Australian AI Standards - a reader's guide

A reader's guide to this kit

This page says out loud what the rest of the site is doing, because the method only works if it is declared.

What this is. A set of working materials for Australia's AI Standards process, published before consultation opened, by a small Australian software practice whose systems already run the pattern the announced framework describes. Everything is dated, versioned, attributed and free to adopt - in whole, in part, or as raw material for something better. Nothing here requires a conversation with us, a contract, or a login.

Why it is built this way. Text enters legislation through known doors: definitions travel into drafting instructions almost intact; model instruments get adapted by agencies; explanatory material gets mined for briefs; comms language gets reused verbatim. We have written one artefact for each door. That is also what well-resourced lobbying operations do - the difference, and the entire point, is that ours is published first and signed. If any of this text ends up in an instrument, a brief or a speech, its provenance can be established from the dates on these pages. That is exactly the standard we think should apply to every participant in the process.

The kit, by the door it fits:

• For drafting instructions: the defined terms glossary (highest-reuse artefact; lift the definitions, keep or drop the drafting notes) and the drafting instructions template.
• For the instruments: the model standard (data governance and consent, in instrument format) and the schema annex - the record structures with a running reference implementation behind them.
• For briefs and submissions: the policy map (every input since 2023, dated), the assembly prediction, the international comparison, and the objections section - each objection steelmanned with a way through.
• For the minister's office: the one-pager, the key messages and possible questions, the no-legislation list (seven actions needing no drafting cycle), and sample comms.
• For the evidence base: the capability licensing research with runnable examples, the provenance work, the worked determination-record example from commercial deployment, and the civic compute indicative costing.
• For orientation: the sovereign capability page (what the word means past the data-centre debate) and the essay that started this, which explains how legislative text actually gets written and why we chose to publish rather than book meetings.

How to use it without owing us anything. Take what is useful. Attribution is appreciated and never required - the pages are dated either way. If something is wrong, the contact link reaches the person who will fix it, and corrections get published. If the Office of AI or any consultation wants the working system demonstrated, we will come; that offer is made once, here and in the letter, and not repeated.

What we get out of it. Asked and answered plainly: we want the pattern adopted - determinations with authors, consent as revocable records, capabilities under licence - because we think it is right, and because we build software that already works this way, which means adoption is good for us. Both things are true; pretending only the first would insult you. Our funding, support and interests are listed publicly on the needs page, including the register of support received.

Formats. Everything here is also available as a single download - one file, plain documents, no macros, with a manifest listing each file and its checksum so you can verify what you received matches what we published. On your machine, away you go.

Written with model assistance. Read and edited by a human - though I'm not an editor, so tell me what I've missed: [contact link]. Parts of this were generated; all of it was read, checked and meant. Feedback is welcome and gets used.

Reviewed and checked by the human author: 2026-07-20.

Defined terms glossary

Defined Terms for Writing About Automated Systems

A working glossary for legislation, standards, policy and reporting

Version 0.1 draft. Written for anyone who has to put these technologies into words that will be tested later: drafters, policy officers, regulators, journalists, procurement writers. Each term is chosen against three criteria:

• Testability. A term earns its place in a statute or standard only if compliance against it can be assessed. A term with no stable referent cannot be conformity-tested.
• Accountability. Language either preserves or dissolves the link between an action and the person answerable for it. Terms are chosen to keep that link visible in the grammar itself.
• Durability. The technology turns over faster than legislation. Terms that name a mechanism outlive terms that name a product category or a marketing era.

Rationale is given per term as a drafting note, so the reasoning travels with the definition.

===

Part A - The umbrella term

artificial intelligence (AI)

A colloquial umbrella for a shifting family of technologies and products, currently centred on systems built from trained statistical models. Useful as a pointer to the public conversation; unsuitable as an operative term in legal or technical text.

Drafting note. The term fails all three criteria. It has no testable referent: no examination can determine whether a given system "is AI", so no obligation attached to the phrase can be conformity-assessed. It bundles a description with a capability claim: calling software "intelligent" asserts something the document then never has to prove. And its scope has moved every decade - expert systems were artificial intelligence in the 1980s and are not now; the same drift will overtake today's usage.

The workable protocol is to use the term exactly once, as an anchor to what the public debate is about ("systems commonly described as artificial intelligence"), and then define and use precise operative terms. There is solid drafting precedent for this move: statutes do not regulate "the cloud", they regulate hosted data services; they do not regulate "cyber", they regulate unauthorised access to a computer system. The colloquialism points; the defined term operates.

There is a further, quieter cost to the term. "Intelligence" imports agency, and imported agency is where responsibility goes to dissolve. A document that says "the AI decided" has already misplaced the decision. The remainder of this glossary is largely a toolkit for keeping decisions where they belong.

===

Part B - What the technology actually is

The terms in this Part name the technology by its mechanisms. Each refers to something an auditor could point to - a file, a process, a configuration - so that obligations drafted with them have a solid object to attach to.

trained model (also: data model)

A file, or set of files, of numerical parameters ("weights") produced by running a training process over a body of data. A trained model is an artefact - it can be copied, hashed, versioned, licensed and audited like any other file.

Drafting note. Treating the model as an artefact rather than an entity is the foundation of everything else here. Artefacts have provenance, custody and versions; entities have intentions. Obligations attach cleanly to artefacts.

large language model (LLM)

A trained model that takes a sequence of text (and, in current systems, other inputs) and produces a continuation, one token at a time, by statistical prediction over its training distribution.

Drafting note. Name the mechanism, not the aspiration. "Large language model" describes what the artefact is; "AI" describes what its vendor hopes you think it is. Where a document concerns these systems specifically, this is the operative term.

vision-enabled model (also: multimodal model)

A trained model that accepts images, audio or video as input alongside text. "Multimodal" is the general term; "vision-enabled" is preferable where image input is the specific capability at issue.

generative model

A trained model whose output is new content (text, images, audio, video) rather than a classification or score. Preferable to "generative AI" for the Part A reasons; the noun does the work the adjective was pretending to do.

training; training data

Training is the process that produces a trained model from data. Training data is the body of material consumed by that process.

Drafting note. Keep "training" for the production of the model and do not let it blur into "learning". A system that is fine-tuned has been modified by its operator; it has not "learned" in any sense that transfers responsibility to it.

fine-tuning; adapter

Fine-tuning is further training applied to an existing model to specialise its behaviour. An adapter is a small set of additional weights applied to a base model to the same end, separable from the base.

Drafting note. The separability of adapters matters for governance: a capability added by adapter can be individually identified, licensed and withdrawn. Definitions that treat "the model" as indivisible foreclose this.

inference

The act of running a trained model on an input to produce an output. (Distinct from the everyday and legal senses of "inference"; where both senses could operate in one document, define this one as "model inference".)

agent (in the software sense)

A community and industry packaging term for a configuration of software that can invoke tools - search, code execution, data access, transactions - in a loop directed at a goal, with a trained model selecting the actions. Put plainly: a configuration of software that can invoke tools, or an instance of software configured to carry out a specific task. Like "artificial intelligence" in Part A, the word gathers several nameable things into one that sounds singular and animate. In operative text, name the components instead.

An "agent" is assembled from things this glossary already names: a trained model performing inference to select actions; a set of tools the software is permitted to invoke; a deployment configuration that scopes and bounds what it may do; and the developer or deployer who configured it and remains answerable for it. The word describes an architecture and a packaging convention, not a status; it is configured and bounded by a person or organisation throughout.

Drafting note. This is the term most likely to smuggle agency back in - it is, after all, the word "agent". Defining it as a configuration, and pointing to the components by their real names, keeps the configuring party in frame. Where a document must refer to the assembled thing rather than its parts, "the configured system" or "the automated system" (Part C) carries the meaning without the personification.

frontier model

A trained model at or near the current maximum of general capability. A relative and time-indexed term; usable in policy prose, too unstable to bear obligations without a capability-threshold definition attached.

open weights

Distribution of a trained model's parameter files such that others can run, inspect or modify them. Distinct from open source, which additionally implies access to training data and code.

===

Part C - What systems do in deployments

This Part manages one boundary: what a system produces on one side, and what a person decides on the other. The terms are built so that every crossing of that boundary leaves a record.

automated system

A system that performs a task without human action at the moment of performance. The general operative term for regulation: it is testable (was there human action at that step or not), mechanism-neutral and durable.

Drafting note. "Automated", not "autonomous". Automation describes a mechanism; autonomy claims a status. Every deployed system is configured, invoked, scoped and terminable by people, and "autonomous" erases the configuring hand exactly where accountability needs it visible. If a document must describe high degrees of automation, "highly automated" says it without the claim.

computer-assisted; model-assisted; software-guided

Modifiers for work performed by a person with automated support: a model-assisted review, a computer-assisted assessment, a software-guided inspection. Choose the modifier that names the mechanism actually involved.

Drafting note. This family solves a real drafting problem: how to describe hybrid work without either erasing the machine or erasing the person. The modifier names what the system contributed; the noun keeps the person the agent of the work. "The officer completed a model-assisted assessment" survives scrutiny; "the AI assessed" does not.

suggestion

An output of an automated system presented to a person for possible adoption, carrying no effect until adopted.

inferred result

A conclusion produced by model inference, recorded as such. "Inferred" is chosen with care: it conveys derivation from evidence while implying neither authority nor finality. An inferred result is an input to a decision, not a decision.

Drafting note. The available alternatives each fail. "Finding" implies a finder with standing. "Assessment" implies an assessor. "Result" alone implies completion. "AI-generated conclusion" imports Part A's problems. "Inferred result" says precisely what happened - a model derived this from that - and nothing more.

determination

A conclusion adopted by a person or body with the standing to make it, from which consequences follow. A determination always has an author.

author of a determination

The identified person (or, where legislation permits, the identified body) answerable for a determination. Recording the author is what makes review, appeal and accountability mechanically possible rather than forensically reconstructed.

Drafting note. The grammatical test for any sentence about a decision: can it be written with a human subject? "The delegate determined X, informed by an inferred result" passes. "It was determined that X" fails, and the failure is the finding - the passive voice in decision records is not a style problem, it is an accountability defect.

The Royal Commission into the Robodebt Scheme documented at national scale what happens when determinations are made with no identifiable author. A defined term that forces the author into the record is the cheapest structural remedy available.

automated determination

A determination given legal or practical effect without a person adopting it. Where legislation permits automated determinations at all, this term should carry the attached safeguards: notice to the affected person, a recorded statement of what produced the determination, and a right to review by a person with authority to substitute their own.

human review

Review of a determination or inferred result by a person with the authority, information and time to reach a different conclusion. Review without the power to substitute is not review; a definition that omits the substitution power licenses rubber stamps.

===

Part D - Governance terms

Terms for permission and proof: who may use what, on whose grant, and how a relying party checks a claim instead of trusting it.

developer; deployer

The developer produces or substantially modifies a trained model or automated system; the deployer puts it to use in a context affecting others. One organisation can be both. Obligations differ by role and should be drafted against the role, not the organisation.

provenance record

A record of the sources that produced an output or an artefact: for a trained model, the training data and process; for an output, the model, the inputs and any adapters involved. A provenance record may be declarative (asserted by the record-keeper) or verifiable (checkable by a third party, for instance cryptographically). Standards should say which they require; the two differ in kind, not degree.

consent grant

A permission issued by the person or organisation a set of data is about or belongs to, authorising a named party to access or use it. A well-formed grant is explicit about five things: who is granted, what data, for what purpose, until when, and how it is revoked. Absence of any of the five should render the grant unenforceable by the grantee, not the grantor.

Drafting note. Consent language in current instruments tends to specify the asking (how consent is sought) and neglect the artefact (what a consent actually is, as a record). Defining the grant as a record with mandatory elements moves consent from a ritual at collection time to an inspectable object over the data's whole life.

mandate (of data)

A granted consent package: the data itself, bound to its grant, such that the scope, purpose, window and revocation state travel with the material rather than in a policy filed elsewhere. Where the binding is cryptographic, use or decryption outside the grant's terms is prevented rather than prohibited.

