. Policy exclusions………………………………………………………………………………………………………………………………………………………………..4

   3.2. Policy exemptions………………………………………………………………………………………………………………………………………………………………..5

4. Policy Principles……………………………………………………………………………………………………………………………………………………………………..5

5. Roles and responsibilities……………………………………………………………………………………………………………………………………………………6

   5.1. Chief Information Officer (CIO)………………………………………………………………………………………………………………………………………6

   5.2. AI Working Group………………………………………………………………………………………………………………………………………………………………6

   5.3. Project Team………………………………………………………………………………………………………………………………………………………………………6

   5.4. Copilot trial members………………………………………………………………………………………………………………………………………………………..7

6. Non-compliance………………………………………………………………………………………………………………………………………………………………………7

7. Authority and review………………………………………………………………………………………………………………………………………………………………7

Appendix A – Glossary of terms and abbreviations…………………………………………………………………………………………………………………….8

Appendix B – References, legislation, and standards………………………………………………………………………………………………………………….9

Use of Artificial Intelligence, Generative AI, and Machine Learning Interim Policy 3

OFFICIAL

1. Introduction

The National Disability Insurance Agency (Agency) is participating in a trial of Copilot for Microsoft 365 (the trial) along with other Federal Government Agencies. The trial is sponsored by the Prime Minister and is supported by the Digital Transformation Agency (DTA). The use of Copilot as part of a trial aligns with interim Government guidance on the use of generative AI tools.

Copilot by Microsoft brings the power of generative AI to professional settings while offering protection from unauthorised data sharing and unregulated internet access.

The aim of the trial is to help to shape the future use of Artificial Intelligence (AI) by Government staff. Copilot is built on top of advanced AI tools to provide intelligent assistance to users to potentially enhance productivity and collaboration.

Copilot is not a mechanism for making independent decisions.

During the trial, emphasis will be placed on protecting Agency data and personal privacy.

Finally, the trial will explore the benefits and any potential impacts of integrating Copilot within the Agency and the wider APS.

2. Purpose

This policy outlines expectations in the use of AI functionality provided by Copilot within the trial.

The policy establishes a framework for the ethical, legal, secure, and effective use of Artificial Intelligence (AI), Generative AI, and Machine Learning (ML) within the Agency. The policy ensures the safety and security of our staff, critical data, and the National Disability Insurance Scheme (the Scheme) information.

The policy aims to harness the benefits of generative AI services to enhance business outcomes and administrative efficiencies for Agency staff.

This policy is written within the context of the Agency ICT Policy Framework.

3. Applicability

This policy applies to all Agency staff, including labour hire workers, participating in the DTA trial of Copilot and the use of AI-products and related activities within the agency during the Microsoft Copilot trial period.

3.1. Policy exclusions

There are NO exclusions to this policy.

Use of Artificial Intelligence, Generative AI, and Machine Learning Interim Policy 4

OFFICIAL

3.2. Policy exemptions

Unless specified in this policy, there are NO exemptions, unless approved by the CIO and recommended by the Agency AI Working Group.

4. Policy Principles

AI tools offer transformative possibilities for public sector services, particularly in enhancing the efficiency and effectiveness of administrative and operational functions. To ensure confidence in the Agency’s processes and alignment with the operational and strategic goals, users of Copilot must ensure that the following policy principles are met:

