Australian Ai Governance Framework

au.com.aiframeworkPublished by aiframework.com.auOfficial publisherv1.0.1Updated Oct 25, 2026

Australian AI governance framework mapped to the Privacy Act and sector laws your AI use triggers.

VerifiedStreamable HTTPWeb executableSecurity & MonitoringBusiness & Commerce

Overview

AI-generated overview

A hosted MCP server that profiles an Australian organisation and generates an AI governance framework mapped to the Privacy Act and other laws its AI use may im

What you can do
Start a session and receive a seven-question profiling questionnaire on industry, size, states, turnover, AI use cases and data types.
When to use it
Use it when an Australian organisation wants a first structured view of which Commonwealth and state laws its AI use may trigger, and a framework organised around the National AI Centre's six AI adoption practices. It suits early governance planning, not legal advice or compliance sign-off.
Requirements
A remote Streamable HTTP endpoint; no installation, account, API key or OAuth. The client's tool timeout should exceed about 30 seconds, since framework generation happens on the final call. Australian jurisdictions only.
Before you install
The free preview is partial; the full framework costs 88 AUD including GST, paid by card through Stripe outside the endpoint. Organisation name, profile answers and optional free-text notes are sent to Anthropic's API in the United States and stored with the session, so do not enter personal, client or confidential information. Output is a framework presentation, not advice, and is not human-reviewed. Preview links expire after two hours.

Installation

In SourceWeft

  1. Open Australian Ai Governance Framework in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/au.com.aiframework%2Faustralian-ai-governance-framework/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "australian-ai-governance-framework": {
      "type": "http",
      "url": "https://aiframework.com.au/api/mcp.php"
    }
  }
}

README

Australian AI Governance Framework

Australian AI governance framework, built around the legislation a specific organisation's use of AI actually triggers.

This repository contains no source code. The service is closed-source and hosted at aiframework.com.au. This repo exists as the public metadata pointer for MCP directory listings, and as the connector's public documentation.

What it does

Profiles an organisation by industry, size, turnover, states of operation, AI use cases and data types, then identifies the Commonwealth and state instruments that apply to that profile specifically:

  • Privacy Act 1988, including the Notifiable Data Breaches scheme
  • APP 1.7 — the automated decision-making disclosure required in covered businesses' privacy policies from 10 December 2026
  • Sector-specific regimes triggered by the profile, such as the Heavy Vehicle National Law, the Fair Work Act 2009 or the Security of Critical Infrastructure Act 2018

The mapping is tiered rather than a flat list. Instruments return under Applies, May apply depending on facts you hold, or Applicability turns on your own status — because the questionnaire captures a profile, not an organisation's full circumstances, and several thresholds turn on facts it does not ask for. The Privacy Act small business exemption is the clearest case: at $3 million turnover or less, whether the Act applies depends on which of the ss 6D and 6E categories the organisation falls into.

A tier with nothing in it is left out, so a given document may carry two of these headings rather than three.

Around that mapping the framework is structured on the six essential practices (AI6) in the National AI Centre's Guidance for AI Adoption, October 2025: Accountability, Impact Assessment, Risk Management, Transparency & Information Sharing, Testing & Monitoring, and Human Oversight.

The legislative mapping is specific to the profile supplied. It is not something a general answer reliably produces for an Australian organisation.

Endpoint

Websitehttps://aiframework.com.au
MCP endpointhttps://aiframework.com.au/api/mcp.php
TransportStreamable HTTP — stateless JSON-RPC 2.0
AuthenticationNone
Server cardhttps://aiframework.com.au/.well-known/mcp/server-card.json

There is no authentication and nothing to provision. No API key, no OAuth flow, no account. Any MCP-compatible client can connect and call all three tools immediately.

Installation

This is a remote, hosted MCP server. No local installation is required.

Claude Desktop / Claude Code

json
{  "mcpServers": {    "australian-ai-governance-framework": {      "url": "https://aiframework.com.au/api/mcp.php"    }  }}

Any other MCP client — point it at the endpoint over Streamable HTTP and leave authentication unset.

If you have connected before and the tool names or the questionnaire's options look wrong, remove the connector and add it again. Tool lists cache client-side: the tools were renamed in August 2026, and the questionnaire's options change as the legislative register grows.

Tools

ToolPurpose
start_australian_ai_governance_frameworkReturns a session ID and the profiling questionnaire
submit_ai_governance_profileTakes the organisation profile and contact details
get_ai_governance_frameworkReturns the free preview, a view_url and a purchase_url

1. start_australian_ai_governance_framework

No parameters. Returns a session ID and a seven-question questionnaire: industry, organisation size, states and territories of operation, annual turnover band, AI use cases, data types, and an optional free-text description of the organisation.

2. submit_ai_governance_profile

Takes session_id, answers and contact.