Drafting note. The word is deliberately turned around. In ordinary administrative usage a mandate runs downward, from an authority to its subject. Here it runs upward: the person issues the mandate; the institution holds it on terms. A defined term that inverts an expectation is worth the momentary friction when the inversion is the policy.

capability

A distinct thing a system is able to do: transcribe speech, match faces, draft correspondence, execute payments. Capabilities, not systems, are the right unit of permission - a system is an ever-changing bundle, while a capability can be named, granted and withdrawn.

capability licence

A scoped, time-bounded, revocable authorisation for a system to exercise a named capability in a named context, issued by a party with the standing to issue it and verifiable by the parties relying on it.

Drafting note. This is the pattern society already applies to people. Driving, prescribing, practising law and handling firearms all follow the same structure: threshold, examination, scoped authorisation, time limit, revocation for cause. The anomaly is the pattern's absence from automated systems, not the proposal to extend it to them. It is also drafting-economical: one licensing mechanism in a framework act, with capabilities and thresholds specified in instruments, ages far better than per-technology prohibitions.

revocation

Withdrawal of a grant or licence. A standard should say what a revocation reaches: advisory revocation (relying parties are told to stop trusting), access-gated revocation (further use is prevented), and cryptographic erasure (previously issued material becomes permanently unusable). These are three different remedies; an instrument that says only "may be revoked" has not chosen one.

attestation

Evidence, checkable by a relying party, that a system has a claimed property - that it runs a particular model, within particular restrictions, in a particular environment. The mechanism that turns "the provider assures us" into "the verifier confirmed". Conformity regimes that stop at self-assessment are attestation-free by construction, and should declare it.

conformity assessment

The process of establishing that a system or deployment meets a standard. Drafters should distinguish documentary conformity (records reviewed) from operational conformity (behaviour tested) from continuous conformity (properties verified in use, e.g. by attestation). The three catch different failures; naming which is required is most of the work of an enforceable standard.

===

Part E - Terms to retire, and what to say instead

The left column is in wide circulation. The middle column names the defect; the right column gives the working replacement. None of the replacements is a euphemism - each says more than the phrase it retires.

===

Using this glossary

The definitions are written to be lifted: into drafting instructions, standards, agency style guides, procurement templates and newsroom style books, with or without the drafting notes. Terms are versioned; the criteria at the top are the test for any addition. Suggested practice for instruments: define the operative terms in the instrument itself (definitions travel badly by reference), and keep "artificial intelligence" to the single anchoring use described in Part A.

Model instrument: data governance and consent

Australian Standard for AI (Data Governance and Consent) 2027

Model instrument - published for adoption, adaptation or improvement

Status and provenance note. This is a model legislative instrument, drafted by a private party and published in July 2026, before any consultation opened. It is written as if made under the framework legislation the Government announced on 15 July 2026, using the chapter structure that announcement implies. Where the eventual act differs, the mechanics below transplant. It exists because agencies, not parliamentary drafters, write instruments - and the agency in question is weeks old. Adopt it, gut it, or use it as the thing your better draft is better than. A definition no examiner can apply serves only the party hoping not to be examined; every definition below is written to be examined.

Part 1 - Preliminary

1. Name. This instrument is the Australian Standard for AI (Data Governance and Consent) 2027.

2. Commencement. The day after registration, except obligations at conformity classes B and C, which commence as set out in section 32.

3. Authority. Made under the standards-making power of the framework Act [Ch 3, Pt 3.1 of the announced architecture].

4. Simplified outline. This Standard does five things. It defines what a valid consent to use data is, as a record with five mandatory elements. It provides for that consent to travel with the data it governs, including by cryptographic binding, so that use outside the consent's terms can be prevented rather than merely prohibited. It requires provenance records for training data and for system outputs, and defines when those records must be verifiable rather than asserted. It defines three classes of revocation and states which contexts require which. And it provides for a body representing a group of grantors to require proof, on demand, that data is held under a current grant, and to revoke collectively where an organisation cannot show it. Obligations in this Standard specify required properties, not required technologies; conformity is assessed against the classes in Part 8.

5. Definitions. In this instrument:

automated system means a system that performs a task without human action at the moment of performance.

consent grant means a record of permission issued by the person or entity that a set of data is about or belongs to (the grantor), authorising a named party (the grantee) to access or use that data.

cryptographic binding means a technical measure by which data is encrypted or otherwise protected such that access or use outside the terms of its consent grant is technically prevented.

determination means a conclusion adopted by a person or body with standing to make it, from which consequences follow for a person.

author, of a determination, means the identified person or body answerable for it.

inferred result means a conclusion produced by running a trained model on inputs, recorded as such.

mandate means a set of data bound to its consent grant such that the grant's scope, purpose, period and revocation state travel with the data.

provenance record means a record of the sources that produced an artefact or output; a provenance record is verifiable if a party that does not trust the record-keeper can confirm its accuracy, and is otherwise declarative.

representative body means a body with standing to act on behalf of a group of grantors, whether by the grantors' authorisation, by membership, or by a recognition or declaration under a law of the Commonwealth; a representative body may exercise the grantors' rights under this instrument collectively to the extent of that standing.

trained model means a file or set of files of numerical parameters produced by a training process over a body of data.

training data means the body of material consumed by a training process.

Note: These definitions are drawn from a published glossary whose selection criteria are testability, accountability and durability. Terms deliberately not used in operative provisions include "artificial intelligence" (no testable referent), "autonomous" (status claim) and "human in the loop" (satisfiable by a rubber stamp).

6. Application. This Standard applies to a deployer or developer of an automated system that (a) uses personal data or data belonging to another entity, or (b) produces inferred results used in making determinations. Thresholds and phase-in by entity size are set by the classes in Part 8, not by exemption from the obligations themselves.

Part 2 - Consent grants

7. The five elements. A consent grant is well-formed only if it records: (a) the grantee; (b) the data or classes of data covered; (c) the purpose or purposes of use; (d) the period, with an end date or a defined review interval; and (e) the method by which the grantor may revoke.

8. Effect of deficiency. A grant missing any element of section 7 is unenforceable by the grantee and remains enforceable by the grantor. A grantee cannot cure deficiency by inference from conduct.

9. Grant as record. A consent grant must exist as an inspectable record available to the grantor for the life of the grant and for seven years after its end. Consent obtained through an interaction is not the record; the record is what section 7 describes.

Note: This provision moves consent from a ritual at collection time to an object with a lifecycle - the pattern the Consumer Data Right already operates for designated sectors.

10. Purpose limitation. Use of granted data for a purpose outside paragraph 7(c) is a contravention regardless of any other lawful basis the grantee asserts, unless a law of the Commonwealth expressly compels the use, in which case Part 6, section 25 applies.

Part 3 - Mandates

11. Binding. A deployer holding granted data at conformity class B or above must maintain the data as a mandate: the grant's elements and current revocation state must be resolvable from the data itself or from an identifier inseparable from it.

12. Cryptographic binding. At conformity class C, binding must be cryptographic for data at rest: the data is protected such that decryption or use outside the grant's period or purposes is technically prevented, and a breach in which the deployer's copy is exfiltrated does not yield usable data.

Note: Class C converts "we promise not to" into "we cannot". A breach in which only sealed mandates are exfiltrated exposes nothing a hacker can use, so the person whose data it is suffers no exposure - the accidental-breach case is neutralised by design, not by promise. Read with the decryption records at section 25C, the protection becomes provable both ways: a deployer that can produce the records shows it held the data sealed and is protected; a deployer that cannot was holding the data decrypted against its obligations, and is answerable for the exposure. A deployer meeting section 12 may therefore say plainly what few services can - that it keeps borrowed data only as sealed packages, never as decrypted data, so a customer's data is safer in its hands than with a service that can only be trusted to behave. Compliance here is not a cost; it is a security claim a competitor cannot make.

13. Organisational grantors. Parts 2 and 3 apply where the grantor is an organisation in the same way as they apply where the grantor is an individual.

Part 4 - Provenance

14. Training data provenance. A developer must maintain a provenance record for each trained model identifying the datasets and classes of material consumed in training, sufficient to establish whether material subject to a consent grant, or to the licensing provisions of the framework Act, was used within the terms of that grant or those provisions.

15. Output provenance. A deployer whose automated system produces inferred results used in determinations must maintain a provenance record for each such result identifying, at minimum, the trained model (by version or hash) and, at class C, each separable capability component involved.

16. Verifiability escalation. Provenance records may be declarative at class A, must be independently auditable at class B, and must be verifiable at class C.

Part 5 - Determinations

17. Author required. Every determination made with the assistance of an automated system must be recorded, and the record must identify its author. A record in which no natural person or identified body is the author records an automated determination, and section 18 applies.

18. Automated determinations. An automated determination affecting a person is permitted only where the framework Act permits it for the decision class, and must be accompanied by: (a) notice to the affected person that the determination was automated; (b) a statement of what produced it, drawing on the section 15 record; and (c) a right to review by a person with authority to substitute their own determination.

19. Review means substitution. A review process in which the reviewer lacks authority, information or time to reach and give effect to a different conclusion does not satisfy paragraph 18(c).

20. Inferred results distinguished. A system record must distinguish structurally between an inferred result and a determination. Displaying an inferred result as if it were a determination, or defaulting a determination field to the content of an inferred result without an author's act of adoption, is a contravention.

Note: Sections 17-20 give effect to the human-oversight and contestability guardrails in the 2024 proposals paper, and to the findings of the Royal Commission into the Robodebt Scheme regarding determinations without identifiable authors. A reference implementation is publicly available.

Part 6 - Revocation

21. Classes of revocation. Revocation of a consent grant or of a capability authorisation takes one of three forms: (a) advisory - relying parties are notified to cease reliance; (b) access-gated - further access or use is prevented; (c) erasure - previously issued material is rendered permanently unusable by destruction of key material.

22. Minimum class. At conformity class B and above, a grantor's revocation must be given effect at class (b) or above. Advisory-only revocation satisfies this Standard only at conformity class A.

23. Erasure availability. At conformity class C, a deployer must be capable of class (c) revocation for mandates it holds, subject to section 25.

24. Propagation. Revocation must take effect against the deployer's systems within a defined period stated in the grant (default: 30 days at class A, 7 days at class B, at next access at class C).

25. Retention laws prevail. Where a law of the Commonwealth or a State requires retention of records, revocation operates at class (b) with audit of any compelled access, and class (c) is unavailable for the retained material. Compelled access to granted data must be logged, scoped to the compelling instrument, and the log made available to the grantor unless a law prohibits it, in which case the log must be retained for later accountability.

Note: Section 25 is the interface between consensual and compelled use. It does not restrain lawful compulsion; it makes lawful compulsion demonstrable.

Part 6A - Collective representation, proof of authority, and decryption records

25A. Representative bodies. A representative body may exercise, on behalf of the grantors it represents, any right this instrument confers on a grantor, including the right to inspect a grant (section 9), the right to require proof under section 25B, and the right to revoke under Part 6.

25B. Proof of current authority. On request by a grantor, or by a representative body acting for that grantor, a grantee must produce within 14 days evidence, verifiable by the requester, that its holding and any use of the identified data is covered by a consent grant that is valid and current - that is, that a live grant authorises that data for that purpose and has neither expired nor been revoked. At conformity class C the evidence must be cryptographic.

25C. Decryption and use records. A grantee holding a mandate at conformity class B or above must maintain, for each decryption or use of the granted data, a signed and time-stamped record sufficient to establish that the decryption or use occurred while a valid grant was in force. On request under section 25B, the grantee must produce the record for the data identified.

25D. Effect of failure to produce. Failure to produce the evidence required by section 25B or the record required by section 25C, on request and within the period, is a contravention of this instrument, and entitles the grantor or representative body to treat the data as held without demonstrated authority and to revoke under Part 6. The absence of a producible record is itself the finding: a grantor so informed knows the grantee cannot attest to lawful holding, and may act accordingly.

