Senate Community Affairs Legislation Committee, , 29:38 to 33:26
Officials outline the department's policy on artificial intelligence, the use of Microsoft Copilot by staff, and the risk assessment processes for new AI use cases.
Topics: Artificial intelligence, Government IT systems
Speakers: Ms Rachel Balmanno, Senator Chris Gatenby
Chair and good morning, Department and Minister. Um just while we're on corporate matters, um, does the Department have a specific policy on the use of AI? And if so, can you summarise that for the committee, please?
Yes, Senator. So so there are a number of different uh we obviously are bound by the whole of government policies in that regard. So we reference those. We also have developed our own processes and policies around assurance of AI, for example, and its use, and we are continuing to educate staff on that. Inherently, the approach is about ensuring that it is used responsibly, and that includes ensuring that staff remain accountable for all outputs and the responsible use of AI.
So in terms of whether it's policy or on the corporate side of things are using it for everything across the department, or are there sort of limitations on where you won't use it?
Yeah. So staff have access to a licensed version of Copilot. About two-thirds of our staff have taken up that opportunity. So they are routinely using AI co-pilot in that context to help them with day-to-day tasks. The uses beyond that, we have a structured approach to a register of use cases that have to go through a risk assessment and impact assessment process. And if it's going to require investment, we also need to look at the cost benefit of that in terms of whether it is an efficient use of resources to actually make that change. So we are progressively looking at that. We're not looking to rush into investments or uses without properly assessing the way that the impacts that they might have and ensuring that they are beneficial and meet those sort of expectations around responsible use.
And recently we've seen issues about patches having to be applied to government websites and the like. What safeguards have you got in place for AI for commercially sensitive information like private health insurance numbers? You know, you've got a number of med tech companies with the processes list. Yes. Those kinds of all that are interacting with government. What are the safeguards that you have to ensure that that commercially sensitive data or personally sensitive data as well? People is also not being accessed or misused by bucks or the like.
Yeah. So we uh have a long history obviously of responding to any suggestion that there may be weaknesses in our prote in our systems or in our protection of that sort of data. Uh AI changes the game a little bit in terms of the the pace at which those weaknesses uh can be identified and taken advantage of. So it doesn't identify it doesn't create new weaknesses, it just means it's a lot faster to actually utilize those. Uh we are very uh responsive, very closely engaged and responsive to any advice from the Australian Signals Directorate and ensure that we're rolling that out across where, for example, the recent uh issues last week with PHP and with web applications, we did patches uh within 24 hours of that advice and additional patching over the weekend to improve both the security of some of our uh web applications uh in response to advice from the vendor and uh ASD as well as to improve our monitoring across those to make sure that we're able to detect any issues. So we we have a specific program of work we are initiating now that is about uh looking particularly through the lens of Frontier AI and the weaknesses that it may be able to accelerate uh the exploitation of in regards to our systems.