Introduction

1.1 Artificial intelligence (AI) is increasingly being adopted by both the Australian Public Service (APS) and the broader economy. The Australian Government has adopted the Organisation for Economic Co-operation and Development (OECD) definition of an AI system:

An AI system is a machine-based system that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments. Different AI systems vary in their levels of autonomy and adaptiveness after deployment.¹⁰

1.2 Automated decision making (ADM) and AI are distinct but closely intersecting technologies that are often used together. ADM is the use of technology to make decisions with little to no human intervention, and may or may not employ AI. The Senate Select Committee on Adopting AI (see paragraph 1.12) defined automated decision making as:

the application of automated systems in any part of a decision-making process. ADM includes using automated systems to: make the final decision; make an interim assessment or decision leading up to the final decision; recommend a decision to a human decision-maker; guide a human decision-maker through relevant facts, legislation or policy; and automate aspects of the fact-finding process which may influence an interim decision or the final decision.¹¹

1.3 The government has stated that AI has the potential to enhance Australia’s wellbeing, quality of life and economic growth.¹² In its Data and Digital Government Strategy published in December 2023, the government committed to adopting AI to ‘improve user experience, support evidence-based decisions and gain efficiencies in agency operations’ and to equip entities to safely engage with emerging technologies, including AI.¹³ The 2025 Implementation Plan for the Data and Digital Strategy describes AI as a 2026 government priority.¹⁴ The AI Plan for the Australian Public Sector sets out the path to accelerating the adoption of AI across the public sector through leveraging the technology to allow officials to unlock productivity gains.¹⁵

1.4 AI encompasses four specialised domains (see Figure 1.1):

• Generative AI is focused on creating new content such as text, images, video, code or data using patterns from data already learnt. Examples of generative AI referred to in the AI Plan for the Australian Public Sector include ChatGPT, Claude and Gemini.
• Machine learning (ML) involves algorithms learning patterns from data and improving over time without the need for explicit programming, for the purposes of making predictions or decisions. An example of machine learning is an algorithm that predicts the movies a user of a streaming service might like based on movies they have already watched.
• Natural language processing (NLP) enables a computer to process and generate human language. Translation features on a computer or chatbots are an example.
• Computer vision enables a computer to process and interpret visual information such as images or camera feeds. Applications include facial recognition and self-driving cars.

Figure 1.1: Specialised AI domains

Source: Adapted by the ANAO from Digital NSW, A common understanding: simplified AI definitions from leading standards, available from https://www.digital.nsw.gov.au/policy/artificial-intelligence/a-common-understanding-simplified-ai-definitions-from-leading [accessed 25 March 2025].

1.5 AI systems differ in their technical characteristics, intended purposes and deployment contexts, resulting in varying levels and types of risk. Australian Government guidance and assurance frameworks recognise that generative AI, ADM and safety-critical applications such as clinical or regulatory decision support present distinct risks, including differences in transparency, predictability, potential for misuse and consequences of failure. Entities using different types of AI need to identify and manage risks and potential impacts of the AI they implement, including risks arising from specific use cases of AI, rather than apply uniform requirements across all AI uses.

Artificial intelligence in the Australian Government sector

1.6 Within the Australian Government sector, requirements and guidance for AI governance and management are evolving. The Policy for the responsible use of AI in government took effect on 1 September 2024 and the AI Plan for the Australian Public Service was released in November 2025. Further information on initiatives and developments related to AI and the APS is at Appendix 3.