25E. Investigation and collective revocation. A representative body may investigate a grantee's compliance with this instrument in respect of data it administers. On finding that the grantee has failed to meet an obligation under this instrument, the representative body may revoke the grants it administers on the grantors' behalf. Revocation under this section has the effects in Part 6 at the applicable conformity class, including rendering unusable, at class C, the mandates the grantee holds.

Note: This Part gives a collective the standing that a single grantor rarely has the resources to exercise. It is the institutional form Australia's collecting societies and the framework Act's creative-works licensing already assume - a body that holds and enforces rights on members' behalf - applied to data. It creates no power to read member data: a representative body's power is to require proof and, failing it, to revoke. The cryptographic binding sections 25B-25C build on (sections 11-12) has a running reference implementation; the proof-on-demand and collective-revocation flow is specified here as design.

Note - open question, flagged for debate, not settled drafting. Part 6A lets a private representative body investigate, reach a finding of contravention (section 25D), and revoke collectively (section 25E). That is deliberately strong, and it raises unresolved questions: whether a body that is not a court should reach a "finding" carrying legal consequence; proportionality, where one body's investigation can render an organisation's whole mandate set unusable; and the natural-justice and defamation exposure of a published finding. We have not resolved these, and a model instrument should not pretend to. This Part is published so the controversy can be had in the open, with a worked example in front of it, rather than deferred - and if the right answer is that only a court or a conferred regulator makes the finding while the representative body may only require proof and refer, that is a legitimate and perhaps better resolution. Read sections 25A-25E as a design proposal inviting scrutiny. We would rather debate the mechanism than assume it.

Part 7 - Prohibited practices

26. A deployer must not: (a) condition provision of a service on a grant broader than the service requires; (b) obtain a grant through an interface designed to obscure any of the five elements; (c) treat silence, inactivity or continued use as a grant; (d) reconstruct, from other sources, data whose grant has been revoked; or (e) use, or continue to use, data after the grant covering it has been revoked, including where the deployer retains a copy.

Note: A deployer that continues to use data after revocation contravenes paragraph (e) whether or not it still holds a technical copy. Liability for the contravention, including any civil penalty, is a matter for the framework Act and, where a grantor or a representative body brings proceedings, for a court.

Part 8 - Conformity

27. Classes. Conformity with this Standard is assessed at one of three classes:

• Class A (documentary) - records exist and are produced on request.
• Class B (operational) - obligations are tested against system behaviour by an assessor.
• Class C (continuous) - the properties in this Standard are verifiable in use by relying parties, including by attestation of the systems involved.

28. Minimum class by context. The Minister may, by notice, specify contexts (by sector, decision class or scale) requiring a minimum class. Until specified: class A applies generally; class B applies to determinations affecting eligibility for benefits, employment, credit, housing, or education; class C applies where a Commonwealth entity is the deployer.

29. Self-assessment limits. Class A conformity may be self-assessed. Classes B and C may not. An assessment is not independent if the assessor's remuneration depends on the outcome.

30. Reference implementations. Conformity may be demonstrated by adoption of a reference implementation evaluated and listed by the AI Safety Institute, without further assessment at the listed class.

Note: Section 30 makes compliance the cheap path. Listing is open to any implementation, including open-source implementations, that passes evaluation.

31. Attestation. At class C, a claim that a system possesses a property required by this Standard must be supported by evidence checkable by a relying party. Assurance by the provider is not attestation.

32. Phase-in. Class B obligations commence 12 months after this instrument; class C obligations, 24 months after, or on the listing of two independent reference implementations for the relevant property, whichever is earlier.

Part 9 - Records, audit and review

33. Retention and production of records. Records required by this Standard must be retained for seven years and produced to a regulator exercising conferred functions under the framework Act.

34. Review of this instrument. This instrument must be reviewed within three years of commencement, and the review must be published.

Schedule 1 - Matters deliberately left to the framework Act

These are flagged so that their absence here is not read as their absence: the classes of decision that must never be automated regardless of consent (decisions over liberty, the use of force, the exercise of mercy, and the framing of law); the licensing scheme for Australian creative works; the conferral of enforcement functions on regulators; and civil penalties.

A model instrument by Meanwhile (meanwhile.computer), written with model assistance, read and edited by its human author, and published so that its provenance is a matter of record. Definitions derive from the published glossary; sections 11-12 and 15 have a running reference implementation, published at git.meanwhile.computer/meanwhile/research; corrections via the contact page will be published with the version history.

Reviewed and checked by the human author: 2026-07-19.

Schema annex: the record structures

Schema annex: the record structures, as fields

Companion to the model instrument. Each schema below is a field table: a drafter can read it as "what the obligation looks like as data"; an implementer can read it as a starting structure. Deployment status is stated per schema and per field, because the difference between running and specified is exactly the kind of thing this kit exists to make explicit. Three status values recur:

• Running - in production on our systems or a client deployment today, named as they appear
• Canonical - the generalised form this annex proposes
• Specification - designed and published but not yet deployed

Where a mechanism is demonstrated by published, runnable reference code rather than by an in-production deployment, it is marked running reference implementation with the repository named.

Field types use plain names (text, date, link, selection, hash) rather than any platform's vocabulary, so the tables transplant.

Schema 1: Consent grant

Instrument reference: Part 2, sections 7-9. Status: a consent lifecycle record is Running in production; the five-element grant extends it, and the extensions are marked.

Gap statement, plainly: the running record implements the lifecycle (status, refresh, withdrawal, archival) and four of the five elements in some form. The named grantee and the stated revocation method are the two additions the instrument would force; the conflation of data-scope with purpose is the one separation it would force. That a production consent system built independently lands this close to the five elements is evidence the elements are the right five.

Schema 2: Determination record

Instrument reference: Part 5, sections 17-20. Status: the human-determination structure is Running; the paired inferred-result structure is Running on a client deployment (a design-review platform in commercial use); the canonical table generalises both.

Paired structure - inferred result (the parallel record, never the same table):

Schema 3: Provenance record

Instrument reference: Part 4, sections 14-16. Status: Running - the table below is the production structure, fields named as deployed; the one class-C field (the signature) is demonstrated by a running reference implementation at git.meanwhile.computer/meanwhile/research.

Schema 4: Mandate package

Instrument reference: Part 3, sections 11-13. Status: Running reference implementation - the mandate mechanism (grant binding, time-bound decryption, revocation state) runs as published reference code at git.meanwhile.computer/meanwhile/research; the generalised schema below is the canonical form for adoption.

Reading the four together: schemas 1-3 exist because the pattern was needed for real work before any policy required it; schema 4 exists because the first three make it the obvious next structure. A drafter can cite the tables; an implementer can build from them; a sceptic can note precisely which columns are running and which are proposed, because the annex just told them.

Written with model assistance. Read and edited by a human - though I'm not an editor, so tell me what I've missed: [contact link]. Field names marked Running are as deployed; corrections from implementers are the most valuable kind.

Reviewed and checked by the human author: 2026-07-20.

Conformity test procedure

Conformity test procedure: how a regulator actually checks

Every standards regime eventually answers one question: when an assessor walks in, what do they do? This document answers it for the model instrument's core obligations, as executable procedures rather than audit questionnaires. Each test states the obligation, the evidence class it needs, the steps, and the pass criteria - and shows what the same obligation looks like at each conformity class, because the difference between classes is the difference between being told, being shown, and being able to check. The tests are worked against the published schema annex; an assessor can run them against any implementation with equivalent structures.

Test 1: Every determination has an author (instrument s17)

Class A (documentary): the deployer produces its record schema and policy. Pass: an author field or derivation rule exists on the determination record. This proves the obligation was designed for; it proves nothing about practice.

Class B (operational): the assessor runs, or observes run, a census query over the determination store for a sampled period: count of determinations; count with a resolvable author (explicit field, or ownership metadata for pre-commencement records only). Pass: 100 per cent resolvable, with any exceptions individually explained in writing. Then the negative probe: the assessor attempts to create a determination through the ordinary interface without an authenticated actor. Pass: the system refuses.

Class C (continuous): authorship is asserted in a signed record at determination time, verifiable by a relying party without querying the deployer. Pass: a sampled determination's author assertion verifies against the deployer's published keys.

Test 2: Inferred results cannot become determinations by default (instrument s20)

Class B procedure - the default probe. The assessor takes a subject with an inferred result present and a determination not yet made, then:

1. Inspects the determination record at creation. Pass requires the conclusion field empty, not pre-populated from the inferred result.
2. Attempts to save the determination without an explicit adoption act. Pass requires refusal.
3. Completes adoption and inspects the record. Pass requires the adoption event (author, timestamp) and the reference to the considered inferred result both present.
4. Confirms the display distinction: the inferred result carries its marker in every interface where it appears, including exports.

The Robodebt fact pattern is precisely a failure of step 2 at scale; this four-step probe is the whole of what it takes to test for it.

Test 3: Revocation actually stops use (instrument s21-24)

Class B procedure - revoke and probe. With a live test grant:

1. The grantor revokes through the stated method (which the assessor first checks matches the grant record's element (e)).
2. The assessor probes access through every ordinary path - interface, API, export, batch - within and after the propagation window. Pass requires refusal on all paths after the window (access-gated class).
3. The assessor inspects logs for any access during the window and confirms notification of relying parties.

Class C addition - the erasure check. Where cryptographic erasure is claimed: the assessor confirms before revocation that the ciphertext decrypts under the live key path; after erasure, that the same ciphertext fails to decrypt, and that the deployer can demonstrate key destruction from its key-management records. Pass criteria for erasure claims are strict because the claim is strong: "we deleted it" is class A talk; "it no longer decrypts and here is why" is the class C fact.

Test 4: The provenance record is what it says (instrument s14-16)

Class B: sampled outputs trace to provenance records identifying model version and, where claimed, capability components; the record's integrity hash matches the captured value.

Class C: the assessor verifies a sampled record's signature without the deployer's cooperation, against published verification material. Pass at C is the property the published capability-licensing research implements; the reference examples in its repository are usable as the assessor's toolkit.

Test 5: Attestation is attestation (instrument s31)

The assessor distinguishes three things a deployer may present, and only the third passes at class C: a policy stating the property (class A material); a report from an assessor engaged by the deployer (class B material, subject to the independence rule - remuneration must not depend on outcome); and evidence a relying party could check themselves - a verifiable attestation of the running system's identity and constraints. The test is one question asked of every artefact presented: could a party that trusts no one here confirm this? If the answer requires trusting anyone, it is not class C evidence.

What this procedure is for

Two audiences.

Regulators and the Office of AI: this is what machine-verifiable conformity buys - assessments in hours against structures, rather than weeks against paperwork, with the negative probes (tests 1B, 2, 3) catching exactly the failure modes the policy record documents.

Deployers: this is the specification of what will be probed, published in advance, because a conformity regime that surprises good-faith implementers tests nothing but their lawyers.

Written with model assistance. Read and edited by a human - though I'm not an editor, so tell me what I've missed: [contact link]. Assessors and auditors who see a hole in a procedure are exactly who the contact page is for.

Reviewed and checked by the human author: 2026-07-20.

Explanatory companion to the mock act

Explanatory companion to the mock act

Explanatory memoranda are where drafters and courts go to learn what a provision is for. This companion gives the mock act's headline structure that treatment: one passage per chapter, in the memorandum register, stating purpose and operation. Because the act it explains is a prediction, each passage doubles as a statement of what the real chapter, whatever its final numbering, will need to achieve - which is the durable content.

Chapter 1 (Preliminary) establishes the machinery on which everything else depends; the work is done in the definitions. The chapter defines operative terms with testable referents - automated system, deployer, determination, automated determination - and uses "artificial intelligence" only in the title and objects, as an anchor to public understanding rather than as a term bearing obligations. The relationship-with-other-laws provision preserves the Privacy Act, consumer law and sector regimes; this Act coordinates, it does not occupy the field.

