AI Governance and the Essential 8: What the Framework Misses

The Essential 8 does not cover your use of AI. Not partly, not indirectly, not at a higher maturity level. The Australian Signals Directorate (ASD) built the Essential 8 as eight technical mitigation strategies to protect internet-connected information technology networks against attacker tradecraft, and it does that job well. It has nothing to say about who answers for a decision an AI system makes, what company data your staff are pasting into a chatbot, or whether a customer can challenge an automated outcome. Those questions belong to a newer and very different piece of Australian guidance.

Which leaves a lot of Australian businesses holding two obligations that share a vocabulary and almost nothing else. Essential 8 maturity is usually something a client, a board or an insurer has asked you to demonstrate. AI governance is voluntary guidance, with one genuine legal deadline sitting inside it. Being strong at the first tells you very little about the second, and the deadline lands on 10 December 2026 whether or not anyone in the building has been given the job.

TL;DR: What to remember

• ✅ The Essential 8 protects networks from attackers. ASD describes it as a minimum set of preventative measures; governing how your organisation uses AI was never its job.
• ✅ Australia's current AI artefact is the National AI Centre's Guidance for AI Adoption, published 21 October 2025: six essential practices, voluntary. The National AI Plan of 2 December 2025 confirmed the voluntary approach rather than mandatory guardrails.
• ✅ One date is not voluntary. From 10 December 2026, APP entities must disclose automated decision-making in their privacy policy where a decision could reasonably be expected to significantly affect someone's rights or interests.
• ✅ The overlap is real but narrow: an AI tool is still software, still a vendor and still an access path, so patching, application control, privilege restriction and data handling all apply to it.
• ✅ The gap is accountability, impact, contestability and human oversight. No maturity level closes it, because no assessment is looking for it.

Contents

• What the Essential 8 was built to do
• What the six essential practices ask of you
• The one deadline that is not voluntary: 10 December 2026
• Where the two genuinely overlap
• What no Essential 8 assessment will surface
• Do we actually have to do any of this?

What the Essential 8 was built to do

ASD is precise about the scope, and the precision matters. The Essential Eight was designed to protect organisations' internet-connected information technology networks. Its principles can be applied to enterprise mobility and operational technology networks, but it was not designed for those purposes, and ASD says so. The eight strategies are:

• patch applications
• patch operating systems
• multi-factor authentication
• restrict administrative privileges
• application control
• restrict Microsoft Office macros
• user application hardening
• regular backups

Every one of those is a control against an attacker getting in, moving around, or destroying something. The maturity model behind them is calibrated to attacker tradecraft: what level of skill and persistence you are aiming to defeat. ASD also states plainly that the Essential Eight is a minimum set of preventative measures, that organisations need additional measures where their environment warrants it, and that it will not mitigate all cyber threats.

None of that is a criticism. A well-scoped framework doing a specific job is exactly what you want. The trouble starts when somebody treats a well-scoped framework as a complete one, and then a question arrives that was never in scope.

What the six essential practices ask of you

On 21 October 2025 the National AI Centre, which sits within the Department of Industry, Science and Resources, published Guidance for AI Adoption. It sets out six essential practices for responsible AI use, and it names its audience: teams starting to use AI, using it in low-risk ways, new to AI governance, or needing practical guidance in business contexts. That is most Australian small and medium businesses. A separate implementation version exists for organisations with mature governance or high-risk use cases.

The six practices:

• Decide who is accountable. A senior leader owns AI governance overall, and an AI policy sets out how the organisation will use AI responsibly. The guidance notes that AI complexity can create gaps where nobody takes clear responsibility for outcomes, which anyone who has watched a tool spread through a business unannounced will recognise.
• Understand impacts and plan accordingly. A stakeholder impact assessment identifies who your AI systems may affect, and contestability channels give people a way to report problems or challenge AI decisions.
• Measure and manage risks. Risk emerges from how a system behaves in different situations, not only from software updates. The same tool carries different risk depending on what you use it for.
• Share essential information.
• Test and monitor.
• Maintain human control.

The guidance carries a worked example that does more explaining than most whitepapers manage: using AI to draft marketing emails is a different risk proposition from using it to assess job applications, even when it is the same tool. The unit of governance is the use, not the product.