• Accountability: Users must be able to explain, justify and take ownership of any advice or decisions made when using AI. Users are responsible for the outcomes of AI generated artefacts. Exercising due diligence when using AI tools is required to ensure the highest standards of quality and ethical responsibilities are met.
• Transparency: Decisions made by Agency staff utilising AI within Microsoft productivity software must be understandable and explainable and provide a clear auditable trail of how the decision was made. AI must not be used for automated independent decision making which may impact participants or the strategic direction of the Agency.
• Accessibility and Inclusion: Any AI tool used by the Agency must adhere to and actively support accessibility standards such as the Web Content Accessibility Guidelines (WCAG).
• Privacy: All Agency staff have a responsibility to protect classified, personal, or otherwise sensitive information held by the Agency. Acceptable use of AI tools compliments existing use of data and information expectations and must protect the privacy of Participants, Partners, and other stakeholders. The use of AI must adhere to the requirements of the Privacy Act 1998 (Cth). The recommendations in the privacy assurance advice in respect of Copilot must be implemented.
• Use of Scheme data: Any recording, use or disclosure of protected Agency information by the AI tools must comply with the secrecy provisions in the National Disability Insurance Scheme Act 2013 (Cth) (NDIS Act). Unless otherwise expressly [authorised by the CIO and] authorised under the NDIS Act, AI tools must not access participant records in PACE, store protected Agency information outside of Australia, disclose protected Agency information to any third parties, or use any protected Agency information for any purposes other than provision of services to the NDIA.
• Compliance: Use of AI tools must comply with existing Agency and ICT specific policies including but not limited to the Acceptable Use Policy, the Digital Collaboration policy, and ICT Security Policy. The use of AI tools must also take into consideration and comply with the APS Code of Conduct and other relevant legislation.
• Training: All users of AI tools must have familiarised themselves with Agency supplied information and training on the responsibilities and ethical use of AI tools within the Agency.

Use of Artificial Intelligence, Generative AI, and Machine Learning Interim Policy 5

OFFICIAL

• Governance: The establishment of a dedicated AI Governance function via the Agency AI Working Group will oversee this trial. The governance body will include representatives with expertise in accessibility, technology, ethics, and legal compliance.
• Human Intervention and Review Processes: Procedural guidelines will ensure that human oversight and input is integral to any continued use of AI tools after the trial.

This policy, supported by procedural documents and information, reflects our commitment to ethical AI usage across the Australian Government.

5. Roles and responsibilities

5.1. Chief Information Officer (CIO)

The CIO is responsible for ensuring that, as far as reasonably possible, effective controls are in place during the trial period to ensure that Copilot is being used as per the requirements of this policy. The CIO is responsible for resourcing the Copilot trial.

5.2. AI Working Group

The AI Working Group are the responsible governance body for the trial. They are responsible for monitoring the use of AI, ensuring that users have access to training and resources that provides clear guidance on the use of AI during the trial. The body will review the outcomes of the Microsoft Copilot trial when it concludes on the 30th of June 2024. The body is also responsible for informing the DTA and other agencies of any insights that will assist the government in implementing and guiding the use of AI tools throughout the APS. The feedback collated from the AI Working Group will be incorporated when developing the permanent Use of AI Policy, should the Copilot trial be embedded further into the agency.

The AI Working Group is not responsible for individual quality control of artefacts produced as part of the trial.

5.3. Project Team

The project team for the trial are responsible for monitoring the use of Copilot and ensuring that, throughout the trial users are informed of their responsibilities and the need to comply with this policy. The project team are accountable for undertaking a review of the trial and providing feedback to DTA. The project team are responsible for working with the Information Law and Privacy team in Legal Services Group to facilitate the privacy assurance advice for the Copilot trial.

The project team will be responsible for reporting the outcomes of the trial to the Agency Senior Leadership Team (SLT) and the Board in the form of a decision paper on the future use of AI within the Agency in alignment with the approach of the Australian Government. The project team will engage with DTA during the trial period, to socialise and review the policy, to ensure consistency with DTA’s expectations of the Copilot trial.

Use of Artificial Intelligence, Generative AI, and Machine Learning Interim Policy 6

OFFICIAL

5.4. Copilot trial members

The members of the Copilot trial are responsible for ensuring that they understand and comply with the requirements of this policy and that they provide unbiased and factual feedback in a timely manner regarding their experience using Copilot.

6. Non-compliance

Any intentional, repeated, or negligent breach of this policy or any other ICT policy by Agency personnel may be considered a breach of the APS Code of Conduct which could give rise to a range of possible sanctions including termination.

Breaches will be managed in line with Agency Human Resource policies.

7. Authority and review

This policy was approved by the CIO on April 2024 and will be reviewed at the completion of the trial pending recommendations from DTA.

Use of Artificial Intelligence, Generative AI, and Machine Learning Interim Policy 7

OFFICIAL

Appendix A – Glossary of terms and abbreviations

The Glossary contains definitions for all key terms used in this document and contain specific meaning in the context of this policy.