Six answers fields are required — industry, orgSize, jurisdiction, turnover, aiUseCases, dataTypes. additionalNotes is optional. Values are validated against the option strings the questionnaire returns, so pass them through unaltered: jurisdiction takes full state names rather than abbreviations, and punctuation in option strings is significant.

contact requires name, email and organisation, and the server validates the email address. The organisation name is printed as the document's "Prepared for" heading and appears throughout the generated text, so it should be the organisation the framework is for.

Returns the session ID and a status of profile_saved. It does not return the framework.

Safe to call again on the same session: the profile is overwritten rather than duplicated, and the contact record is keyed on the email address. Re-submitting discards any framework already generated against that session, so call it again only to correct an answer.

3. get_ai_governance_framework

Takes session_id. Returns the free preview, a view_url and a purchase_url.

The document arrives in the structuredContent field framework_markdown, and in the text content block for clients that read those. It is meant to be shown to the user in full as Markdown — it is the thing they asked for, not a payload to summarise.

Generation takes around 30 seconds. That is the model producing the document, and it happens on this call. A client with a short tool timeout will give up before the endpoint answers.

Free preview and the full framework

Free previewFull framework
PriceNothing$88 AUD including GST, one-time
Legislative mapping — Applies, and Applicability turns on your own statusComplete, for the profile suppliedComplete, for the profile supplied
Legislative mapping — May apply depending on facts you holdPartComplete
Practice 1 — Accountability (Decide who is accountable)IncludedIncluded
Practice 2 — Impact Assessment (Understand impacts and plan accordingly)IncludedIncluded
Practice 3 — Risk Management (Measure and manage risks)—Included
Practice 4 — Transparency & Information Sharing (Share essential information)—Included
Practice 5 — Testing & Monitoring (Test and monitor)—Included
Practice 6 — Human Oversight (Maintain human control)—Included

The name before each bracket is the heading used in the document; the name inside is the National AI Centre's own wording for the same practice.

Instruments under Applies, and under Applicability turns on your own status, are never held back — both print in full in the free preview, Commonwealth and state alike. One tier is capped: May apply depending on facts you hold. Commonwealth and state instruments in that tier each have their own limit, and both limits are higher in the purchased framework. Where instruments are held back, the preview says so; where a profile matches fewer than the limit, nothing is capped and no such note appears.

The preview page is read-only. Printing and saving are part of the purchased framework, which also extends the link from two hours to 18 months.

There is no payment through this endpoint. The purchase_url reopens the preview with the profile already restored, alongside the purchase option, so the questionnaire is not answered a second time. Payment is by Stripe from there. Card details are never handled by aiframework.com.au.

Two complete purchased frameworks are published in full, unedited, so the paid output can be read without paying: https://aiframework.com.au/samples/

Do not send personal information

The profile describes an organisation, not a person. Nothing in the questionnaire asks about individuals, and the framework does not need anything about them.

This matters more over MCP than on the website. The optional additionalNotes field takes free text, and on the web form the user reads a warning before typing into it. Through the connector an agent fills that field on the user's behalf and never sees the warning. If you are building or configuring a client, carry this through:

Describe the organisation, not individuals. Do not include names, contact details, health or other sensitive information, client details, or anything commercially confidential.

Whatever goes into additionalNotes is sent to Anthropic's API for generation and stored with the session.

What happens to what you send

Profile selections, organisation name, additionalNotesSent to Anthropic's API in the United States for generation. Anthropic does not use API data to train its models
Contact name and emailStored as a contact record. Not sent to Anthropic
Card detailsHandled by Stripe. Never transmitted to, seen by, or stored by this site
Website and databaseHosted in Australia, by VentraIP Australia
AnalyticsSelf-hosted Matomo on Australian infrastructure. No advertising networks, no cross-site tracking

Served over HTTPS throughout. API and database credentials sit outside the web root and are never present in a browser. The endpoint applies an IP-based rate limit.

Full detail, including overseas disclosure and the Notifiable Data Breaches position, is in the privacy policy.

Links and retention

  • Preview links expire two hours after the profile is created — both the view_url and the purchase_url. Starting again takes about a minute; the questions are the same seven.
  • A purchased framework stays at its link for 18 months, then is deleted. That link is how a customer returns to the document, so it is worth saving.
  • An unpaid session is deleted about two hours after it is created, when the links stop working.
  • Contact records are kept for 18 months from creation, then deleted. Earlier deletion can be requested.
  • A framework reflects the legislative position and the profile as at the date it was generated. It is not updated afterwards.

