← Back to writing
AIGovernanceNational SecuritySovereign AIOversight

Exempt by Design: The AI Governance Gap in the National Intelligence Community

11 min read
Exempt by Design: The AI Governance Gap in the National Intelligence Community

It is fair to assume the agencies wielding AI on the most consequential decisions carry the tightest rules governing it; in Australia, for the national intelligence community, that assumption is exactly backwards. The mandatory framework for government AI, the Digital Transformation Agency's policy now at v2.0 with a mandatory use-case register, exempts the Defence portfolio and the national intelligence community (Digital Transformation Agency, 2025). The National AI Plan shelved the proposed mandatory high-risk guardrails and stood up an AI Safety Institute instead (Department of Industry, Science and Resources, 2025). What is left for the community is point-in-time authorisation under the Protective Security Policy Framework and an oversight office that has appointed a single Chief AI Officer (Inspector-General of Intelligence and Security, 2025).

So for the same class of AI decision, a suburban retailer now carries more binding AI-specific obligations than an intelligence agency. This piece argues that the carve-out itself is defensible on classification, mission and tempo grounds. What is not defensible is that exemption from the framework quietly became exemption from any equivalent discipline. The gap is the missing substitute, not the exemption.

When the agencies with the sharpest tools are exempt from the rules written for everyone else, what exactly is doing the governing?

Juvenal asked the older version of it two thousand years ago: quis custodiet ipsos custodes, who guards the guardians. AI just made the question load-bearing again.

Introduction

Picture two rooms. In the first, a retail chain switches on facial recognition at the front door to spot known shoplifters. That deployment answers to the Privacy Act, to the Office of the Australian Information Commissioner, and, if a shopper complains, potentially to the Administrative Review Tribunal. A bank running the same class of model answers to all of that plus APRA and AUSTRAC. A service-delivery department answers to the DTA's mandatory requirements: a named accountable official, published use-case transparency, and, within 12 months of the policy's 15 December 2025 commencement, a mandatory use-case register (due by 15 December 2026). From 10 December 2026 it also answers to the new automated-decision-making transparency provisions in the Privacy Act (Digital Transformation Agency, 2025).

In the second room, an intelligence agency runs a model over data that is vastly more consequential to a person's liberty. It answers to none of those AI-specific instruments.

That is the inversion, and you did not come here for me to pretend it is a simple scandal. It is more interesting than that. The exemption is deliberate and, on its face, sensible. The problem is what filled the space it left, which for AI-specific assurance is close to nothing public. This is the governance equivalent of the pacing problem: law and oversight structurally lag the technologies they govern (Marchant et al., 2011). Australia has already named its own version of it. The Richardson Review found that the national intelligence community's legislative framework had been outpaced by technology (Richardson, 2020).

The Inversion

Let us walk the ladder one rung at a time, because the shape of the thing only becomes obvious when you climb it.

  • The retailer. Deploys facial recognition, bound by the Privacy Act and answerable to the OAIC and, on review, the ART. AI-specific obligations: the general privacy regime, soon the ADM transparency provisions.

  • The bank. Everything the retailer carries, plus prudential obligations to APRA and reporting obligations to AUSTRAC. More binding instruments, higher stakes, tighter watch.

  • The service-delivery agency. A non-corporate Commonwealth entity, so the DTA policy applies in full: accountable official, transparency statement, and, within 12 months of the policy's v2.0 effective date of 15 December 2025, the mandatory AI use-case register (Digital Transformation Agency, 2025). The register is a separate obligation from the accountability and transparency duties, not the same milestone.

  • The police force. Privacy obligations, warrant regimes, and its own accountability bodies, with AI decisions increasingly folded into existing oversight.

  • The intelligence agency. Processes the most consequential data of the lot, and sits outside the AI-specific instruments entirely.

The mechanics matter here, so let me be precise. The DTA policy applies to non-corporate Commonwealth entities but carves out the Defence portfolio and the national intelligence community. The v2.0 scope clause says the policy "does not apply to: the use of AI in the defence portfolio; the 'national intelligence community' (NIC) as defined by Section 4 of the Office of National Intelligence Act 2018", which pulls in ONI, ASD, ASIO, ASIS, AGO, DIO and ACIC, plus the intelligence functions of AUSTRAC, the AFP, Home Affairs and Defence (Digital Transformation Agency, 2025). The Privacy Act, for its part, has long exempted the intelligence agencies from its core operation. Stack those two carve-outs and the community sits outside both of the instruments that bind everyone below it on the ladder.

I am going to be honest about what comes next. A bar graph at the end of this section counts binding AI-relevant obligations per actor for the same AI decision, and the bars fall as the consequence rises. Read it as illustrative, not gospel. It counts instruments, it does not weigh them, and a single well-drafted obligation can do more than five thin ones. What matters is the direction of travel rather than the exact height of any one bar, and the direction is upside down.