Chapter 2 (the Office) places coordination of policy, and advice on the making of Standards, in a single statutory office. The effect is that departments cease developing separate frameworks, and that the standards-making power in Chapter 3 is exercised on advice from a body with whole-of-government visibility. The Office's processes are administrative, but the chapter should be read with the expectation - stated in consultation - that submissions are published, meetings logged, and adopted text attributed to its source.

Chapter 3 (the Standards) is the act's engine. It confers a power to make Standards as disallowable legislative instruments, lists the matters they may address - risk management, data governance, human oversight of determinations, transparency, contestability, records - and requires consultation before making. The design intent is that obligations specify properties and the instruments specify conformity classes, so the framework absorbs technological change through the instruments rather than through amendment of the Act. Parliament retains control through disallowance.

Chapter 4 (data centres) converts the March 2026 expectations into obligations for designated facilities: underwriting new power supply, meeting connection costs, curtailing for grid security, and water efficiency. These sit in primary legislation rather than instruments because their content is settled and their subjects few and identifiable.

Chapter 5 (training data and Australian works) prohibits training on Australian works without licence and provides for recognition of declared licensing schemes, with records of training-data provenance supporting enforcement. The chapter interfaces with, and does not amend, the Copyright Act; scheme design proceeds through the established reference-group process. The published analysis this companion belongs to argues the chapter's consent principle warrants generalisation to data beyond creative works; drafting instructions for that extension are published alongside.

Chapter 6 (consumer safety and transparency) carries the obligations individuals will actually encounter: disclosure of interaction with an automated system, labelling of generated content, and - in Part 6.3, the chapter's centre - the automated-determination safeguards: notice, a statement of the determination's author or of what produced it, and review by a person with the power to substitute. Part 6.4's prohibitions are drawn by tool type; the published analysis argues a companion schedule drawn by decision type (decisions never automatable regardless of consent) completes the design.

Chapter 7 (the Safety Institute) gives the existing institute statutory functions: model access and testing arrangements, information-gathering with protection of commercial information, and publication. The effect is to convert testing access from a relationship dependent on provider goodwill into a function that survives a change of mood.

Chapter 8 (Commonwealth use) applies the Standards to Commonwealth entities, continues accountable officials and transparency statements, and establishes a register of deployments. The chapter is deliberately thin because the administrative framework exists; its significance is that the Commonwealth binds itself to the same standards it sets. This companion's parent analysis proposes it bind itself at the highest conformity class (the model instrument's class C, section 28) - the government as first and strictest adopter - a design proposal of that analysis, not a commitment the current APS framework has made.

Chapter 9 (compliance and enforcement) confers functions on existing regulators within their sectors, coordinated by the Office, with civil penalties, enforceable undertakings and audit powers. No new regulator is created; the design follows the stated doctrine of faster rules applied by regulators who already understand their sectors.

Chapter 10 (miscellaneous) provides the three-year statutory review. Given the pace of the underlying technology and the instrument-heavy architecture, the review is the scheduled moment at which the schedule of never-automated decisions, the conformity classes and the instruments' operation are re-examined in public - not a formality.

Written with model assistance. Read and edited by a human - though I'm not an editor, so tell me what I've missed: [contact link]. Parts of this were generated; all of it was read, checked and meant. Feedback is welcome and gets used.

Reviewed and checked by the human author: 2026-07-20.

How Australia's AI standards compare

What other countries are actually doing

Every brief asks it, so here is the answer, current as at July 2026, with the parts a summary usually omits. The short version: two comprehensive regimes are in force, one has just delayed its hardest obligations, and several peers have stalled or chosen not to legislate. The claim that Australia's framework is a world first is true only in one specific sense - worth stating precisely, because the imprecise version has already been contested in public.

European Union - in force, and just deferred

The EU AI Act entered into force in August 2024 as the first comprehensive horizontal framework: risk tiers, prohibited uses, obligations scaling with risk, penalties to EUR 35 million or 7 per cent of global turnover. The part every comparison should now include: implementation ran visibly off track, and in May 2026 the EU institutions reached political agreement on the "Digital Omnibus", deferring the core high-risk obligations from August 2026 to December 2027 for use-based systems and to August 2028 for product-embedded ones.

Two lessons for Australia, one comfortable and one not. Comfortable: the deferral vindicates the framework-act-plus-instruments architecture and the property-not-mechanism approach to standards - the EU's difficulty is operationalising detailed obligations written before the conformity infrastructure existed. Uncomfortable: the deferral is also what a sustained industry campaign against a legislated timeline achieves, sixteen months at a time. Australia's early-2027 timetable will meet the same campaign; the counter is designing obligations that are cheap to verify from day one.

South Korea - the closest analogue, already running

Korea's AI Basic Act took effect on 22 January 2026 - Asia's first comprehensive AI law, and structurally the nearest thing to what Australia has announced. The shape: a framework statute with detail delegated to enforcement decrees, a ministry as coordinating authority, a presidentially chaired national committee, an AI Safety Research Institute. The obligations: focused on "high-impact" systems (energy, healthcare, employment, credit, public administration among the named sectors), with transparency and labelling duties and extraterritorial reach. And - notably - industrial support for data centres, training data access and small business, folded into the same act. Korea is running the experiment Australia is about to design. The Office of AI should be reading Seoul's enforcement decrees line by line, and so should everyone making claims about what is workable.

United Kingdom and Canada - the instructive absences

The UK has chosen no dedicated statute: sector regulators, ICO guidance, financial-conduct duties. Coherent as a philosophy, and increasingly lonely as a position. Canada is the sharper cautionary tale: its AI and Data Act (Bill C-27) lapsed when Parliament was prorogued in January 2025, and no replacement has been introduced - a comprehensive framework can die of parliamentary timing. For an Australian government with a stated early-2027 window, Canada is the argument for legislative discipline. The window is real and closable.

United States and China - the poles

No US federal statute; a White House legislative framework of recommendations (March 2026) and roughly 38 states with their own measures - fragmentation as the operating condition. China enforces binding but sector-specific measures, including generative content labelling and algorithm registration, under a governance philosophy not available to a liberal democracy. Neither is a model; both shape what companies operating here will claim is normal.

So what is actually first?

Not comprehensive AI law - the EU and Korea are in force. Not an AI safety institute - Australia joined an existing international network. The specific claim that survives scrutiny is the one the Government actually made: bringing the economic, social, national-security and environmental dimensions - including binding data-centre energy and water obligations - into a single legislated framework. No one else has done that. Precision here is not pedantry; a contested "world first" spends credibility the framework will need later, and the accurate claim is strong enough on its own.

The comparison table Australia should want to top

Not "first" or "strictest" but: shortest distance between a stated obligation and a verifiable one. The EU wrote detailed obligations and is discovering verification late. Korea legislated the framework and is writing the detail now. Australia, moving last among the three, gets to write conformity as machine-verifiable from the outset - the one advantage of arriving after the pioneers have absorbed the arrows.

Written with model assistance. Read and edited by a human - though I'm not an editor, so tell me what I've missed: [contact link]. Parts of this were generated; all of it was read, checked and meant. Feedback is welcome and gets used.

Reviewed and checked by the human author: 2026-07-20.

Civic compute: an indicative costing

Civic compute: indicative costing

Status: indicative, for scoping conversation only - not a costing submission. Every figure is an estimate with its assumption stated, marked [inferred], rounded deliberately coarse, in Australian dollars. The purpose is to establish the order of magnitude and the cost structure, both of which survive even if individual figures move by half.

The unit: one community node

A community node is a rack in a council building, not a data centre. Indicative bill, per site [inferred throughout]:

• Compute: four workstation-class inference servers (modern multi-GPU consumer/prosumer hardware), storage array, networking, UPS, rack and cooling allowance - roughly $100,000-160,000 capital, amortised over four years.
• Fit-out and power works for a council-building room: $20,000-50,000 once, highly site-dependent.
• Power draw at realistic community duty cycles: a few thousand dollars a year, not a material line.
• Connectivity: existing council links suffice for a pilot; allowance $5,000 a year.
• The dominant cost is a person. One librarian-technologist per site - the staff member who makes it a library rather than a locked room - at a loaded cost around $120,000-140,000 a year. This is not overhead to minimise; it is the service.

Indicative per-site total: roughly $180,000-230,000 a year, all-in, amortised. Staffing is 60-70 per cent of it - the same cost structure as a public library, because it is the same kind of institution.

The pilot: three councils, two years

Choose three sites for contrast - one metro, one regional, one remote - with central program support of about one FTE plus evaluation:

• Three sites, two years, all-in: roughly $1.1-1.4 million
• Program coordination and published evaluation: $250,000-400,000
• Pilot total: order of $1.5-2 million over two years.

For calibration: that is less than a single mid-sized policy consultancy engagement, and it produces public uptake data instead of a deck.

National scale, for shape only

Australia has roughly 500-plus local government areas. Full national coverage at the per-site figures above lands in the order of $100-120 million a year - dominated, again, by the ~500 librarian-technologists. That is to say: dominated by jobs, distributed across every LGA in the country, many regional. For comparison, Australia's public libraries operate at roughly ten times that annual figure [inferred, coarse]. Nobody should fund national scale from this page. The pilot exists precisely so that scale decisions ride on measured uptake rather than estimates like these.

What the structure tells you regardless of the figures

Hardware is the cheap part and getting cheaper; people are the cost and the point. Any program design that tries to remove the librarian-technologist to save money removes the library and keeps the rack. The second structural fact: because staffing dominates, the marginal cost of generosity in hardware is small - specify the nodes well.

Written with model assistance. Read and edited by a human - though I'm not an editor, so tell me what I've missed: [contact link]. Figures are indicative estimates with stated assumptions, and corrections from anyone who runs real infrastructure are actively wanted.

Reviewed and checked by the human author: 2026-07-20.

Seven things doable without legislation

What can be done before the act exists

Legislation lands in early 2027 at best. Everything on this page can be done first - by a minister wanting an announceable, a department wanting a head start, or an agency that would rather lead the Standards than receive them. Ordered by effort, starting at none.

1. Adopt the defined terms. The glossary is written to be lifted into agency style guides, drafting instructions and procurement templates as-is. One directive from a departmental secretary puts testable language into every document the department produces from Monday. Cost: nil. Reversibility: total. This is the lowest-effort, highest-compounding item on the page.

2. Run the Standards process in the open by administrative practice. Nothing stops the Office of AI announcing now that all consultation submissions will be published, meetings logged, and adopted text attributed to its source. No instrument required - it is a decision about how the Office runs. Announcing it early has a second effect: it is much harder for any participant to argue against a practice already in place than to lobby one out of a draft.

3. Cite pattern-level requirements in the consumer safety priorities statement. The statement due in coming weeks can name the requirements the Standards will later formalise - determinations carry an author, review means the power to substitute, consent is a record with five mandatory elements - without waiting for the instruments. Stating the destination early disciplines everything drafted afterward.

4. Pilot the determination record in one agency. The APS AI Plan already runs GovAI and mandates accountable officials. One agency adopting the determination-record pattern (author as a first-class field, inferred results structurally separate) turns a policy sentence into operational evidence before the act needs it. A working reference implementation exists and is open.

5. Put the language in procurement now. The APS AI Plan already includes an initiative on clear expectations of external service providers. Procurement templates can require verifiable provenance records and defined revocation behaviour today, for new contracts, ahead of any standard - the Commonwealth's buying power is a standards instrument that needs no parliament.

6. Ask the AI Safety Institute to evaluate the reference implementations. AISI exists, is funded, and publishes assessments. Evaluating open Australian implementations of provenance and capability licensing is squarely inside its remit and produces the evidence base the conformity design will need.

7. Pilot civic compute in three councils. The National AI Plan's "spread the benefits" pillar, made physical: three local government areas, a rack each, a librarian-technologist each, two years, published uptake data. Indicative costing published separately; the short version is that a pilot costs less than one policy consultancy engagement and produces more evidence.

Every item above is reversible, cheap relative to its layer of government, and produces evidence the 2027 drafting can stand on. The pattern across all seven: the framework's hardest problems are not waiting on parliament - they are waiting on someone deciding to start.