Use of Artificial Intelligence, Generative AI, and Machine Learning Interim Policy 8

OFFICIAL

Appendix B – References, legislation, and standards

Legal Frameworks and Acts

The Privacy Act

Disability Discrimination Act 1992

National Disability Insurance Scheme Act 2013

National Disability Insurance Scheme (Protection and Disclosure of Information) Rules 2013

Ethical Guidelines and Standards

Australia’s Artificial Intelligence Ethics Framework

European Unions Ethics guidelines for Trustworthy AI

Australian Government AI Resources

Digital Transformation Agency’s AI resources and guidelines

Australia’s Tech Future policy document

Engaging with Artificial Intelligence

International AI Guidelines

OECD Principles on AI

IEEE Standards on AI and Autonomous Systems

Best Practice Guidelines for AI in Public Sector

World Economic Forum’s Guidelines on AI Governance

United Nations Guidelines on AI and Public Service Delivery

Use of Artificial Intelligence, Generative AI, and Machine Learning Interim Policy 9

ndis

AI in Action: Microsoft Copilot enhancing Productivity and Collaboration

Ajay Satyan

Chief Information Officer

ndis.gov.au

FOI 24/25-1217

ndis

What is Generative AI?

• Generative AI uses algorithms to identify the underlying patterns and relationships in the data and can generate new, synthetic data that is statistically like the original data.
• Generative AI can create new content such as text, images, and music.
• It can be used to automate repetitive tasks and free up time for more strategic, creative work.
• Generative AI can help organisations ramp up their productivity and do more with less.
• It can help unlock the full potential of data across businesses and empower users to gain distilled meaningful insights to guide every decision.
• Trust and transparency are important for generative AI to truly work for businesses.

FOI 24/25-1217

ndis

Generative AI at the NDIA

• 2024 is the year where AI becomes “consumer-grade” and with this inevitable change it is critical that NDIA engages across Whole of Government forums on the safe and responsible applications of AI across the APS and in the NDIA.
• Adopting a strategic approach to AI implementation can enhance our decision-making capabilities and drive innovation within the agency.
• A well-planned AI strategy can help us stay ahead of the curve.
• AI is already pervasive in our personal lives, for example AI is built into Google search or in music suggestions from Spotify.
• AI can help to level the playing field for people with cognitive disabilities or people who are neurodivergent by interpreting text and summarising in a manner that is more easily understood.

FOI 24/25-1217

ndis

AI and Microsoft Copilot Proof of Concept Working Group

• As part of the WoG Microsoft CoPilot trial, an AI Microsoft Copilot working group comprising of team members across the agency ahs been setup.
• A working group will be established in March 2024.
• The working group will consider the WOG and DTA policies related to AI and its applicability in the agency.
• The following table identifies members of the working group.

FOI 24/25-1217

ndis

Introduction to the Copilot Trial

• The Australian Government announces 6-month trial of Copilot for Microsoft 365 which is led by the DTA.
• Trial to commence early 2024 across the Australian Public Service (APS)
• Explore safe, responsible and innovative use of generative AI

Image Caption: A pen drawing a graph

FOI 24/25-1217

ndis

About the trial

• DTA administers trial from January to June 2024
• Collaborates with Microsoft for training and implementation
• DTA and AI in Government Taskforce establish guardrails including advice on interim policy and security requirements
• Oversees trial and coordinates evaluation
• Participating agencies partake in program of activities
• Contribute to trial deliverables including training and reporting
• DTA and AI in Government Taskforce evaluate user experience
• Assess opportunities, feedback, and report to government

FOI 24/25-1217

ndis

What is Microsoft Copilot?

• Copilot is built on advanced AI technology, such as Generative AI.
• Copilot is designed to enhance productivity and collaboration by enabling administrative efficiencies.
• Copilot can assist with a variety of tasks, including summarising important documents, generating drafts of emails and documents, searching documents for answers, and creating/writing different varieties of content.
• Copilot has limitations and is not a mechanism for making agency decisions.
• Copilot’s features will be added progressively to NDIA supplied devices on the trial.

Image Caption: A screenshot of Microsoft Copilot in Word. The prompt is to draft a proposal based on meeting notes from a OneNote file

FOI 24/25-1217

ndis

What is Copilot? (cont.)