Count the instruments that bind AI use and walk the ladder. The bars fall as the consequence rises.

What Actually Covers the Community Today

Strip away the AI-specific instruments and the community is not ungoverned. It is governed by machinery built for a different job.

The first layer is security, not assurance. Systems are authorised to operate under the Protective Security Policy Framework, with the Information Security Manual setting ongoing-monitoring expectations. That gives you a point-in-time authority to operate and an expectation of monitoring, but not codified continuous authorisation. It is the cATO gap again, the same one I described in Starved by Design: you certify a system on a Tuesday and trust that it has not drifted by Friday, which is a stretch for anything that retrains.

The second layer is oversight. On 24 January 2024 the Inspector-General of Intelligence and Security opened an own-motion preliminary inquiry into AI use across the community under section 14(2) of the IGIS Act, covering AGO, ASD, ASIO, ASIS, DIO and ONI (Inspector-General of Intelligence and Security, 2024). Its public report found varied maturity across agencies, AI mainly augmenting human analysts rather than acting on its own, and no autonomous action. It did not proceed to a full inquiry. Since then IGIS has appointed its Assistant Inspector-General, Agency Oversight as its Chief AI Officer (Inspector-General of Intelligence and Security, 2025).

Treat IGIS fairly here, because it deserves it. This is an oversight office of modest size, built to examine human decisions and paper trails: who authorised what, on what basis, with what warrant. It did the responsible thing by looking early and looking hard. But an office built to audit paper is now expected to oversee model behaviour, and one Chief AI Officer, however capable, is not an evaluation capability. That is a statement about the tooling they have been handed, not a criticism of the people.

What the Review Actually Asked For

None of this went unnoticed. The 2024 Independent Intelligence Review by Dr Heather Smith PSM and Richard Maude, the unclassified report released on 21 March 2025, made 67 recommendations and secured $44.6 million over four years to ONI for initial implementation (Smith & Maude, 2025). Recommendation 32 asks the community to "develop intelligence community-wide artificial intelligence governance principles and artificial intelligence public messaging principles" (Smith & Maude, 2025, p. 80). Two others sit beside it and are worth keeping separate rather than folding into one headline: Recommendation 35 goes to AI governance frameworks at the agency level, and Recommendation 37 asks for an enterprise technology strategy without being AI-specific at all. The reviewers looked at the same inversion and said, in effect, that the community needs its own discipline for this.

Then look at what the wider policy settings actually deliver for the enclave. The National AI Plan treats national security briefly: risks are handled inside existing structures, incidents run through the Crisis Management Framework, and the PSPF governs the authorising of AI systems (Department of Industry, Science and Resources, 2025). The new Australian AI Safety Institute is operational, backed by $29.9 million to establish it (Department of Industry, Science and Resources, 2025), and its work is real.

Here is the strongest version of the reply an agency could make to this article, and it deserves to be answered rather than left standing as an exposed claim. The institute says on its own pages that it "works with technical partners including the Australian Signals Directorate and CSIRO" (Department of Industry, Science and Resources, n.d.), and an agency could reasonably argue that a signals-intelligence agency sitting inside the country's model-evaluation body is precisely the kind of assurance this piece claims is missing. Concede it rather than argue it away: a model evaluated with ASD in the room has had more scrutiny than a flat "nothing public says its assurance reaches the enclave" implies. I will not overstate it in the other direction either. The public wording is a technical partnership, not a published commitment to test every model before it reaches government use, and I am not going to dress the one up as the other. But model evaluation upstream is not the same discipline as assuring the system that model becomes once an agency wires it into a classified workflow with its own data, its own fine-tuning and its own drift over time. That partnership answers "was this model evaluated before it shipped". It does not answer "is this deployed enclave system still behaving the way it did on the day it was authorised", which is the continuous, system-level assurance question the rest of this piece is actually about. So the review asked for a substitute, and the instruments that followed, this partnership included, point at model-level testing upstream of deployment, not at the deployed-system assurance the enclave still lacks.

Here is the same picture as a map. Read the value chain left to right, and read the instruments as bands sitting over it. The uncovered band is the one to watch.

The security layer covers collection and the oversight layer covers the human call. The seam where a model actually resolves and analyses is where the assurance is missing.

The So What?

So if the exemption stays, and I think it should, what does a community-grade substitute look like? Here is the design sketch. And yes, I am aware of the irony. This is a series that opened by attacking compliance theatre, and here I am arguing for more paperwork. The difference is the whole point: I want discipline that changes behaviour, not paperwork that transfers blame.