Policy for the responsible use of AI in government

1.7 The government released the Policy for the responsible use of AI in government to ‘position the Australian Government as an exemplar under its broader safe and responsible AI agenda’ and ‘to create a coordinated approach to government’s use of AI’.¹⁶ The policy¹⁷ required entities to:

• designate ‘accountable officials’ by 30 November 2024¹⁸; and
• publish AI transparency statements by 28 February 2025.¹⁹

1.8 Version 2.0 of the policy was released on 15 December 2025.²⁰ Version 2.0 defines an AI use case as ‘a specific application of an AI system or systems to achieve certain objectives or perform certain tasks.’ The policy specified that an AI use case is considered ‘in-scope’ of the policy where any of the following apply:

• The use, misuse or failure of AI could lead to more than insignificant harm to individuals, communities, organisations, the environment or the collective rights of cultural groups including First Nations peoples.
• The use of AI will materially influence administrative decisions that affect individuals, communities, organisations, the environment or the collective rights of cultural groups including First Nations peoples.
• It is possible the public will directly interact with, or be significantly impacted by, the AI or its outputs without human review.
• The AI is designed to use personal or sensitive data or security classified information.
• It is deemed an elevated risk AI use case as directed by the [Digital Transformation Agency].²¹

1.9 Version 2.0 of the policy required entities to develop a strategic approach to AI adoption within six months of the policy coming into effect (that is, by 15 June 2026) and implement training and governance arrangements for AI use cases within 12 months of the policy coming into effect (that is, by 15 December 2026). Further details of the policy requirements can be found in Appendix 4.

AI Plan for the Australian Public Service

1.10 The AI Plan for the Australian Public Service outlines a series of objectives for government, including to improve AI literacy, drive AI adoption through a coordinated approach and lead by example. The plan requires entities to appoint Chief AI Officers (CAIO) by July 2026 to promote adoption of AI and encourage collaboration across the public service.²²

1.11 CAIOs are responsible for leading change while AI Accountable Officials are responsible for the governance required to comply with government policy. Department of Finance guidance states that CAIOs are ‘expected to be existing senior leaders in their agency, separate to the Accountable Official where possible.’

Previous reviews and audits relating to the governance of artificial intelligence

1.12 The Senate Select Committee on Adopting AI tabled its report in November 2024, which made 13 recommendations including that the Australian Government introduce new legislation to regulate high-risk uses of AI; increase its support to sovereign AI capability in Australia; extend and apply the existing work health and safety legislative framework to the workplace risks posed by AI adoption; and introduce a right for individuals to request information about how substantially automated decisions with legal or similarly significant effect are made.²³ The Australian Government’s April 2026 response stated that it would: support sustainable AI infrastructure; support the growth of Australia’s AI ecosystem and the widespread responsible adoption of AI; prevent and mitigate AI harm; build a workforce ready for a future enabled by AI; support the creative sector during the AI age; ensure the transparent use of automated decision-making by the government to improve public services; and expand digital literacy to safeguard elections in Australia.²⁴

1.13 The Joint Committee of Public Accounts and Audit (JCPAA) conducted an inquiry into the use and governance of artificial intelligence systems by public sector entities and tabled its report in February 2025.²⁵ The report made four recommendations relating to collecting data on the use and understanding of AI in the APS; convening a whole-of-government working group; establishing a Joint Committee on Artificial Intelligence and Emerging Technologies; and Digital Transformation Agency guidance. The Chair of the JCPAA noted the need for effective and coordinated governance frameworks for AI systems within the APS. The government had not responded to the report as at June 2026.

1.14 Auditor-General Report No. 22 2024–25 Audits of the Financial Statements of Australian Government Entities for the Period Ended 30 June 2024 stated that during 2023–24:

64 per cent of entities that used AI had also established internal policies governing the use of AI (2022–23: 44 per cent). Twenty-seven per cent of entities had established internal policies regarding assurance over AI use.²⁶

1.15 Auditor-General Report No. 26 2024–25 Governance of Artificial Intelligence at the Australian Taxation Office assessed the Australian Taxation Office’s governance of AI at the enterprise level. The audit found it had partly effective arrangements to support the adoption of AI, including arrangements for governance, design, development and deployment and monitoring, evaluation and reporting.

IP Australia

1.16 IP Australia is a non-corporate Commonwealth entity that administers intellectual property (IP) rights for patents, trademarks, design rights and plant breeder’s rights (known collectively as IP rights groups). It is a portfolio agency of the Department of Industry, Science and Resources, with $440.3 million total estimated resourcing for 2026–27 and an average staffing level of 1,100. More than 97 per cent of IP Australia’s costs are recovered by charging fees for the services administered.