• Copilot has native integration with:
  • Word,
  • Excel,
  • PowerPoint,
  • Outlook,
  • Teams,
  • Notepad,
  • Whiteboard, and
  • Loop
• Copilot does not have integration with other agency applications such as PACE or ESSentials.

Image Caption: The words “Copilot for Microsoft 365” and “Microsoft 365 Apps” along with the Copilot logo and logos for the Microsoft Office applications.

FOI 24/25-1217

ndis

What is Copilot? (cont.)

Copilot Live Demo

FOI 24/25-1217

ndis

DTA Key steps and timeline

Timeline illustration detailing milestones from November 2023 to June 2024:

• November 24th: Agencies receive Copilot for M365 trial license agency commitment and order form.
• December 8th: Agency commitments received & collated.
• December 15th: DTA Finalise and Sign Contract.
• December 18th – 21st: Receive agency invoices from SDO & send to agencies.
• January 1st: Copilot trial commences.
• March (Early): Agencies required to notify Microsoft if seeking to extend Copilot. (This will be in line with the ASC confirmation process for CCC and ECC enrollments).
• May (Expected): Expected trial evaluation by DTA.
• June 27th: Copilot trial end.

FOI 24/25-1217

ndis

Where are we now?

• The agency has an initial commitment for trial participation with 300 licences
• An initial group of 50 people have been granted access as part of a Proof of Concept to conduct initial usability testing.
• A wider group of 300 people will be provided access at the end of February 2024. The wider group includes the following groups:
  • All SES and support staff,
  • Members of the Employee Disability Network (EDN),
  • Office of the CIO technical support teams.
• A policy covering the responsible use of AI has been drafted and a working group has been established to work through the usage of AI in the agency.
  • The policy take guidance from government organisations such as DTA and APSC. It also takes into consideration guidance from authorities such as Gartner.
• Agency communications are in development with Strategic Communications.

FOI 24/25-1217

ndis

Important security considerations

• DTA is consulting with Australian Cyber Security Centre
  • Understanding security requirements
  • IRAP assessment of Copilot for Microsoft 365 has been completed
• NDIA is undertaking our own security risk assessment
  • In line with own tolerance and circumstances
• Copilot for Microsoft 365 part of Microsoft 365 family
  • Built into Microsoft 365
  • Inherits same security, compliance, and privacy controls
• More information available
  • See Data, Privacy, and Security for Copilot for Microsoft 365

Image Caption: Close-up of a computer server

FOI 24/25-1217

ndis

Training and Support

• DTA and Microsoft will support participating agencies through onboarding and readiness workshops, and additional training.
  • Readiness workshops and training will be at no extra cost to agencies.
• An information pack will be provided to trial participants early in the trial process.
  • The information pack contains FAQs addressing whole-of-government guardrails, possible use cases, evaluation approach and other information about the trial.
• The OCIO have developed their own change management material and worked with internal learning teams to develop a LEAP module.

Image Caption: Yellow paper ship leading among white ships

FOI 24/25-1217

ndis

Support and Feedback on the trial

ICT Service Desk - Service project (ndis.gov.au)

Image Caption: Empty Envelope

FOI 24/25-1217

ndis

Useful information

• Interim guidance on government use of public generative AI tools
  • Provided by AGA (digital.gov.au)
• Australia’s AI Ethics Principles
  • Part of Australia’s Artificial Intelligence Ethics Framework
  • Provided by Department of Industry, Science and Resources
• How might artificial intelligence affect the trustworthiness of public service delivery
  • Provided by PM&C (pmc.gov.au)
• How to develop AI strategy and policy
  • Provided by Gartner (gartner.com)

Image Caption: A group of black question marks with a bright yellow question mark on top

OFFICIAL FOI 24/25-1217

ndis | Delivered by the National Disability Insurance Agency

Copilot for Microsoft 365 trial Factsheet

The Australian Government has announced a 6-month trial of Copilot for Microsoft 365 across the Australian Public Service (APS) commencing early 2024 to explore the safe, responsible and innovative use of generative Artificial Intelligence (AI).