  • A register with a cleared reader. Build a classified AI use-case register, mirrored to IGIS. A register nobody outside the enclave can read is still a register the overseer can walk. The transparency instrument for everyone else was sunlight. Here the substitute is a reader with a clearance.

  • Assurance at one governed seam. Route model use through a single governed seam that logs every call, evaluates outputs and carries provenance, so oversight inspects the seam rather than every system. This is the thin-model-layer pattern from earlier pieces (see Starved by Design), and it is what makes oversight tractable at all.

  • Evaluation before authorisation, and continuously after. A point-in-time ATO is not enough for systems that retrain. Borrow the continuous-authorisation argument wholesale: evaluate before you authorise, then keep evaluating, because the thing you certified is not the thing running next quarter.

  • Oversight tooling, not just remit. Give IGIS the technical means to match the systems it oversees: eval harnesses, log access, the ability to test and observe a model's behaviour at the boundary rather than read only its paperwork. This is black-box assurance, evaluation and logging, not a promise to interpret the model's internals. The review's implementation funding is the vehicle to ask for exactly this.

  • Report the shape, not the secrets. Publish annual counts and categories of AI use across the community, the way interception statistics are already reported. You can disclose the shape of the thing without disclosing a single operation.

The Governance Gap Map interactive sits at the end of this section. Pick an actor and a use case, and watch which instruments actually bind.

Interactive: pick an actor and a use case, and see which instruments bind, which merely encourage, and who can look inside.

Conclusion

Reframe the whole thing through the pacing problem and it stops looking like a conspiracy and starts looking like physics. Oversight lags capability by default. The gap between what the community can now do with a model and what any AI-specific instrument requires of it is not a scandal that someone engineered. It is the ordinary trajectory of law and institutions trailing technology (Marchant et al., 2011), the same trajectory Richardson named when he found the legal framework had been outpaced (Richardson, 2020). Scandals are simply how democracies discover the gap later, at the worst possible time, in a report with a person's name on the cover.

The carve-out earned its place. Classification, mission and tempo are real, and pretending the community can just be dragged inside the DTA policy is as lazy as pretending the gap does not matter. But a carve-out is a promise to do the equivalent work differently, not a licence to skip it. The 2024 review saw that and asked for the substitute. The interesting work now is designing it before the incident writes it for us.

So here is the question I would put to any oversight body reading this. If the systems you are meant to watch walked in the door tomorrow, would you know what to ask for?

Thanks for reading.

The views expressed in this article are my own and do not represent those of my employer, or any of my clients.

See related articles: Starved by Design and The Compliance Clock.

References

Related reading

22 min read

Obsolete the Day You Sign It: Australia Needs a Continuous ATO, and It Already Has the Missing Piece

Australia has already written down continued authorisation. The Protective Security Policy Framework carries a section headed "Continued Authorisation" which states that authorisation to operate "is generally ongoing once the system is operational", with the system owner monitoring so that the risks of operating the system stay inside the entity's tolerances (Department of Home Affairs, 2026, s 13.3.1.1). The familiar complaint, that we still run annual certificates while the Americans moved on, does not survive the text.

AIContinuous AuthorisationSecurityGovernanceSovereign AI
10 min read1 like

Doing More With Less Is a Trap: Why Cheaper AI Will Not Save Government

Your agency's AI bill will keep climbing even as the price per token falls, because "do more with less" is the wrong promise and cheaper inference does not bank a saving. It buys more inference, more sprawl, and a bigger bill (Jevons, 1865). The assurance we wrap around it measures the wrong thing and then gets gamed until the dashboard is green and the risk is not managed (Strathern, 1997). And because every platform your agency already owns now ships its own model, government AI is fragmenting to mirror the shape of the org chart, one captive feature at a time (Conway, 1968). The public value never turns up, because none of this compresses the thing that actually matters: the time it takes to turn raw information into a decision a person can defend and a citizen can contest.

AIFinOpsSystems ThinkingGovernanceSovereign AI
9 min read1 like

Starved by Design: The Sovereign AI Paradox

Sovereign AI is being pitched to the national security community as a straightforward capability upgrade, yet the paradox holds regardless of vendor: the more classified the network, the worse the artificial intelligence running on it tends to be, because every technique that makes modern AI capable, live retrieval, fine-tuning, a connection to a frontier model, needs data to move, and a classified network's entire purpose is to stop data moving. That gap is a structural feature of how these systems are currently built, not simply a funding shortfall Australia can spend its way out of, though it narrows as local techniques improve. As Australia invests in sovereign and next-generation capability through programs like the Australian Signals Directorate's REDSPICE and the National AI Plan (Australian Signals Directorate, 2022; Department of Industry, Science and Resources, 2025), we owe ourselves an honest conversation about what a sealed enclave can and cannot do.

Sovereign AINational SecurityCloudAIArchitecture