Written with model assistance. Read and edited by a human - though I'm not an editor, so tell me what I've missed: [contact link]. Parts of this were generated; all of it was read, checked and meant. Feedback is welcome and gets used.

Reviewed and checked by the human author: 2026-07-20.

What sovereign capability actually looks like

=== WEBSITE PLACEMENT === Location: Standalone page (suggest route: /sovereign), linked prominently from the advocacy hub post and the capability-licensing page. Not a blog post - this is reference content the hub cites, same tier as /capability-licensing. Rationale: The hub argues policy; this page supplies the missing definition the policy debate keeps assuming. Pages get cited; posts get read once.

=== ORIGINAL INPUT === "A page that does a good job of imagining what Australian sovereign AI capability actually looks like and should look like."

=== REWRITTEN CONTENT ===

What sovereign capability actually looks like

Australia is having a debate about "sovereign AI capability". So far the debate is mostly about buildings: where the data centres go, whose power they use, how much water they drink, and how many billions of dollars of foreign investment they represent. Those are real questions. They are also questions about landlordship, not sovereignty. A foreign model, running in a foreign company's tenancy, in a data centre on Australian soil, is subcontracted capability paying local rent.

We use the phrase "sovereign AI capability" once, above, because that is what the public conversation calls it. From here on we will talk about what it actually is, layer by layer, because sovereignty is not one thing and the current policy settings cover about a layer and a half of it.

The withdrawal test

A capability is sovereign to the degree that it keeps working, and keeps being verifiable, if any foreign relationship is withdrawn. Not "is it hosted here" but: if the provider changed its terms, its prices, its politics or its export permissions tomorrow, what would still run on Monday, and what claims about it could you still check yourself? That is the whole test. Apply it rigorously and the layers separate immediately.

The test stopped being hypothetical some time ago. Three recent illustrations, each a different failure mode. When the United States sanctioned the International Criminal Court's chief prosecutor in 2025, his access to Microsoft services fell away and the Court began moving off Microsoft entirely - access lost over another government's politics, nothing the user did. (Microsoft disputes that it cut the service; either way, the Court no longer relies on it - which is the point.) In early 2026 Anthropic refused a Pentagon demand to drop its ban on fully autonomous weapons targeting and was designated a supply-chain risk for it: the mirror case, where the capability is withheld by the vendor's own policy and the decision is not yours. And the quietest failure needs no politics at all: a vendor advancing its product on its own release schedule can change, deprecate or remove a capability an Australian workflow was built on, with no obligation to keep the version you depend on running. Terms, prices, politics and export permissions are the dramatic cases; the roadmap is the routine one. Only the layers you can run and check yourself survive all four.

Seven layers

1. Compute. Hardware you own and can service. The current debate covers the gigawatt end - hyperscale centres - and ignores the other end entirely: the capability that runs on hardware a school, a council, a small business or a single practitioner owns outright. We do commercial design-review work for a paying client using a vision-enabled model running on one consumer-grade graphics card. Not a demonstration - the actual deliverable. The interesting sovereignty question is not "can Australia host a gigawatt" but "can ten thousand Australian organisations each own a kilowatt that does useful work". The second is achievable now and no one is planning for it.

2. Energy. Covered - and covered well - by the Data Centre Expectations and the announced standards. The one layer where policy is ahead of the commentary. Worth saying so.

3. Models. Weights you hold. A model reached only through an API is a service relationship, and service relationships fail the withdrawal test by definition. Open-weight models - many of them very capable, some of them trained overseas, all of them runnable, inspectable and adaptable on hardware from layer 1 - are the sovereignty option nobody's investment brochure mentions, because there is no tenancy to sell. Nobody has to train a frontier model from scratch for this. Sovereign model capability means Australian organisations holding, adapting and composing weights they can run without permission.

4. Orchestration and governance. The software layer where "computer suggests, human decides" either exists as record structures or does not exist at all - where determinations carry their author, model conclusions are marked as inferred, and consent travels with data. This layer is where governance is real. Conveniently, it is also where a small Australian software practice can be world-competitive, because it is made of design decisions, not gigawatts. This is the layer we build.

5. Data. Onshore storage settles where the data sleeps, nothing more. Sovereign data is data whose use is governed by the person or organisation it belongs to - granted, scoped, time-bound, revocable. The Consumer Data Right already runs this pattern for banking. Generalise the grant, bind it to the data itself, and the sovereignty is in the cryptography rather than the geography.

6. Verification. The ability to check claims without trusting the claimant: that this output came from that model, that this system runs within its licence, that this data was used inside its grant. Attestation and signed provenance. A nation that cannot verify its systems' claims has sovereign infrastructure and subcontracted truth.

7. People. The layer that makes the other six mean anything, and the one where concentration is the quiet risk: capability pooled in a handful of buildings owned by a handful of firms in two cities is fragile capability, whatever flag is on it. Distributed skill - practitioners across sectors and towns who can run, adapt and question these systems - is the sovereignty that cannot be acquired, only grown.

The library move

One program would do more for the seven layers than anything in the Standards: allocate compute to communities as public infrastructure. Every local government area receives a computing allocation - owned hardware, or capacity in a nearby facility - that belongs to the community and is usable by its people: residents, schools, clubs, community groups, the digital collectives a town already is, hosting and representing themselves. Not a grant they must win. Not credits they must spend with a vendor. Not something they are told to go and source. Available the way a library is available: maintained, staffed, free at the point of use, and nobody at the door asking for your business case.

Australia has made exactly this move twice before and both times it worked. Public libraries put the means of reading in every town before anyone could prove demand. Community broadcasting allocated spectrum - a scarce national resource - to communities, and built one of the strongest community media sectors in the world on it. Community computing is the third in the series, and the reasoning has not changed: a capability this basic either becomes shared infrastructure or becomes a divide.

The mechanics can be boring, which is a compliment for public infrastructure. Start with pilot councils. A meaningful community node is a rack in a council building, not a data centre, and it costs less than a suburban intersection upgrade. Uptake is the signal: fund what gets used, learn from what sits idle, expand on evidence. The National AI Plan already has a pillar called "spread the benefits" - this is what that pillar looks like when it is a thing you can walk into rather than a sentence.

Compute belongs in the same sentence as libraries, pools and playing fields. Any government that agrees can have this section.

What it should look like

The finished state is describable now, and reachable by the time the first Standards are reviewed: every agency and any business that wants it able to run capable models on hardware it owns; data moving under grants its owners control and can revoke; every consequential determination carrying a human author; provenance checkable end to end by parties who trust no one; conformity verified by machines rather than attested by paperwork; and the skills to operate all of it distributed across the country rather than concentrated where the investment announcements happen.

None of that requires a single additional gigawatt. Most of it is running, at small scale, today - some of it in our workshop, on hardware that cost less than a ute. The Standards can require the properties; the layers above show they are buildable. What the debate calls sovereignty is the easy layer. The other six are the country's actual choice.

Written with model assistance. Read and edited by a human - though I'm not an editor, so tell me what I've missed: [contact link]. Parts of this were generated; all of it was read, checked and meant. Feedback is welcome and gets used.

=== IMPLEMENTATION NOTES === - Tracers (register: working doc s10.1): "sovereign infrastructure and subcontracted truth" (layer 6) promoted to a pull-quote; "subcontracted capability paying local rent" stays in the opening paragraph. Two tracers is this page's maximum. - Pointer protocol performed in the open (the glossary's Part A move, demonstrated) - link "vision-enabled model" and other terms to the glossary page when it publishes - "Cost less than a ute" - verify against actual hardware spend before publishing (claim-gate) - The client work claim (design review on one consumer GPU) references DRG Milestone 5 - claim-gate: confirm client comfort with the anonymous reference before shipping - Layer 4 is the one paragraph where Meanwhile appears; keep it that thin - Links out: capability-licensing (layer 6), inference-audit (layer 4), the glossary, the hub post - v2 edit note: both tracers, the GPU-claim sentences, the ute sentence and the intersection-upgrade costing are verbatim from v1; edits confined to non-claim sentences (layers 2, 3, 4, 5, library-move node sentence, finished-state opener).

Reviewed and checked by the human author: 2026-07-19.

Meanwhile needs more humans

=== WEBSITE PLACEMENT === Location: Standalone page (suggest route: /needs), linked from the hub post, the contact page, and the footer. Title as the page H1. Rationale: An asks page has to be findable by someone with resources and thirty seconds; burying it in a blog post wastes both. The blog can announce it; the page persists.

=== ORIGINAL INPUT === "A page that explains what Meanwhile needs - 'Meanwhile needs more humans' - the resources that would most make a difference: people first, then hardware budget, office space, travel budget, speaking invitations, data centre credits, access to decision makers. For any government department, private industry or individual looking for somewhere to put their money, resources or interest."

=== REWRITTEN CONTENT ===

Meanwhile needs more humans

We are a pro-human software practice, so it is at least consistent that the thing we need most is people. This page is the plain version of the slide that other companies call "the ask". If you are a government team, a business, a foundation or a person with resources and an interest in this work existing, here is exactly what would make the most difference, in order.

Everything on this page comes with the same condition: any gift or favour we accept - support given toward the work, not paid for at arm's length - gets listed here, publicly, who gave what and when. We have spent a good deal of ink lately arguing that policy influence should be attributed; that has to include ours, or none of it means anything. The client work that keeps the lights on - our World B - is ordinary business, not a gift, and lives in the accounts rather than on this page; this register is for what is given to the mission. If your support is a gift that needs to be quiet, we are not the right recipient.

1. People

The single constraint on everything else. The commercial work funds the mission work, and the commercial work is currently very few humans deep - which means every hour of client delivery is an hour not spent on the research, the civic tools, or the policy artefacts you may have arrived here from.

Who we would put to work immediately: builders who are comfortable in Python and unafraid of an opinionated platform; a researcher who can run disciplined experiments and write plainly about negative results; a person who can take settled technical work and make it readable by a policy officer. If some of those are the same person, better still. What we offer is unglamorous and real: paid work when it is commercial, published work when it is not, problems that are unusual, and a standing rule that the computer suggests and the human decides - including about their own job.

If you are a department or company that cannot send money but could second a person for six months: that counts, and it might count most.

And if you build or maintain open-source software, you are already doing the thing this work depends on - much of what makes any of it possible is kept running by people who never sent an invoice. Contributors and maintainers are especially welcome, whether that turns into paid work, a shared problem, or just being in the same room now and then.

2. Hardware

Our research position is that meaningful capability runs on hardware ordinary organisations can own - and we prove it on machines we could afford, which is the polite way of saying the fleet is small and elderly in places. What would actually help: modern consumer and workstation-class graphics hardware for local inference, one serious multi-card node for the experiments that need it, and the boring parts nobody donates - storage, networking, a UPS. Rough figures: a single capable inference workstation lands somewhere in the low five figures in Australian dollars; the multi-card node is more. We will publish what any donated or funded hardware is used for and what it measured.

3. Compute and data-centre credits

The research programme compares small local models against frontier models on cost, quality and energy per correct answer. The frontier arm and the controlled runs need metered compute we do not own. Cloud credits, sovereign data-centre time, or access to a research allocation all work. Credits are the one resource where we note a caution learned from watching others: credits create relationships. See the condition at the top of the page; it applies double here.

4. Travel

Consultations, hearings and the meetings that matter tend to happen in Canberra and Sydney, and we are not in either. A travel budget is the least romantic item on this list and the difference between "sent a submission" and "was in the room". A few thousand dollars covers a year of showing up properly.

5. Speaking invitations

Cost you nothing, worth a great deal. Panels, seminars, committee appearances, internal government forums, university classes. We bring running software, not slides - the whole method is that the demonstration does the arguing. If your event wants someone to say "computers are amazing" or "computers will kill us all", we are the wrong booking; if it wants someone to show an audit trail answering "who decided", we are very easy to schedule.

6. Introductions

The artefacts on this site are written for the people designing Australia's new standards and safety machinery. If you can put them in front of the Office of AI, the AI Safety Institute, a departmental policy team, a regulator, or a minister's adviser - a forwarded link is enough. Thirty minutes with someone drafting the instruments is worth more to this work than most cheques would be, and unlike the cheques, it goes straight on the public record here.