1.17 The Strategic Corporate Plan 2025–26 (the Corporate Plan) outlines IP Australia’s operating context as well as its approach to managing risk and measuring performance against its objectives. According to the Corporate Plan, the purpose of IP Australia is ‘[e]nabling Australians to benefit from great ideas by providing a world-leading IP system.’²⁷ The key outcome that IP Australia has identified against its purpose is:

Increased innovation, investment and trade in Australia, and by Australians overseas, through the administration of the registrable intellectual property rights system, promoting public awareness and industry engagement, and advising government.²⁸

1.18 The Corporate Plan sets out nine strategic objectives under four categories: Impact, Customer, Capability, and Innovation. The objectives include:

• Increase trust and confidence by maintaining a high-quality, customer-centric, efficient IP rights system.
• Increase access to and benefits from IP rights ownership.
• Create and continually improve capabilities that meet the current and future needs of the IP rights system.
• Create innovative contemporary digital and data driven customer services and staff experiences.

Artificial intelligence use at IP Australia

1.19 IP Australia has been adopting AI and ADM capabilities over many years and deployed its first AI tool in 2018. Adoption of AI began with experimentation and a desire to develop staff capability with AI tools. As IP Australia’s implementation of AI matured, it has sought to identify and realise longer-term efficiency gains.

1.20 In its Corporate Plan IP Australia states ‘[a]rtificial intelligence (AI) is rapidly transforming our world and we are committed to innovating to improve the accessibility of the IP rights system and efficiency of its administration through its responsible use.’²⁹ IP Australia applies a risk-based approach to the governance of AI and ADM that ‘ensures the ethical and responsible implementation of any AI and ADM tools that deliver tangible benefits.’³⁰ IP Australia reported its use of AI in its AI Transparency Statement published in February 2025, with an update in February 2026.³¹

1.21 As at May 2026, IP Australia identified 30 AI tools in use across the agency including those that have been developed internally and purchased from third-party providers. None of the AI deployed by IP Australia decides the outcome of an IP rights application. Examples of tools in use, and their role in supporting staff and business processes; include:

• Generative AI tools that assist with general administrative tasks, writing, image, and video generation. These tools include specialised models for staff training and media generation, enterprise-wide general-purpose tools such as Microsoft Copilot, and generative AI functionality embedded in existing software such as Adobe Acrobat. IP Australia also has a small number of licences for publicly available generative AI models. Additionally, in April 2026 IP Australia released its own generative AI chatbot to respond to queries from the public regarding intellectual property rights.
• Other off-the-shelf solutions that use AI functionality to support administration, manage and categorise customer enquiries and contacts, and manage internal documentation.
• Internally developed tools that assist with managing the workflow for IP rights applications. These tools use AI to streamline manual tasks in the examination process, such as by examining IP rights applications to categorise them by type for assignment to an appropriate team, and searching for existing intellectual property. Several of these tools were examined by this audit and are discussed further in Chapter 3.

1.22 IP Australia’s registers of AI use do not currently identify if use cases meet the in-scope criteria of the Policy for the responsible use of AI in government (described in paragraph 1.8); work to update these registers is in progress. Noting that this assessment is not yet complete, and definitions have evolved over time, the registers identify that some use cases would be considered in-scope.

Rationale for undertaking the audit

1.23 Artificial intelligence is an emerging technology that is increasingly used by the APS. AI can offer the promise of better services, enhanced productivity and efficiency, but has the potential for increased risk and unintended consequences.

1.24 In 2024–25, there were 29,999 patent applications filed with IP Australia, with the median time between the filing of an application and the grant of a patent being 2.8 years.³² The number of patent applications in the examination pipeline peaked in 2023–24 and has declined since. IP Australia began adopting AI in 2018 and has increasingly implemented AI to improve efficiency and productivity as it manages its patent application workload.