About the trial

The trial will be administered by the Digital Transformation Agency (DTA) and will run from January to June 2024. The DTA is working with Microsoft to arrange training, onboarding, and implementation assistance with participating agencies. The DTA, in partnership with the AI in Government Taskforce, will establish whole-of government guardrails and security requirements, oversee the trial, and coordinate evaluation. This includes assisting agencies to work through the various considerations of trialling Copilot for Microsoft 365 for their circumstances, risk tolerances and potential use cases.

Participating agencies will be required to partake in a program of activities and contribute to trial deliverables including induction and training, reporting against evaluation measures and development of case studies.

The DTA in partnership with the AI in Government Taskforce will evaluate the experience of users to assess opportunities, feedback, and report to government.

Security of the trial

Important security considerations

The DTA is consulting with the Australian Cyber Security Centre to understand the security requirements. An Infosec Registered Assessors Program (IRAP) assessment of Copilot for Microsoft 365 is currently underway and is planned for completion prior to the commencement of the trial.

The NDIA is currently undertaking our own security risk assessment in line with our own tolerance and circumstances.

Copilot for Microsoft 365 is a part of the Microsoft 365 family of products, which means it’s built into Microsoft 365 and inherits all the same security, compliance, and privacy controls that underpin Microsoft 365.

For more information, see Data, Privacy, and Security for Copilot for Microsoft 365.

The trial was open to all agencies licensed for Microsoft 365 E3 or E5 on the Whole of Government Microsoft Volume Sourcing Arrangement (VSA).

The DTA has placed a centralised order on behalf of the participating agencies for a six month period. Following the placement of the order, licences were transferred to

OFFICIAL FOI 24/25-1217

the primary production tenancy of participating agencies which has been available for deployment since January 2024.

What were the Minimum requirements for trial participation?

The terms and minimum commitment for trial participation are an Agency commitment of:

• 300 Copilot for Microsoft 365 licences from agencies with 2,000 Microsoft 365 Qualified Users or more; or
• The greater of 15% of users or 10 Copilot for Microsoft 365 licences for agencies with fewer than 2,000 Microsoft 365 Qualified Users
• Commitment for the term of trial.

The overall benefit from Copilot for Microsoft 365 will be impacted by how heavily invested agencies are in their usage of Microsoft 365.

Agencies may opt to extend the term of their Copilot for Microsoft 365 licences after the trial for a further 12 months. The DTA will be contacting agencies with more information about extending their commitments as part of the annual licence reconciliation process.

Key steps and timeline

Timeline illustration detailing milestones from November 2023 to June 2024:

• November 24th: Agencies receive Copilot for M365 trial license agency commitment and order form.
• December 8th: Agency commitments received & collated.
• December 15th: DTA Finalise and Sign Contract.
• December 18th – 21st: Receive agency invoices from SDO & send to agencies.
• January 1st: Copilot trial commences.
• March (Early): Agencies required to notify Microsoft if seeking to extend Copilot. (This will be in line with the ASC confirmation process for CCC and ECC enrollments).
• May (Expected): Expected trial evaluation by DTA.
• June 27th: Copilot trial end.

OFFICIAL FOI 24/25-1217

ndis | Delivered by the National Disability Insurance Agency

Training and Support

• The DTA and Microsoft will be working with participating agencies to support them, through onboarding and readiness workshops, and additional training.
• Readiness workshops and training will be at no extra cost to agencies.
• An information pack containing FAQs addressing whole-of-government guardrails, possible use cases, evaluation approach and other information about the trial will be provided to trial participants early in the trial process.

Useful information

The following resources have been developed to assist implementing AI in the APS

Interim guidance on government use of public generative AI tools | aga (digital.gov.au)

Australia’s AI Ethics Principles | Australia’s Artificial Intelligence Ethics Framework - Department of Industry, Science and Resources

How might artificial intelligence affect the trustworthiness of public service delivery - PM&C (pmc.gov.au)

Product information

Copilot for Microsoft 365

Microsoft Copilot Copyright Commitment Security Information

Data, Privacy, and Security for Copilot for Microsoft 365

Microsoft Purview data security and compliance protections for Microsoft Copilot

Support and Feedback on the trial

The NDIA project team responsible for conducting the trial can be contacted via: redacted: s47E(d) - certain operations of agencies