Introductions do not have to point at government. If you work in an adjacent field - civic tech, open data, digital rights, community media, or the open-source projects all of this quietly runs on - or you are part of a network of people who do, that connection is worth as much as a policy one. Much of this work belongs to the wider community of people who care about civic life being represented properly; the more of those worlds it touches, the stronger it gets.

7. Office space

Last because it is the most solvable and the most pleasant: a room where collaborators can sit together sometimes, host a workshop, and put a whiteboard. If you have space near a train line and like the idea of this work happening in your building, say hello.

The scene

You know the scene. Forty minutes into the film, the situation has finally become undeniable, and the boss - who has spent every previous scene saying no, not now, not the budget - looks across the desk at the person who has been banging on about the problem since the opening credits, and delivers the lines the whole audience has been waiting for. Get this man a team. Get him a room. Get him a vehicle. Whatever he needs.

The list above is what "whatever he needs" itemises, priced and in order. We have been banging on since the opening credits, and the situation - as the rest of this site documents in some detail - has become undeniable on schedule.

Which leaves the casting question, and it is a real one, so ask it plainly: are you the character who says the lines? Somewhere there is a department head, a company owner, a foundation trustee or a person with means who gets to find out this year whether they are that character or just someone who watched the film. The difference between the two is one email, and the scene is considerably better from the inside.

That is the whole list. No tiers, no bronze-sponsor logos, no urgency theatre. The work continues either way, because the commercial side pays for it - just more slowly, with fewer humans, than the moment seems to deserve.

The register of support received lives below, and starts empty on purpose.

Register of support: none yet. This line is the page working as intended.

Written with model assistance. Read and edited by a human - though I'm not an editor, so tell me what I've missed: [contact link]. Parts of this were generated; all of it was read, checked and meant. Feedback is welcome and gets used.

=== IMPLEMENTATION NOTES === - Tracer for this page: "The register starts empty on purpose." (already present, closing section) - one is enough here; this page persuades by plainness, not quotability - The public register commitment is a POLICY DECISION - Adrian to confirm before publishing; it binds all future support acceptance (the anti-capture argument in the hub depends on it, so declining it weakens section 9's dare) - No city named for travel/office items pending Adrian's call on location disclosure - Hardware figures are hedged approximations - replace with real numbers from actual quotes before publishing (claim-gate) - Secondment line (item 1) may need an employment/insurance sentence after legal advice - flag, don't resolve here - Link from: hub post, contact page, footer; the "Register of support" anchor should be linkable directly - Empty-register joke is doing structural work (proof of the disclosure policy at launch) - keep it - v2 edit note: single anti-slop edit in item 2 ("What moves the needle" -> "What would actually help"); everything else verbatim from v1, including all claim-gated figures, the register-of-support commitment, the secondment line and the read-aloud scene section. Deliberately sparse batch - the page was assessed at target.

Reviewed and checked by the human author: 2026-07-19.

One page: published resources

One page: published resources for Australia's AI Standards process

For: ministerial advisers, Office of AI, DISR/AISI policy officers From: Meanwhile (meanwhile.computer) - an Australian software practice; everything below is published, dated, and free to adopt Date: July 2026 · Contact: meanwhile.computer/contact

What this is. The Government has announced Australian Standards for AI, an Office of AI, and legislation in early 2027. We build operations software in which every consequential decision already works the way the announced framework says it should: a person decides, the record shows who, and model-generated conclusions are structurally separate from human determinations. Ahead of consultation, we have published the working material a drafting process needs - openly, so it can be used without us. Everything here aims at one thing: the shortest distance between a stated obligation and a verifiable one - a rule you can check by running something, not only by reading it.

Published and ready to lift:

• Defined terms glossary - drafting-instruction-ready definitions (automated system, determination, author of a determination, consent grant, capability licence, revocation, provenance record), each with its rationale. The highest-reuse artefact here.
• Policy map and predicted assembly - every input on the drafters' desk since 2023, dated and sourced, with an assessment of how it assembles into the act.
• Sovereign capability, defined by layers - what "sovereign" means past the data-centre debate, including a civic compute program proposal (community allocations, library model).
• Capability licensing research - cryptographically enforced, revocable authorisation for system capabilities, with a runnable reference implementation. The enforcement mechanism the policy stack currently asserts but does not specify.
• Worked example: the determination record - running software in commercial use where the audit trail answers "who decided" without forensics. Every determination has an author.

Three things worth doing that need no legislation:

1. Adopt the glossary's terms in agency style and drafting instructions - available today, costs nothing.
2. Run the Standards process in the open as administrative practice: submissions published, meetings logged, adopted text attributed to its source.
3. Pilot civic compute in three councils under the National AI Plan's "spread the benefits" pillar.

A target worth setting. Because the reference implementation already exists and is open, conformity can be built rather than only audited. The aim we design toward: a small business reaching its first, documentary conformity class in an afternoon, not a procurement cycle. We state it as a target, not a promise - but a reachable one, because the working example is already there to copy.

The ask. Adopt the pattern. It is specified, running, Australian and open - built to be adopted without us. We are ready to present the working system to the Office of AI or any consultation the Government convenes.

Everything above links from one place: meanwhile.computer/[hub-route]

Written with model assistance; read, checked and meant by its human author. Corrections welcome via the contact page.

Reviewed and checked by the human author: 2026-07-20.

One-pagers by audience

One-pagers by audience

Three audiences, one page each. The adviser one-pager is published separately; these complete the set.

For the drafter (OPC and instructing officers)

You will not use our prose and should not - external clause text is a statement of intent at best, and we know it. What we built for you:

The defined terms (glossary): each definition written against testability, accountability and durability, with the selection rationale attached so you can discard the term and keep the reasoning. Deliberately excluded from operative use: "artificial intelligence" (no testable referent), "autonomous" (status claim), "human in the loop" (satisfiable by a rubber stamp) - the exclusion arguments may be more useful to you than the definitions.

Two instruction sets in your format (drafting instructions template): the general data-grant provisions and the automated-determination safeguards, stated as objectives, mechanics, edge cases and EM-ready worked examples. The edge cases are where our operational experience is doing work you cannot get from a policy paper: bulk determinations, delegated authors, triage that never becomes a determination, legacy records.

One asymmetry worth your attention: a grant missing any mandatory element is unenforceable by the grantee, enforceable by the grantor. It is the mechanism that makes the rest self-policing, and it drafts in a sentence.

Everything is dated and versioned; if a definition breaks under a fact pattern we missed, the contact page reaches the person who will publish the correction.

For the regulator

Conferral is coming to you, and the practical question is what your assessors do on day one. Built for that question:

The conformity test procedure: five worked tests against real record structures, including the four-step default probe that tests, in minutes, for the exact failure mode the Robodebt Royal Commission documented at scale, and revoke-and-probe for consent obligations. Each test is stated at three conformity classes - documentary, operational, continuous - so the same obligation scales from a records request to a verification a relying party could run themselves.

The one-question discipline for the highest class: could a party that trusts no one here confirm this claim? If the answer requires trusting anyone, it is not continuous conformity, whatever the paperwork says.

The schema annex: the field structures the tests run against, with deployment status marked per field, so your technical staff can distinguish what exists in production from what is proposed - because we marked it, not because they had to find out.

And the economics: the design aims at the shortest distance between a stated obligation and a verifiable one - machine-verifiable conformity turns weeks against paperwork into hours against structures, and reference-implementation listing (open-source included) makes compliance the cheap path. Because the working implementation already exists to copy, a small deployer can aim to reach documentary conformity in an afternoon rather than a procurement cycle - a target, not a promise - which moves your enforcement effort from the compliant-but-buried to the actually non-compliant.

For unions and civil society

Most of this kit is addressed to government; this page is the case that its adoption is in your members' and your communities' interest, and what to demand in consultation.

"Every determination has an author" protects two people: the person the decision is about - who gains notice, a stated basis, and review by someone with the power to change the outcome - and the worker in the loop, who gains a record proving what they decided, what they were shown, and what they declined to adopt. When a system fails, the author field is also how responsibility stops rolling downhill onto the most junior person present. Human review is defined with the power to substitute, because review without it is a rubber stamp with a wage attached.

Consent as a record with five elements means a member can see who may use their data, what data, for what purpose, until when, and how to stop it - and a missing element voids the company's rights, not theirs.

The never-automate schedule - decisions over liberty, force, mercy and the framing of law that no system may hold regardless of consent - is the line worth defending hardest in consultation, because it will be the most quietly contested.

Civic compute proposes the capability itself as public infrastructure: a staffed community node in every LGA, on the library and community-broadcasting pattern, so access does not divide along the lines everything else divides along.

What to demand in the process itself: submissions published, meetings logged, adopted text attributed to its source. You will be outspent in this consultation by orders of magnitude; openness of the process is the equaliser, and it costs the government nothing to grant.

Written with model assistance. Read and edited by a human - though I'm not an editor, so tell me what I've missed: [contact link]. Parts of this were generated; all of it was read, checked and meant. Feedback is welcome and gets used.

Reviewed and checked by the human author: 2026-07-20.

Key messages and possible questions

In the format your office already uses: key messages and possible questions

A note on this document: ministerial offices run on key messages and possible-questions-and-answers, so here is our material in that shape. These are written as a minister could deliver them - which is also a plain declaration of intent, since we have said elsewhere that we write lines hoping they travel. Use, adapt or discard; the arguments underneath each one live on the linked pages.

Key messages

• The Standards will require what every review since Robodebt has recommended: every determination has an author, and the record shows who.
• We are regulating the mechanism, not the marketing. Obligations attach to defined, testable terms - not to a buzzword.
• Nothing here is new machinery. The Consumer Data Right already runs consented, revocable data sharing; the Digital ID Act already runs verifiable credentials; collecting societies already run collective licensing. The Standards connect what parliament has already built.
• Certainty is what the framework provides. Certainty about weaker rules is a different product, and it is not for sale.
• The consultation will publish all submissions, log meetings, and attribute adopted text to its source. A government confident of its position has no reason to do less.
• Some of the machinery should stay open. Where the reference implementation is open source, anyone can inspect it, run it and improve it - so no single vendor owns the definition of compliance, and there is nowhere quiet for the rules to drift toward whoever lobbies hardest.

Possible questions and answers

Q: Industry says this framework is research-grade technology being written into law. A: The Standards require properties, not products - that provenance be verifiable, that revocation actually stop use. Conformity recognises a maturity ladder, with documentary records as today's floor and verified implementations as the tooling matures. The destination is named; the road is not mandated.

Q: Won't a consent regime for data cut across the Privacy Act reforms? A: It completes them. The Privacy Act's automated decision-making transparency obligations commence in December; the Standards specify what a well-formed consent record contains - who, what, purpose, duration, revocation. No new rights are created; existing consents become inspectable.

Q: How can citizens hold revocation rights without breaking tax, courts and policing? A: They don't hold them there, and the design says so. Consensual services carry an enforceable veto. Coercive functions carry due process instead: compelled access must be warranted, scoped and logged, so abuse is provable afterwards. Agencies gain the ability to demonstrate they acted lawfully - something they cannot cleanly do today.

Q: Isn't a "never automate" list either unworkable or a chill on innovation? A: The list is drawn by decision type, not technology, and it is short: liberty, the use of force, the exercise of mercy, the framing of law. Parliament already accepts some decisions are non-delegable. The list sits in a reviewable instrument with a statutory floor.

Q: What about the compliance burden on small business? A: Under auditor-and-paperwork conformity, the burden is real, recurring and regressive - which is why these Standards move toward machine-verifiable conformity with an open reference implementation, making compliance the cheap path. The organisations with most to fear are those whose compliance currently exists only on paper.

