The 31 October attestation: what NSW agencies must register, and what AIG Sentinel produces for it

The first signed attestation under NSW circular DCS-2026-02 is due by 31 October 2027. It covers the financial year that began on 1 July 2026, so the year an agency will be attesting to is already a quarter gone. The AIAF Platform it depends on became mandatory on 30 September 2026.

The circular was issued by the Secretary of the Department of Customer Service on 30 July 2026, updated on 1 September 2026, and replaces DCS-2024-04. Compliance is mandatory. This post sets out what it asks for, in the order an agency meets it, and then what AIG Sentinel produces at each step.

Who is in scope, and what they must do

The circular lists the entities that must comply: departments, executive agencies related to departments, separate agencies, statutory authorities and bodies, advisory entities including boards and committees, public financial and public non-financial corporations, State Owned Corporations, and subsidiaries of the NSW Government established under the Corporations Act. Local councils are not on that list. The circular points to the NSW AI Operational Policy for the detail of which entities are covered.

The policy's mandatory agency requirements, as the circular states them, start with appointing an Accountable Official "to oversee the policy's implementation and act as a point of coordination with NSW GovAI within Digital NSW". Agencies must "ensure that all AI use cases are registered in the AI Assessment Framework (AIAF) Platform and maintain accurate and complete records through the AI system lifecycle", apply the AIAF where registration determines an assessment is required, and "refer high-risk and critical-risk AI use cases to the AI Review Committee for advice on risk mitigation". The registration questions decide whether a full assessment is needed. Agencies engage the committee within 5 business days of completing the AIAF, and NSW GovAI may also refer medium-risk cases where higher-risk characteristics are present.

Use cases must be re-assessed "throughout the AI system lifecycle, from inception to retirement", with periodic reviews set by the potential for harm. Then the attestation: agencies "are required to provide a signed annual attestation for the previous financial year to NSW GovAI by 31 October each year, with the first attestation due by 31 October 2027".

What AIG Sentinel produces at each step

An attestation is only as good as the register behind it, and the register is only as good as the discovery that fed it. AIG Sentinel starts there. It finds the AI already in use across the organisation, including the assistants that arrived inside everyday tools without anyone registering them, so the register entry begins with what is actually running rather than what was approved.

For each use case it builds the register entry: purpose, owner, data involved, whether the system makes or informs decisions about people, and the risk tier. It then assesses the use case against the NSW AIAF pack, carrying the framework as data so that a revision re-maps existing workpapers instead of starting them again. Where the result is high or critical, it assembles the referral for the AI Review Committee, tracks the committee's conditions and records when each is closed.

Every step lands on a tamper-evident evidence chain: who registered, who assessed, who approved, what changed and when. At the end of the financial year the attestation pack is generated from that chain, which is the difference between an Accountable Official signing on the basis of evidence and signing on the basis of a survey of divisions.

Two things to say plainly. AIG Sentinel is demo-available today, and the NSW AIAF pack is the one framework pack built today; EU AI Act, ISO/IEC 42001 and NIST AI RMF mappings follow. The product is built to align with the AIAF and evidences that alignment in the product. It is not a certification, and the AIAF does not issue one.

See the product at AIG Sentinel, run the demo, or contact us to walk through your register.

Sources

1. DCS-2026-02 Use of Artificial Intelligence by NSW Government Agencies. Department of Customer Service, NSW Government. Issued 30 July 2026, updated 1 September 2026. arp.nsw.gov.au
2. NSW Artificial Intelligence Assessment Framework. Digital NSW, Department of Customer Service. Accessed 5 October 2026. digital.nsw.gov.au