1.25 This audit continues the ANAO’s work in examining the governance of emerging technologies and is the first audit examining the implementation of a mature AI model across the full development lifecycle, against the Technical standard for government’s use of artificial intelligence.³³ It provides independent assurance to the Parliament as to whether IP Australia has effective arrangements in place to support its adoption of AI in the patent rights process.

Audit approach

Audit objective, criteria and scope

1.26 The objective of this audit was to assess whether IP Australia’s use of artificial intelligence (AI) in the patent rights process is effective. To form a conclusion against the objective, the ANAO examined the following criteria:

• Does IP Australia have appropriate governance arrangements supporting the adoption of AI?
• Does IP Australia have fit-for-purpose arrangements for the design, development and deployment of AI tools in the patent rights process?
• Is IP Australia effectively monitoring and reporting the impact of the use of AI?

Audit methodology

1.27 The audit methodology involved:

• examining IP Australia’s documentation including its policies, procedures, risk assessments, registers, assurance and reporting activities relating to AI;
• meetings with IP Australia officers;
• walkthroughs of IP Australia systems and analysis of selected AI tools; and
• testing of the design, development and deployment processes of AI models related to patent rights.

1.28 The audit was conducted in accordance with ANAO Auditing Standards at a cost to the ANAO of approximately $449,575.

1.29 The team members for this audit were Jenny Broome, Jessica Bracken, Kai Clark, Lachlan Rowe, Qing Xue, Zhuo Li, Nathan Daley, Anne Rainger and Ben Siddans.

2.1 AI governance guidance is evolving, with a common theme that there is no one-size-fits-all governance model. The National Framework for the assurance of artificial intelligence states that ‘[g]overnance structures should be proportionate and adaptable to encourage innovation while maintaining ethical standards and protecting public interests’.³⁴ The Policy for the responsible use of AI in government is intended to ‘complement and strengthen … existing frameworks in use by the [Australian Public Service]’.³⁵ The policy provides a framework to support government agencies to ‘embrace AI while continuing to position government as an exemplar in responsible AI use’.³⁶

2.2 IP Australia has adopted AI and automated decision-making (ADM) capabilities since 2018, including deploying AI tools to support elements of the patent rights process. As AI use in government has increased, expectations have also evolved that entities put in place governance arrangements that are fit-for-purpose, risk-scaled and capable of providing clear accountability for decisions and outcomes across the AI lifecycle.³⁷

2.3 This chapter assesses whether IP Australia has appropriate governance arrangements to support the adoption of AI in the patent rights process. In doing so, it examines whether IP Australia has: an effective strategic framework that links AI use to business needs and intended outcomes; arrangements to identify and manage AI-related risks within its broader risk management framework; and clearly defined and communicated roles, responsibilities and oversight mechanisms to support accountability and effective control.

IP Australia has had strategies for AI adoption and experimentation since 2017

2.4 Version 2.0 of the Policy for the responsible use of AI in government states that government agencies must develop a strategic position on AI adoption within six months of the policy taking effect (that is, by 15 June 2026) and requires agencies to embed responsible AI practices within 12 months of the policy taking effect (that is, by 15 December 2026).³⁸

2.5 IP Australia’s strategy for AI adoption has been driven by its desire to demonstrate innovation, including through the use of AI. IP Australia advised the ANAO in February and March 2026 that its early strategies were also informed by an interest in exploring non-tangible benefits resulting from AI experimentation, such as building staff capability and organisational understanding. IP Australia’s AI Transparency Statement (published in February 2026) states that the agency is ‘committed to fostering innovation and engaging AI and ADM to improve the efficiency and accessibility of the IP rights system’.³⁹

Cognitive Futures Strategy

2.6 First published in 2017, IP Australia’s Cognitive Futures Strategy and Roadmap (the Strategy) provided the strategic direction for cognitive computing to improve the efficiency of the administration, examination and enforcement of IP rights.⁴⁰ IP Australia pursued AI under the Strategy. The Strategy was updated in 2021, and again in 2023 to provide ‘a consolidated view of the strategic direction, inclusive of resourcing, sustainment, ethics, explainability, and ongoing funding for cognitive computing across IP Australia over the next three years.’⁴¹ Under the Strategy, ‘business problems and opportunities’ were reviewed to identify potential use cases for prioritisation with business owners, and if a viable proof of concept was discovered, funding was requested through the Investment, ICT and Property Committee (IIPC).