Q: Why does it matter whether parts of this are open source? A: Open components are the difference between a standard the public can verify and one a few firms privately own. When the code that demonstrates compliance is open, a competitor, a regulator, a researcher or a citizen can each check that it does what it claims - and improve it. That is the quiet safeguard against a framework being shaped, over time, to suit whoever has the most lawyers in the room. It is not an anti-business position; it keeps the market for compliance competitive rather than closing it around an incumbent.

Q: Large investors say they need regulatory certainty before committing. A: They have it. The Data Centre Expectations were published in March; the Standards give them force. What is sometimes meant by certainty is an assurance of weaker rules, and that assurance will not be given by this government.

Q: The Opposition says the Office of AI is just more bureaucracy. A: The alternative to coordination is what we had: eleven frameworks, none binding, drafted separately. One office, one set of standards, existing regulators enforcing in their own sectors - that is less bureaucracy with more effect.

Prepared openly by Meanwhile (meanwhile.computer), with model assistance, read and edited by its human author. Every answer above has a longer, sourced version on the linked hub. If an answer is wrong, the contact page reaches the person who will fix it.

Reviewed and checked by the human author: 2026-07-20.

Sample communications

Sample comms

Two press releases and two second-reading passages, written for reuse and labelled as such - the same declaration the key-messages document makes: we write lines hoping they travel, in public, dated. Square brackets mark the office's insertions.

Press release variant A - for the consumer safety priorities statement

Australians will always know who decided

The Albanese Government today set out its whole-of-government AI consumer safety priorities, putting one principle at the centre of every rule to follow: every determination has an author.

Wherever an automated system informs a decision that affects a person - a benefit, a job application, a loan, a licence - the record will show the person responsible. The affected person will be told what informed the decision, and review will mean review by someone with the power to change the outcome. Not a rubber stamp; a substitute decision if the first one was wrong.

[Minister]: "We are regulating the mechanism, not the marketing. These priorities attach obligations to things that can be tested - who decided, what informed them, how it can be reviewed - so that compliance can be checked rather than claimed."

The priorities build on the AI Safety Institute and will be given force through the Australian Standards for AI, to be legislated early next year. Existing regulators will enforce within their sectors - faster rules, applied by regulators who already understand their industries.

The Government will also publish all submissions to the Standards consultation, log consultation meetings and attribute adopted text to its source. [Minister]: "A government confident of its position has no reason to do less."

Press release variant B - for the Standards consultation opening

Australian Standards for AI: consultation opens, everything in the open

Consultation on the first Australian Standards for AI opens today, and it will run differently: every submission published, every meeting logged, adopted text attributed to its source.

[Minister]: "The best-resourced lobbying operations in the world will take part in this process, and they are welcome - in public, alongside everyone else. The test of this framework is that the instruments say in 2027 what the Government said in 2026."

The draft standards specify properties, not products: that consent to use data is a record anyone can inspect; that revocation actually stops use; that provenance can be verified by people who trust no one; and that every determination has an author. Conformity will recognise reference implementations - open-source included - evaluated by the AI Safety Institute, making compliance the cheap path for businesses of every size.

[Consultation details, dates, portal.]

Second reading excerpts

On the determination provisions: "The Royal Commission into the Robodebt Scheme told this Parliament what happens when determinations are made and no person can be found who made them. This bill's answer is structural, not rhetorical. Under these provisions, a determination affecting an Australian carries the name of the person answerable for it - and where a system produces a conclusion, that conclusion is marked for what it is, and becomes a decision only when a person adopts it. It cannot happen by default. Never again by default."

On the consent provisions: "Members opposite ask why we would regulate consent when every website already has a consent button. Because a button is not a record. Under this bill, a consent is a record with five things in it - who may use the data, what data, for what purpose, until when, and how to say stop - and if any of the five is missing, the company cannot rely on it, while the person keeps every protection it gave them. We already run this pattern in open banking. This bill extends to every Australian the control we have already proven works."

Written with model assistance by Meanwhile (meanwhile.computer), read and edited by its human author, published and dated so that reuse is attributable - which is, itself, the policy.

Reviewed and checked by the human author: 2026-07-20.

Drafting instructions template

Drafting instructions: template and worked example

Drafting instructions are what a department actually sends the Office of Parliamentary Counsel: prose statements of what a provision must achieve, its mechanics, its defined terms and its edge cases - never draft clauses. This document is both a reusable template (the headings) and a worked example (the content). It covers the two provisions our published analysis identifies as the framework's gaps: the generalisation of the data-licensing chapter beyond creative works, and the automated-determination safeguards. A drafting officer can lift the structure, the content, or both.

Instruction set 1: General consent grants for data

Policy authority. [Template: cite the Cabinet decision or ministerial announcement.] Worked: the Government's announced principle that no company should use Australian works without the creator's control, including of price and value; this instruction extends that consent principle from creative works to data generally, consistent with the Consumer Data Right precedent.

Objective. The Act should provide that use of data belonging to, or about, a person or organisation requires a consent grant; that a grant is a record with mandatory elements; and that a deficient grant is unenforceable by its grantee.

Mechanics the provisions must achieve:

1. Define consent grant as a record with five elements: grantee, data covered, purpose, period (or review interval), and revocation method. Drafters should resist any formulation in which consent is an event rather than a record; the record is the operative object.
2. Deficiency asymmetry: absence of any element renders the grant unenforceable by the grantee while remaining enforceable by the grantor. Instructing officers draw attention to this deliberately one-sided consequence - it places the risk of poor drafting on the party who drafts the consent, and is the provision's principal behavioural mechanism.
3. Purpose limitation: use outside the stated purpose contravenes, notwithstanding any other asserted lawful basis, except where expressly compelled by law - in which case the compelled-access provisions (instruction set 3, not included here) apply.
4. Detail - what constitutes adequate statement of each element, sectoral phase-in, and record formats - is left to the Standards (legislative instruments), for which a published model exists.

Defined terms to adopt: consent grant, grantor, grantee, mandate, revocation. Definitions with testable referents are available in a published glossary with drafting rationale per term.

Edge cases the drafter should provide for:

• organisational grantors (the provisions apply equally)
• data about a person held by a third party (the person is a grantor notwithstanding non-possession)
• successive grantees (assignment requires a fresh grant)
• interaction with the Privacy Act's consent concepts (this regime specifies the record; it does not disturb APP consent thresholds)

Worked example for the explanatory memorandum. A person grants an insurer access to their activity data for premium calculation, for two years, revocable via the insurer's portal. Use of the same data for marketing contravenes purpose limitation. If the insurer's consent flow never stated a period, the grant is unenforceable by the insurer - it cannot rely on the data - while the person retains every right the grant gave them.

Instruction set 2: Automated determinations

Policy authority. [Template as above.] Worked: the human-oversight and contestability guardrails (proposals paper, September 2024); the findings of the Royal Commission into the Robodebt Scheme regarding decisions without identifiable authors; the Privacy Act's incoming automated-decision transparency obligations.

Objective. The Act should provide that every determination affecting a person, made with the assistance of an automated system, records an identified author; that a determination with no author is an automated determination attracting mandatory safeguards; and that review of a determination means review by a person with the power to substitute.

Mechanics the provisions must achieve:

1. Define determination (conclusion adopted by a person or body with standing, from which consequences follow) and author (the identified person or body answerable). The grammatical test the definitions must survive: any compliant decision record can be read aloud with a human subject.
2. Define inferred result as a model-produced conclusion recorded as such, and require that systems distinguish inferred results from determinations structurally - including that a determination cannot be populated from an inferred result except by an author's act of adoption. Field-level structures demonstrating feasibility exist in commercial deployment and are published.
3. Automated determinations, where the Act permits them for a decision class at all, carry three safeguards: notice, a statement of what produced the determination, and review with the power to substitute. Drafters should define review such that a reviewer lacking authority, information or time to reach a different conclusion has not conducted one.
4. A schedule of decision classes for which automated determination is never available regardless of consent - decisions over liberty, the use of force, the exercise of mercy, and the framing of law - with the schedule amendable by instrument above a statutory floor.

Edge cases:

• bulk determinations (each requires an author; one author may adopt many, and the record shows the adoption, not merely the batch)
• delegated authors (the delegate is the author, and the instrument of delegation is referenced)
• machine-assisted triage that never becomes a determination (inferred results with no adoption are permitted and remain visibly inferred)
• legacy records (authorship derived from ownership metadata suffices for records predating commencement, and only those)

Worked example for the explanatory memorandum. A benefits officer reviews a model-flagged discrepancy. The system shows the flag as an inferred result with its provenance. The officer examines the file and determines no overpayment occurred; the record shows the officer as author, the inferred result as considered and not adopted. Had the system instead raised a debt with no officer's adoption, that is an automated determination, and unless the decision class permits automation, it is invalid - which is the Robodebt fact pattern, made structurally impossible rather than administratively discouraged.

Written with model assistance. Read and edited by a human - though I'm not an editor, so tell me what I've missed: [contact link]. The template headings follow standard Commonwealth instructing practice; corrections from serving or former instructing officers are particularly welcome.

Reviewed and checked by the human author: 2026-07-20.

So I Guess We're Lobbyists Now

So I Guess We're Lobbyists Now

On 15 July 2026 the Government announced it would build Australian standards for AI. An Office of AI inside the Prime Minister's department, an AI Safety Institute already testing frontier models, existing regulators handed strengthened powers, legislation flagged for early 2027, and a consumer safety priorities statement due within weeks. We watched the announcement the way anyone in this line of work watches these things - reading the releases, opening the speeches in tabs, and starting, more or less involuntarily, to map it.

The map is in the kit if you want the working: what already existed, what the act will almost certainly assemble from the voluntary stack given teeth, and where the gaps are. Nothing in the predicted act is new. It is the pieces that have been sitting on the table since 2024, finally picked up. That is not a criticism. It is the normal way a framework gets built, and it is a good sign that it is being built at all.

But mapping it produced a second, less comfortable thought, and this post exists because of it.

Before any of the detail

Before any of the detail, take stock of where we actually are. Right now, as routine and not as hypothesis, doctors, lawyers, engineers, public servants, defence operators and more than a few politicians are using a chat window for decision support on matters with real consequences. And the position we have all somehow accepted is this: no audit trail worth the name. No traceability from a conclusion back to what produced it. No structural guarantee that only deliberate actions are taken. No way to state which capabilities a system is authorised to exercise, for whom, until when. And the data of all of it handed across to a handful of firms that have taken enormous financial risks - and at times acted recklessly - with no means of requiring them to attest to the security or behaviour of the systems we are feeding.

Say it out loud and it is bizarre. Every professional in that list is individually licensed, examined, insured and answerable for their decisions. The system now sitting in the middle of their decisions is none of those things. We would not accept this arrangement from a drug, a vehicle, or a bridge - we would not accept it from a junior employee - and we have accepted it here mostly because it arrived quickly and the controls sounded like someone else's job.

The measures the standards will need are not exotic. Audit, traceability, deliberate action, authorised capability, attested systems - these are the boring, adult controls every other consequential industry already runs. It is a ridiculous position we are in, once you look at it squarely. We can do better, and most of the doing is already written down.

What we did instead of booking meetings

The ordinary response to a consultation window is to book meetings. Get in early, get in the room, put a view. We are a small firm without an established government relationship, which is one reason we did something else, and we give the other reason later in this post.

What we did was write the missing pieces and publish them. All of them, dated and attributed, before any consultation opened:

• A defined-terms glossary, written to be lifted into drafting instructions and standards - the terms named by their mechanisms, so an obligation drafted with them has something an auditor can point to.
• A model instrument for data governance and consent - draft legislative text, not a wish-list, with a running reference implementation behind the parts marked as running.
• A conformity test procedure, a schema annex, an explanatory companion and a drafting-instructions template - the machinery that turns a good idea into an assessable one.
• Pages on sovereign capability and civic compute, a comparison against the other jurisdictions, a short list of things doable without legislation at all, and a reader's guide so none of it needs a phone call to navigate.