Two facts to be clear on, because the ground shifted recently and a lot of commentary has not caught up. Australia is not getting an AI Act. The government consulted on mandatory guardrails for AI in high-risk settings, then released the National AI Plan on 2 December 2025 and proceeded with a voluntary approach instead. The Guidance for AI Adoption is that voluntary approach, and being voluntary, it creates no new legal duties about AI systems or their use. An Australian AI Safety Institute has been established with $29.8 million over four years, and the government has been explicit that it will not be a regulator. So there is no AI inspector coming. The pressure, where it comes, will arrive the same way Essential 8 pressure did: from clients, boards and insurers who want evidence.

The guidance is also explicit that you do not need to do everything at once, and that each practice should be adapted to your organisation's size, use cases and risk profile. Take it at its word.

The one deadline that is not voluntary: 10 December 2026

Everything above makes it easy to conclude nothing here carries a date. One thing does, and it is close.

The Privacy and Other Legislation Amendment Act 2024 introduced an automated decision-making transparency obligation. From 10 December 2026, APP entities (organisations covered by the Australian Privacy Principles) that use personal information in automated decision-making must include information in their privacy policy about the kinds of personal information used and the kinds of decisions made that way, wherever a computer program makes a decision that could reasonably be expected to significantly affect an individual's rights or interests. The Office of the Australian Information Commissioner (OAIC) has said it intends to publish guidance ahead of the commencement date, so the detail will firm up. The date will not.

Read the trigger carefully, because it is narrower than "we use AI" and wider than people assume. It turns on decisions that significantly affect someone's rights or interests, and the published examples include decisions affecting rights under a contract such as an insurance policy, and decisions affecting access to a significant service or support such as healthcare. It attaches to APP entities, the same turnover-and-category test that governs the Notifiable Data Breaches scheme, so a business under the $3 million threshold may sit outside it while a health service provider of any size does not.

If an AI tool contributes to decisions about your customers, applicants or claims, or you are considering one that would, this obligation has your name on it. The work starts with knowing what you are actually using, which is the register, and the register comes up again below.

Where the two genuinely overlap

The overlap is narrower than the marketing around both frameworks suggests, but it is real, and it is the part where an existing IT and security capability already earns its keep.

• Some AI tools are software you install. Where they are, patching applications, application control and user application hardening apply exactly as they would to anything else a user installs. An AI assistant with a browser extension is a browser extension. Where the tool is a vendor-hosted service, those controls apply to the client side and the access path rather than to the service itself, a distinction worth keeping precise.
• An AI tool is a vendor. Third-party risk does not change character because the third party is a model provider. The Australian Securities and Investments Commission's (ASIC) cyber pulse survey found 44% of participants were not managing third-party or supply chain risks, and AI tools tend to get adopted faster than procurement ever hears about them.
• Access to it is access. Multi-factor authentication and restricted administrative privileges apply to AI platform consoles and integrations, and those integrations frequently hold broad permissions into email and files.
• Data leaving the business is a data question. Whether staff can paste customer information into an external service is an egress and data-handling question your existing controls may already partly answer.

So a business with genuine Essential 8 maturity is not starting from zero. It has the technical hygiene that makes AI adoption safer. What it does not have is anything that answers the governance questions, and no amount of patching changes that.

What no Essential 8 assessment will surface

An Essential 8 assessment will never raise the following, because it is not looking for any of it.

Nobody is accountable. The first of the six practices exists because AI use spreads sideways through an organisation without a decision ever being made. There is rarely a named owner, and an Essential 8 report has no field for one.

Nobody can list what is in use. Many businesses cannot say which AI tools their staff use, on which data, for what. That inventory is the precondition for every other practice, and it is the most useful hour available here. The National AI Centre publishes an AI register template alongside the guidance, so nobody has to design one from scratch.

The policy is whatever the least cautious employee decides. Without written guidance, staff make individual judgement calls about what is acceptable to put into an external model, and the sum of those calls is the organisation's actual position. A policy template ships with the guidance too.

A person affected by an AI-assisted decision has nowhere to go. If a decision touches a customer or a job applicant, there is often no route for that person to question it and no process for putting it right. From 10 December 2026, for APP entities, that gap also carries a disclosure obligation.

The human checkpoint disappears first. Tools get adopted for speed, and the oversight step is the first thing removed when speed is the point.