2.7 The 2023 Strategy acknowledges the progression of cognitive computing from research and development to a core supporting capability at IP Australia. IP Australia’s Delivery Model for cognitive computing products, from identification of a business problem to identification of potential use cases, to proof of concepts, budget allocation and an agile build approach prior to release into production is set out in the Strategy.

2.8 Each year, Cognitive Futures Roadmaps set out specific initiatives that are scheduled, pending or paused. The 2025–26 roadmap includes a number of initiatives ranging from research and development activities, business-as-usual updates to existing AI systems, and work to implement both new systems and improvements to existing solutions. The Strategies did not list any specific outcome measures or actions by which the annual roadmaps of activities would be considered a success.⁴²

Innovation Framework

2.9 IP Australia developed its Innovation Framework in 2023 to support the associated objectives of its Corporate Plan, noting ‘[a]s our operating context changes — such as shifts in technology, economic activity, or societal expectations — we also need to change to ensure that we remain relevant and ready and able to deliver’. The Innovation Framework is not specific to artificial intelligence and is intended to be complementary to other strategic initiatives such as the Cognitive Futures Strategy.

2.10 IP Australia has defined three characteristics for innovation within the agency:

• novel — innovation should be something new to the agency;
• achieves impact — innovation must make a real or significant difference to what has happened before; and
• more than an idea or an invention — ideas must be implemented to achieve value.

2.11 The Executive Board⁴³ has responsibility for oversight of the Innovation Framework and undertakes an annual stocktake of innovation activities and reviews the framework every two years. There were no changes to the framework or its direction as a result of the review conducted in October 2025.

People, Technology and Efficiency Program

2.12 The People, Technology and Efficiency Program (the P+T+E Program) was stood up in late 2024 in an effort to maintain IP Australia’s long term budget position following executive discussions about productivity and efficiency, especially in the context of the implementation of AI. The P+T+E Program was initiated through four projects: Investment and resource allocation, AI use cases, Organisational structure, and Enterprise cultural change.⁴⁴ The Program operates in parallel to the existing Cognitive Futures Strategy and Innovation Framework.

2.13 The P+T+E Program reports monthly to the Management Committee (MCM).⁴⁵ The P+T+E Annual Report published in June 2025 indicated that the program had been focusing on initiatives such as completion of AI use cases for key business areas, establishing data and AI governance arrangements, alignment of internal budget, investment and other planning processes, and combining data and technology functions in IP Australia’s organisational structure.

Strategic position on AI adoption

2.14 In December 2025, IP Australia’s MCM identified the need for a clear, agency-wide AI adoption strategy that describes the integration of its various AI-related initiatives, noting that ‘current documents and communications lack cohesion and do not fully explain how all the different components fit together’.⁴⁶ IP Australia advised the ANAO on 16 April 2026 that it is currently developing a Strategic Position on AI Adoption, which will ‘draw on and connect to existing programs and artefacts including P+T+E, Corporate Plan and ICT Strategy.’

2.15 IP Australia also advised that it is developing a separate AI Adoption approach as part of the P+T+E Program (refer to paragraph 2.12). Aligned to the People Pillar of the AI Plan for the Australian Public Service, the purpose of this document is to:

explain what staff are expected to do when AI is introduced into their work, what support IP Australia will provide, and how individuals and the agency can understand where they are on the AI adoption journey.

2.16 IP Australia advised the ANAO in June 2026 that it planned to release the documents on 15 June 2026.

2.17 IP Australia was an early adopter of AI, with the first AI tool being deployed in 2018. Strengthening processes to define and measure benefits at different stages of the AI lifecycle and inform future strategic positioning would allow IP Australia to further leverage this experience to inform its future directions.

