The DTA AI impact assessment tool: what content teams should do now
If your team uses ChatGPT, Claude, or Copilot to draft, edit, or translate government content, the DTA AI impact assessment tool already applies to you. Most content teams have not registered this yet. My advice is to run the assessment now, as a self-audit, before procurement, audit, or your agency's risk function makes it mandatory.
The Digital Transformation Agency published the tool in December 2025, alongside an updated Policy for the responsible use of AI in government. An AI impact assessment is a structured review of how one specific AI use case measures against Australia's AI Ethics Principles. Agencies must apply it to in-scope use cases by 15 December 2026.
In my experience leading content governance across government, the risk is rarely the technology itself. It is that content teams pick up AI quietly, one prompt at a time, and never write down what they are doing or why. When the assessment lands, there is no record to point to.
What the DTA AI impact assessment tool actually asks
The tool is built as twelve sections, and it is tiered. Every use case completes the first four: basic information, the purpose and expected benefit, a threshold assessment of inherent risk, and fairness.
If every inherent risk rates low, you can close the assessment at section four with an approving officer's endorsement. If anything rates medium or high, you continue through the rest: reliability and safety, privacy and security, transparency, contestability, accountability, and human oversight.
Most content drafting and editing use cases will sit in the lower band. That does not let you skip the assessment. It means you complete four sections and keep the record.
Where content work actually lands
Take a common case. You use a general-purpose AI tool to redraft a dense web page into plain language. The purpose is clear, a person reviews the output before it goes live, and no personal information goes into the prompt. On the DTA's own logic, that is a low inherent-risk use case that closes out at section four.
Now change one detail. The page is about eligibility for a payment, and the drafter pastes in a real case study describing someone's circumstances. Privacy and fairness are now live questions, and you are into the full assessment.
The section that catches content teams is not transparency or safety. It is knowing which of your use cases quietly crossed a line. That judgement is a content design decision, not an IT one, and it is why content people need to be in the room when the assessment is filled in.
Why running it now is the stronger move
There is a real difference between completing this assessment as a self-audit and completing it because your risk team has flagged you. The first is a half-day exercise that produces a clean record. The second arrives with questions about why you ran the tool for eight months without one.
The tool is not designed to stop content teams using AI. It is designed to make the decision visible and accountable. Documenting a low-risk use case is not bureaucratic friction. It is the evidence that you thought about fairness, privacy, and human review before you shipped anything.
How to start this week
List every way AI already touches your content: drafting, editing, summarising, translating, alt text, and metadata. Be honest, including the informal uses no one has approved.
Run each one through the first four sections of the impact assessment tool. Most will close out at section four. The one or two that do not are exactly the ones you want documented before anyone asks for them.
The assessment is not the hard part. The hard part is that most content teams cannot yet list their own AI use cases in one place. If you cannot name them, you cannot assess them, and that gap is the first thing an auditor will notice. So the question to take into your next team meeting is a simple one: can we write down every place AI touches our content, today?