These are governance problems that happen to involve technology, which is why they survive a strong technical assessment untouched, and why they sit with the same person already holding the framework requirement rather than with whoever configured the tool.

For a business already maintaining controls against a compliance framework, the practical move is to treat AI as one more thing inside that scope rather than a separate project. inSUPPORT aligns clients to the compliance frameworks their industry uses, and the register, access, vendor and data-handling questions above are the same questions asked of any new tool. The accountability, contestability and human-oversight practices are decisions for the business, and they belong with someone senior.

Do we actually have to do any of this?

Is AI governance legally required in Australia?
The six essential practices are voluntary, and the National AI Plan of December 2025 confirmed the government would not proceed with AI-specific mandatory guardrails, relying on existing law instead. But voluntary guidance is not the same as nothing applying. Existing law still governs what you do with AI, and one new obligation commences on 10 December 2026: the automated decision-making transparency requirement in the Privacy Act, which applies to APP entities whose automated decisions could significantly affect an individual's rights or interests. Check whether you are an APP entity, then check whether any of your AI use meets that trigger.

We already have Essential 8 maturity. Does that count for anything here?
Yes, for the technical half. Patching, application control, privilege restriction and access management all apply to AI tools and integrations, and having them working properly is a genuine head start. What it does not give you is a named accountable owner, a register of AI use, a policy, contestability channels or a human-control checkpoint, because the Essential 8 was never scoped to produce them.

Where should a small business actually start?
With the register. You cannot assign accountability, assess impact or manage risk for tools you cannot list. Ask each team which AI tools they use, for what, and on what data, then write it down. It commonly surfaces tools nobody had approved, and it usually costs an afternoon.

Does an AI policy have to be a long document?
No. The guidance says you do not need to do everything at once and that practices should be adapted to your organisation's size and risk profile, and the National AI Centre publishes a policy template as a starting point. A short policy staff actually read beats a long one nobody opens, and the useful content is usually what data must never leave, which tools are approved, and who to ask.

AI policy in Australia is moving. This reflects the position as at August 2026: voluntary guidance following the National AI Plan of December 2025, with the automated decision-making transparency obligation commencing 10 December 2026. Check current guidance and the OAIC's published material before relying on either.

Citations

• "Guidance for AI adoption: foundations", National AI Centre, Department of Industry, Science and Resources (published 21 October 2025). The six essential practices, the intended audience, the marketing-email versus job-application risk example, and the accompanying policy and register templates. ai.gov.au
• "Essential Eight explained", Australian Signals Directorate. The eight mitigation strategies and the statement that the Essential Eight was designed to protect internet-connected information technology networks. cyber.gov.au
• "Essential Eight maturity model", Australian Signals Directorate. That the Essential Eight is a minimum set of preventative measures, that additional measures are needed where the environment warrants, and that it will not mitigate all cyber threats. cyber.gov.au
• "National AI Plan", Department of Industry, Science and Resources (released 2 December 2025). Australia's voluntary approach rather than AI-specific mandatory guardrails, and the establishment and non-regulator role of the Australian AI Safety Institute. industry.gov.au
• "Consultation on Guidance for Transparency in Automated Decision Making", Office of the Australian Information Commissioner. The automated decision-making transparency obligation introduced by the Privacy and Other Legislation Amendment Act 2024, commencing 10 December 2026, and the OAIC's intention to publish guidance beforehand. oaic.gov.au
• "ASIC calls for greater organisational vigilance to combat cyber threats" (23-300MR, November 2023). Cited here for the third-party and supply chain risk finding: 44% of survey participants were not managing it. asic.gov.au

Related Reading

• How the Essential 8 Maturity Model Benchmarks Cybersecurity
• What is Cybersecurity
• The 6 Step Cyber Strength System
• IT, compliance and cyber insurance under one model

Content reviewed by Probably Genius for accuracy and relevance.

inSUPPORT provides managed IT and cyber security services. It is not an insurer, insurance broker or underwriter and does not hold an Australian Financial Services Licence. Where cyber insurance forms part of a plan, it is arranged through licensed insurance partners and underwritten by the insurer. Cover is subject to the insurer's assessment, the policy terms and the Product Disclosure Statement and Target Market Determination. This article is general information about IT and security practice, not financial product advice, and it does not take account of your objectives, financial situation or needs.