Identification of use cases for AI in patent rights has been business led

2.19 The Policy for the responsible use of AI in government defines an AI use case as ‘specific application of an AI system or systems to achieve certain objectives or perform certain tasks’ (refer to paragraph 1.8).⁴⁷ Policy requirements for ‘in-scope’ use cases are more in depth than for those that do not meet the ‘in-scope’ criteria (refer to Appendix 4). IP Australia’s identification and selection of AI use cases has developed over time, informed by its strategic frameworks and priorities being identified by the different IP rights groups.⁴⁸

Examination Excellence Working Group

2.20 In 2018 IP Australia’s Examination Excellence Working Group⁴⁹ produced a report that proposed goals, measures, training and opportunities to explore efficiencies in the patent examination process. The efficiencies included ‘embrac[ing] automation and artificial intelligence and seek to encourage examiners to identify new opportunities such that productivity gains may be created’. The report noted:

There is little doubt that in working to improve quality, we must look for efficiency gains in all aspects of examination. Automation and the use of artificial intelligence is fast becoming a necessity for progress. A soon to be conducted trial will seek to automate classification of applications, and it has been suggested that automation and AI could be used to conduct pre-examination searches to prepare a list of potential prior art citations for examiners. While no specific additional ideas manifested in the focus groups, it is clear that the patents group must seek to employ such technologies wherever possible and beneficial.

2.21 IP Australia established the Examination Process Improvement Working Group (EPIWG) to assess ideas proposed by patent examination staff for automation and AI opportunities. Potential AI use cases in relation to patent rights were identified through a series of working group meetings in 2018. The Automation and Artificial Intelligence in Patent Examination report outlined 18 areas for automation and AI. In response, the Executive Board noted that the use of automation and AI by the business area would allow reinvestment of time saved into excellence and quality outcomes.

2.22 Three of the four AI tools that have been implemented in the patent examination process were identified through the work of the EPIWG. These are the Patent Auto Classifier, Automated Preliminary Search Tool and Family Member Analyser.

IPAVentures

2.23 Created in 2021, IPAVentures is a team of eight staff within IP Australia that identifies and explores new opportunities in the IP rights system through innovative business ventures that may focus on or include the use of AI. Oversight is provided by IP Australia’s Venture Board.⁵⁰ IPAVentures undertook a scenario-based discovery process in 2023 to identify potential impacts of generative AI on IP rights.⁵¹

2.24 The development of the AI tools used in patent rights processes (discussed in Chapter 3) occurred before IPAVentures was established. IPAVentures explored the design of a generative AI chatbot as part of the IP First Response website. The AI chatbot was released in April 2026 (see paragraph 3.21).

P+T+E Program

2.25 Project 2 of the P+T+E Program (refer to paragraphs 2.12 and 2.13) is AI Use Cases. As part of Project 2, the Patents Examination Group (PEG) conducted a Patents AI Use Case Project. The project has five phases: Discovery and Ideation; Analysis, Testing and Reporting; Refinement of Ideas; Piloting; and Delivery and Benefits Realisation. The project is currently in the Piloting phase. Oversight of the Program is through the Management Committee, while decisions regarding AI use cases identified through the project are made by the Venture Board.

2.26 Phase 1 of the AI Use Cases project was conducted between September and November 2024 and involved consultation with 85 members of PEG and other relevant business areas. The consultation identified 12 potential AI use cases across the patent process, based on identified problems and opportunities. Under phase 2, the Patents AI Use case team provided concepts and preferred options to IP Australia’s Venture Board. The Venture Board approved two use cases to progress to potential business cases and pilots. As at May 2026, one AI use case has been approved to move to a standalone project.

Policies and procedures for AI governance have been established but could provide more practical guidance

2.27 In 2018, amendments were introduced to Parliament to legislate the use of ‘computer programs’ by the Commissioner of Patents. Section 223A of the Patents Act 1990 allows for the Commissioner to ‘arrange for the use, under the Commissioner’s control, of computer programs for any purposes for which the Commissioner may, or must, under this Act’ for making a decision, or exercising any power and complying with any obligation.⁵² IP Australia’s 2018 Automated Decision Governance Framework and Policy (2018 ADM policy) set out its ‘framework to govern the design and use of automated decision-making systems’ in line with the legislative amendments. The 2018 ADM policy described core stages of the automated decision-making framework and associated objectives, activities and mandatory requirements.

