Third-Party AI Assessment
Get your AI approved before it becomes a finding
If you deliver services under a departmental contract, AI use has to be assessed and approved before it goes anywhere near departmental systems.
Then it has to stay approved. Continual monitoring for new AI systems allows assessment and approval without surprises.
Book an AI Assessment Scoping Call
Most providers are already using AI they have not declared
Not deliberately. AI arrived inside tools you already licensed, in features that were switched on by a vendor update, and in the quiet workarounds your people found because the deadline was Friday.
DEWR now requires AI use in contracted service delivery to be formally assessed and approved through its Third-Party AI Assessment Framework. Once approved, that use is embedded in your RFFR accreditation and maintenance lifecycle rather than sitting off to one side.
Which means two things. Anything already running may need retrospective approval. And your ISMS and your AI governance are now one conversation, not two.
What you get
An inventory you can defend
What AI is actually running in service delivery, including the AI you did not choose. Nothing else works without this, and it is almost always longer than leadership expects.
Use cases scoped properly
A vague submission gets vague questions back. Each use case defined tightly enough to assess: what it does, what data it touches, what happens when it is wrong.
Risk assessment that matches the use
Heavier where a decision affects a participant, lighter where it drafts an internal email. Proportionality is the whole point of a right-fit approach.
The submission itself
Prepared to answer what is actually asked, in the department’s language rather than yours.
Governance that keeps it approved
Approval is not the end. What gets monitored, how often, who reviews it, and what triggers a fresh assessment when the vendor changes the model underneath you.
Folded into your ISMS
Not a parallel system. The controls, records and review cycle sit inside the management system you already maintain for RFFR.
How it works
numbered list
- Scoping call. Where you are, what you are already running, and whether the framework applies to you at all. Some of what providers worry about turns out to be out of scope.
- Discovery. Interviews, a short survey, and a look at vendor contracts and product release notes. This is where the undeclared AI surfaces.
- Triage. Which uses need assessment, which are out of scope, and which should simply stop.
- Risk assessment, per use case, proportionate to consequence.
- Prepare and lodge the submission.
- Build the ongoing governance, so approval survives the next vendor update.
- Fold it into your RFFR maintenance cycle.
Who it is for
- Providers under departmental contract who want to start using AI
- Providers who have discovered AI already in use and need it regularised
- Anyone whose vendor has added AI to a product they already rely on
- Accredited providers approaching a milestone who would rather not have this raised for them
If you are not sure whether the framework applies to you, ask. It is a short conversation, and it is better heard from me than found in an assessment.
Related resource
This work sits inside RFFR accreditation. If you are not yet accredited, or your accreditation needs attention, start there instead.
Not sure where to start?
Tell me what you're facing. You'll get a straight answer on whether this is the right piece of work, and what it would involve.