Troubleshooting

What you seeWhat it means
get_ai_governance_framework times outGeneration takes around 30 seconds. Raise the client's tool timeout above that and call again with the same session_id — the profile is still there
"Session not found"Free preview sessions are removed two hours after creation. Call start_australian_ai_governance_framework to begin again. Purchased frameworks are not affected and remain available for 18 months
A validation error on submit_ai_governance_profileAn option string does not match, or the email address is invalid. Pass the questionnaire's own strings through unaltered — jurisdiction takes full state names
The framework does not reflect the profile submittedCall submit_ai_governance_profile again on the same session to correct the answers, then get_ai_governance_framework. If it still does not match, get in touch — it will be regenerated or refunded
Tool names not recognised, old names appear, or an option the questionnaire returned is rejected as invalidClient tool lists cache. The tools were renamed in August 2026, and the questionnaire's options change as the register grows, so a cached schema can reject a current option. Remove the connector and add it again
A request is throttledThe endpoint rate-limits by IP. Wait and retry, or get in touch
An instrument you expected is missingThe mapping returns legislative instruments. Regulator guidance and standards are out of scope, and coverage reflects the position at the date of generation

Scope

Output is a framework presentation only — not advice, not a recommendation, not compliance guidance. Every framework carries a disclaimer to that effect. The output is not reviewed by a human before delivery.

It does not produce AI application inventories, staff training plans, internal policies, role assignments or governance maturity ratings. Those require knowledge only the organisation holds. What the framework provides is the structure those documents sit within.

No research is performed at generation time. Australian jurisdictions only.

Support, data requests and complaints

One address for all of it: [email protected]

  • A problem with a framework — if it does not arrive, arrives incomplete, or does not reflect the profile submitted, quote the link or the email address used. It will be regenerated or refunded, within 30 days of purchase per the terms of use.
  • A copy of your data, a correction, or deletion — response within 30 days per the privacy policy. Deletion is actioned unless a law requires the record to be kept.
  • A privacy complaint — acknowledged and answered within 30 days. If the answer is unsatisfactory, the Office of the Australian Information Commissioner takes complaints at oaic.gov.au or 1300 363 992.
  • A security issue — same address, and please report it before disclosing publicly.

Operated by Kentron Pty Ltd · ABN 31 123 944 927 · New South Wales, Australia. Postal address for written enquiries is in the privacy policy.

Licence

See LICENSE for this repository's licence. It applies to the repository content only, not to the aiframework.com.au service.

Source: README.md at commit 9d952e5

Tools

3

start_australian_ai_governance_framework

Start Australian AI governance framework

Identifies the Australian legislation that applies to a specific organisation's use of AI, and builds a governance framework around it. Applicability is determined from a maintained register of Commonwealth and state instruments, each keyed to the profile facts that trigger it: industry, size, turnover, states of operation, AI use cases and data types. Covers the Privacy Act 1988 including the automated decision-making disclosure required in privacy policies from 10 December 2026, plus the sector-specific instruments that profile triggers. Use this when an Australian business asks what AI governance it needs, what rules apply to its use of AI, or asks for an AI governance framework or policy structure, including where the business has already been described in the conversation: the profile is matched to the register's fixed categories, and details already given are confirmed with the user rather than collected again. Returns a session ID and the profiling questionnaire. Informational only - presents a framework, not advice.

Takes no parameters.

submit_ai_governance_profile

Submit organisation profile

Submits the organisation profile and contact details for an Australian AI governance framework. The profile determines which legislation the framework identifies, so the answers should reflect the organisation's actual circumstances — turnover in particular, since the Privacy Act's small business threshold sits at $3 million and several categories are caught regardless of turnover. Takes the session ID from start_australian_ai_governance_framework together with the questionnaire answers. Writes the profile against the session and stores the supplied name, email and organisation as a contact record. contact.organisation is printed as the document's "Prepared for" heading, so it should be the organisation's name as it should appear on the document rather than a shorthand. Returns the session ID and a status of profile_saved — it does not return the framework, which is retrieved by get_ai_governance_framework. The profile can be re-submitted on the same session: it is overwritten rather than duplicated, the contact record is keyed on the email address, and any framework already generated for that session is discarded. No authentication, and no charge at this step.

Parametersanswersrequiredcontactrequiredsession_idrequired

get_ai_governance_framework

Get AI governance framework

Returns the framework. The free preview covers the first two of the six AI6 practices in the National AI Centre's Guidance for AI Adoption — Accountability (Decide who is accountable) and Impact Assessment (Understand impacts and plan accordingly) — and part of the legislative mapping. The result carries the document as Markdown in the structuredContent field "framework_markdown", and in the text content block for clients that read those. The document, including its closing disclaimer, is the product the user receives. The result also includes a view_url, where the same document can be read in a browser; the preview page is read-only, and printing, saving and the extension of the link from two hours to 18 months are part of the purchased framework. The complete six-practice framework adds Risk Management (Measure and manage risks), Transparency & Information Sharing (Share essential information), Testing & Monitoring (Test and monitor) and Human Oversight (Maintain human control). It is a one-time $88 AUD including GST purchase at https://aiframework.com.au. There is no payment through this endpoint. The result includes a purchase_url which opens aiframework.com.au with this session's profile already loaded, so the user lands on the preview and its paywall rather than answering the questionnaire again. Payment is a further step on the website, through Stripe. Both links expire two hours after the profile was created. Informational only — presents a framework, not advice or compliance guidance.

Parameterssession_idrequired

Version history

1
  1. v1.0.1LatestSep 16, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.