2.28 IP Australia’s Artificial Intelligence Governance Policy (AI Governance Policy) was published in May 2025.⁵³ The AI Governance Policy adopts the OECD definition of AI (refer to paragraph 1.1) and sets out the principles and governance processes for the implementation of AI. The AI Governance Policy establishes risk-based governance mechanisms, requiring all new AI use cases to be assessed using a specific template, be documented in a ‘use case card’ and added to the AI and ADM Inventory (refer to paragraphs 2.58 to 2.61). The level of initial approval and documentation is determined by the risk rating of the use case.

2.29 IP Australia’s AI Governance Policy does not define ‘use case’. In practice, IP Australia uses the term ‘use case’ differently from that of the DTA and refers to an AI system more broadly rather than a specific objective or task. For example, IP Australia treats Microsoft Copilot as an AI use case, rather than identifying the specific objective or task the system has been implemented to achieve such as document summarisation and analysis or image generation. Considering specific implementation of tools would support IP Australia in understanding both the AI systems it has deployed and how they are being applied to specific business problems.

2.30 At the time IP Australia released its AI Governance Policy, it was participating in the DTA-led whole-of-government trial of the Commonwealth AI Assurance Framework.⁵⁴ As a result, IP Australia’s AI Governance Policy refers to older guidance issued by the DTA for the purpose of the pilot. IP Australia has not updated the AI Governance Policy to reflect recent guidance.

2.31 The AI Governance Policy states that use case cards and risk assessments should be reviewed ‘at each stage of their life cycle’.⁵⁵ The policy does not articulate how ongoing review and monitoring of AI use cases and tools will occur or the key information required at each stage. The policy does not indicate at which stage mandatory security requirements would need to be completed or provide specific guidance to officials regarding consideration of legal, privacy and security issues.

2.32 IP Australia does not have up-to-date IT security risk assessments for any of the tools used in the patent rights process (refer to Table 4.1). Three use cases were described as existing in multiple stages of the life cycle simultaneously. For example, the use case card for the Family Member Analyser tool records the tool as being in both ‘design, data and models’ and ‘operation and monitoring’ stages.

2.33 Design documentation and risk assessments must evolve in line with the evolution of a system. Formalising requirements for completion of assessments at key lifecycle stages would support IP Australia to assure that assessments are finalised in advance of potential business use or changes in model design.

2.34 IP Australia advised the ANAO in February 2026 that the use case cards are intended to be ‘live documents’ and are updated as the use case is reviewed or information changes. In April 2026, IP Australia advised that it is continuing to develop the format of the use case cards.

Policies for generative artificial intelligence

2.36 The DTA coordinated a whole-of-government trial for Microsoft 365 Copilot. IP Australia participated in the trial which concluded on 1 July 2024. Following the trial, IP Australia decided to implement Microsoft Copilot with 300 licences made available to staff. As at 31 May 2026, IP Australia had allocated 608 licences for Microsoft Copilot (51 per cent of employees).

2.37 The Australian Government released guidance on the use of publicly available generative AI tools in July 2023, with updated guidance released in November 2023 and December 2025.⁵⁶ IP Australia’s AI Governance Policy states ‘IP Australia staff who develop and/or use [generative AI] tools at work must read and understand Australia’s AI Ethics principles and Australian Government issued Interim guidance on government use of public generative AI tools.’ The AI Governance Policy requires staff to comply with all relevant laws, regulations and policies, and consider privacy, confidentiality, sensitivity and classification of data and information inputs.