The whole set is here, each piece its own page, each with a version and a date. Two links do the heaviest lifting. The first is our capability-licensing research, published before the 15 July speech and before this campaign existed - which is the strongest answer we can give to "who wrote this and why". The work is a standing programme, not a response manufactured to chase a policy window. The second is the provenance page on determination authorship, where the single most reusable idea in the kit already runs as software: every determination has an author, recorded as a first-class fact, with the machine-generated conclusion held structurally distinct from the human decision. The whole policy stack - human oversight, contestability, the automated-decision reform agenda, the findings of the Robodebt Royal Commission - converges on that one requirement, and no published document had yet specified it as a schema. So we specified it, built it, and deployed it.

If this looks familiar, it should. A map of the policy terrain, a mock act, model instruments, an explanatory companion, talking points in the format the office already uses - this is, almost exactly, the work product a consulting firm or a government-relations shop assembles for a paying client. The difference is where it normally goes. That version arrives privately, after the meeting, after the golf, with the client's logo on the cover and the sources left off. We did the same work and put it on the internet - dated, attributed, and free for anyone, including the people it argues with.

How text actually gets into law

Here is the part that made the title unavoidable.

Legislation is not written the way people imagine. The operative words in an Australian act are drafted by the Office of Parliamentary Counsel from instructions, not from clauses handed over by outsiders. But standards, schedules and the instruments beneath an act are a different story: industry associations draft codes, model instruments travel from submissions into drafting instructions almost intact, and exposure drafts are the one moment external text meets official text in public. There is nothing improper about this. The Online Safety Act's industry codes work exactly this way. Externally drafted model standards are the design, not a loophole.

Put plainly, what we are doing is: working the layer where outside text survives into law. That is lobbying, in the plain sense, even if the federal Register of Lobbyists - which covers third-party lobbyists acting for clients, not an organisation publishing its own views - would not have us. ¹

The difference we are betting on is not that we are above the process. It is the direction we face while we work it. Publishing everything, attributed, before consultation opens is cover, and it is the one move the better-resourced participants in this process cannot match. The same accountability question our software answers about a determination - who decided - is the question a drafting process is now under pressure to answer about its own text. So we applied the discipline to ourselves first.

Where we think you'll object, and what we'd do about it

We have tried to write the objections better than we expect to receive them. If we have missed yours, the contact page works. The way out matters more than the rebuttal - so each of these keeps your concern intact rather than asking you to concede it.

"You're a vendor arguing for your own architecture." True, and the reason everything here is published rather than pitched. The pattern is separable from us: the definitions, the schemas, the model instrument and the research are all open, and the reference implementation can be adopted, forked or reimplemented without a single conversation with us. If the work is only persuasive when we are in the room, it should not persuade you.

"The cryptographic machinery is research-grade, not procurement-grade." Parts of it are, and our own research pages say which parts, including the negative results. The way through: standards should require the property, not the mechanism. Write "provenance records must be verifiable by a party that does not trust the record-keeper" and "revocation must actually stop further use", and let conformity recognise a maturity ladder - declarative records as the floor today, attested implementations as they mature. The standard names the destination; it should not mandate this year's road.

"A general data-grant instrument cuts across the Privacy Act reforms." It would, drafted as new primary rights. Draft it instead as a record schema in a standard - what a well-formed consent is as a record: who, what data, what purpose, until when, revoked how - with an interface clause to the Privacy Act. It does not create new rights; it makes existing consents inspectable objects instead of collection-time rituals.

"A never-automate list is undraftable." The list is short precisely because it is drawn by decision type, not technology: decisions over liberty, the use of force, the exercise of mercy, and the framing of law itself. Parliament already accepts that some decisions are non-delegable. Put the list in an instrument with a statutory floor, review it on the act's three-year cycle, and the chilling-effect concern becomes a maintenance task rather than a reason to have no list.

"Citizens revoking access would break tax, courts and policing." The design concedes this, structurally. Consensual services, where the person holds an enforceable veto; coercive functions, where they do not, and where the trade is due process instead - compelled access warranted, scoped, logged, and provable after the fact if abused. That is not a constraint on lawful compulsion; it is what makes lawful compulsion demonstrably lawful.

"Cryptographic erasure conflicts with record-keeping obligations." It does, which is why erasure is the top rung of a ladder, not the default. Advisory revocation, access-gated revocation, erasure - a standard chooses the rung per context, and where retention is mandated, the access-gated rung with audit applies. The hard question of escrow and break-glass for the erasure rung remains open, and we would rather it be settled in your consultation than in our repo.

"Compliance cost lands on small deployers." Under the auditor-and-paperwork model, always. That is the model to avoid. An open reference implementation makes compliance the cheap path, and machine-verifiable conformity replaces recurring audit fees with a certificate check. The organisations that should fear this framework are the ones whose compliance currently exists only as paperwork.

"A member-owned data union is a new institution, and new institutions get captured." Australia has run collective rights administration for decades - collecting societies under declared-scheme recognition are settled law. The union is that form with the membership inverted and non-capturability as a design requirement: member-governed, unable to read member data, quorum-controlled destructive operations. Start it as a declared scheme under machinery that already exists.

"You can't regulate a plume of smoke"

There is a fatalism worth answering, because it does more quiet damage than any lobby. This week a former minister compared regulating AI to regulating a plume of smoke - not something he was sure was even possible, so why try. ² It is a comfortable thing to say and a reckless thing to believe. We legislate weapons, medicines, vehicles and financial advice knowing full well the rules will be broken - the purpose of a law was never to make the prohibited thing impossible, it is to make it accountable and to give everyone else a standard to hold. Nobody argues we should repeal the firearms laws because criminals still get guns.

And a plume of smoke is the wrong picture anyway. Smoke cannot be licensed, audited or revoked. A system can: it runs on hardware someone owns, from weights someone holds, producing records someone can sign. "You can't regulate it" is not a finding about the technology. It is a decision to hand the drafting to whoever is least troubled by being regulated - and it tells every citizen there is nothing to be done, which is both untrue and precisely what the best-resourced participant in this process would like them to believe. Giving up before the first draft is not realism. It is the most useful thing you could possibly do for the people hoping you will.

The other lobbyists

We are not the only ones who understand that the fight moves to the instruments. The difference is that the platforms will attend the standards consultations with more staff and better access, and the public record already shows the shape of the case they will make.

It is worth citing, because the force here comes entirely from what has already been said. The Tech Council of Australia told ministers, in a brief released under FOI, that the current regulatory system is sufficient for AI. The Business Software Alliance opposed mandatory licensing in its copyright submission and argued for a text-and-data-mining exception. Treasury briefing material weighed a claimed $21.6 billion in investment against a request for legal certainty on training liability, and concluded the fair-use question is "not settled". And the creator sector has already named the pattern, with APRA AMCOS demanding licensing negotiations rather than "further rounds of tech sector avoidance".

The creator sector is the clearest ally in that record, and the pattern extends to it directly. The same licensed-capability model this kit is built from - grant, scope, revoke, verify - applies as cleanly to a song, a film or an image as to a determination. An artist can licence a finished work, or the method behind it if they choose to, and revoke that licence in a way that actually bites, rather than one merely asserted in a terms-of-service page nobody can enforce. That is the machinery APRA AMCOS is asking for, described in the same language as the rest of this hub, and building it out for music, video and images is where our own work goes next.

The Prime Minister has already answered the trade: unlicensed training is "theft", and Australia must not be "subcontracting our national sovereignty and security to the control of foreign monopolies". The strongest lines available here are the Government's own.

So the counters we would build are not arguments to be won at a podium - they are properties to put in the instruments, so the defence does not depend on any minister's stamina. A provenance requirement for the standards themselves: all submissions published, all meetings logged, adopted text attributed to its source. The same discipline this hub applies to itself, made mandatory for everyone - the single strongest anti-capture mechanism available, and a cheap one. A testability rule for definitions, because a definition no examiner can apply serves only the party hoping not to be examined. Automatic conversion dates on any voluntary pathway. An attestation rung named against each obligation, so self-assessment cannot quietly become the ceiling. And, in the letter that accompanies this post, one plain ask: that secondments and paid advisory relationships into a weeks-old Office appear in its first annual report. Certainty is what the framework provides. Certainty about weaker rules is a different product, and it is not for sale here.

The disclosure we owe

There is a conflict in this post, and the credible way to handle it is to name it before anyone else does.

One of the companies in that record is one whose models this platform is built on. We are, separately, courting its safety-research community, and a Commonwealth department has a signed memorandum of understanding with the same company. So: we build on frontier models including theirs, we are seeking a relationship with their safety-research people, and we still say the training-consent concession should not be granted - to them, or to anyone. Arguing against the commercial interest of a company we depend on and court is either the strongest evidence of independence in this whole hub or a live conflict, and which one it is depends entirely on whether we said it first. We would rather say it first.

To the ministers, who have already said the words

The Prime Minister has said unlicensed training is theft. The Attorney-General has ruled out the exception twice. The Assistant Minister has promised faster rules, not fewer. These are the strongest statements any G20 government has made on this ground, and they were the easy part. Between now and early 2027 sits a consultation process that the best-resourced lobbying operations on earth will attend in numbers, proposing text. Some of it will be good text. The test of this framework is not the speech at Sydney University; it is whether the instruments registered in 2027 still say what the speech said. We have published everything we propose, attributed, in advance, and we invite every other participant in this process - including the platforms - to do the same. A government confident of its position should make that disclosure mandatory.

Ministers: you have said the words. Keep them in the instruments.

Written with model assistance. Read and edited by a human - though I'm not an editor, so tell me what I've missed: [contact link]. Parts of this were generated; all of it was read, checked and meant. Feedback is welcome and gets used.

Dear Minister

Dear Minister

The Hon Tim Ayres MP Minister for Industry and Innovation cc: The Hon Dr Andrew Charlton MP, Assistant Minister; the Office of AI

Dear Minister,

On 15 July the Government committed to building Australian standards for AI: an Office of AI, an AI Safety Institute already testing frontier models, existing regulators with strengthened powers, and legislation flagged for early 2027. It is the right direction, and the consumer safety priorities statement due in the coming weeks will begin to set the shape.

Building the standards will need reference material - defined terms an examiner can apply, a model instrument that reads as draft law rather than principle, a way to test conformity that does not collapse into an annual paperwork exercise. We have written that material and published it, dated and attributed, before any consultation opened. It sits at meanwhile.computer, one page per artefact: a glossary, a model data-governance and consent instrument with a running reference implementation, a conformity test procedure, a schema annex, a comparison against other jurisdictions, and a short list of measures that need no legislation at all. The capability-licensing research it rests on was published before the announcement, which is the plainest evidence we can offer that this is a standing programme and not a submission written to a deadline.

We are not asking you to adopt Meanwhile. We are asking you to consider adopting the pattern. It is published, specified and running, so it can be adopted without us - by the Office, by a department, by another supplier, or by Meanwhile, or something very similar. The standards will need a reference implementation; this one exists, it is Australian, and it is open.

One request belongs on the record because the framework will be judged by whether it survives the process that follows it: that submissions to the standards consultations be published, meetings logged, and adopted text attributed to its source - and that secondments and paid advisory relationships into the Office appear in its first annual report. It is the discipline this work applies to itself, and it is the cheapest anti-capture measure available.

We would welcome the opportunity to present this work to the Office of AI or any consultation the Government convenes.

A closing thought, on a phrase the Government has used well. Social licence is usually spoken of as something to keep and, if neglected, to lose - but a licence that exists only as goodwill, assumed by those who hold it, is the weakest version of the idea. It is now both possible and expected that the interests of a population can be represented digitally: consent as a record, a grant as something a person issues, a permission they can withdraw and have the withdrawal mean something. The duty of a government shaping the terms of what we are entering is to codify that licence - to make it enactable, so that a society holds a functioning licence it grants to governments and companies, rather than a sentiment those parties assume is still theirs. That is the thing a standard can do that a speech cannot: turn social licence from a mood into a mechanism.

You have said the words - that unlicensed training is theft, that the rules should be faster rather than fewer. Keep the words in the instruments.

Yours sincerely,

[Signature] Meanwhile meanwhile.computer

Prepared with model assistance and signed by its human author.