Staff training on artificial intelligence

2.38 Version 1.1 of the Policy for the responsible use of AI in government strongly recommended that agencies implement AI fundamentals training within six months of the policy taking effect (that is, by 1 March 2025).⁵⁷ Version 2.0 of the Policy for the responsible use of AI in government requires agencies to ‘communicate their strategic position on AI to give staff clear direction on AI adoption’ and implement mandatory training for all staff on responsible AI use within 12 months of the policy taking effect (that is, by 15 December 2026).⁵⁸ The DTA’s Guidance for staff training on AI (December 2025) suggests agencies consider if it is appropriate for staff to complete annual refresher training.⁵⁹

2.39 In August 2025 DTA released AI in Government Fundamentals, an online course which aims to provide staff with foundational knowledge, and principles regarding the safe and responsible use of AI in an APS context. While IP Australia’s AI Governance Policy does not outline staff training requirements, it has implemented DTA’s course. As at 31 May 2026, 838 employees had completed the course (70 per cent of employees), and all staff were directed to complete it by 30 June 2026.

2.40 As part of the whole-of-government trial of Microsoft Copilot, access to a training module was provided to participating entities by DTA. The content of the module relates to the whole-of-government trial of Microsoft Copilot, and does not provide specific guidance on the use of Copilot or its use in an IP Australia context. Following the trial, staff were directed to complete the training module as a pre-requisite to obtaining a licence for Microsoft Copilot.⁶⁰ As at 30 September 2025, 119 staff had completed the module (31 per cent of staff with a licence). On 1 October 2025, IP Australia updated its guidance to staff indicating the AI in Government Fundamentals course was the required training prior to obtaining a licence.

2.41 At governance committee level, IP Australia’s executive indicated they did not have clarity over how staff might use generative AI tools and were unclear about potential risks. For example, executives were unclear on whether patent-related information could be used in Microsoft Copilot. Following this discussion, a staff message was issued on the IP Australia intranet advising that Microsoft Copilot is approved for data with a security classification up to and including Official Sensitive. Providing clarity at an operational level through guidance and training, in addition to over-arching principles, would improve IP Australia’s policy framework and ensure that understanding is communicated to new staff.

IP Australia’s enterprise risk forecast identifies AI as both an opportunity and a threat to its strategic risks

2.43 In May 2019, IP Australia’s Executive Board identified an emerging risk of ‘effectively adopt AI and automation — to achieve Strategy 2030 outcomes’. The risk was rated ‘Substantial’ and controls were considered ‘partially effective’. The critical controls were the Cognitive Futures Strategy and Roadmap (refer to paragraphs 2.6 to 2.8), the 2018 ADM policy and business-led working groups identifying AI and automation.

2.44 The Executive Board approved the addition of the risk to IP Australia’s Corporate Risk Register. In approving the risk, the Executive Board requested a benefits realisation plan for AI initiatives estimating and tracking time savings and quality improvements. There is no evidence that the plan was commenced. The Corporate Risk Register, including the risk related to adoption of AI, was reviewed quarterly by the Executive Board until mid-2020, when IP Australia’s approach to enterprise risk management was updated.

2.45 IP Australia’s approach to risk management is supported by the Risk Management Policy and Framework (the Policy), the Risk Management Plan (the Plan) and the Risk Objectives, Appetites and Tolerances.⁶¹ IP Australia’s risk tolerance level determines the level of escalation required to make decisions regarding a risk. These are defined on a scale from ‘missed opportunity’ through to ‘threat to objectives’. The Policy defines IP Australia’s strategic risks, objectives and the risk appetite and tolerance against six risk categories⁶²:

• IP Ecosystem: uphold the integrity of the system, encourage innovation and add value to the global IP community;
• Confidence: customers have confidence in IP services and have access to accurate information;
• Customer and Stakeholder Engagement: collaborate and engage with stakeholders to focus on performance;
• Governance: meet and administer legislative responsibilities and whole-of-government policy;
• Financial: Invest strategically for long term sustainability and capacity to adapt to customer needs; and
• People and Technology: capable workforce, innovative and flexible working options.

2.46 A Strategic Risk Forecast that ‘describes what we are trying to achieve (risk objectives) and the strategic threats and opportunities to those objectives’ is reviewed quarterly by the Executive Board. As at December 2025, IP Australia had identified threats and opportunities relating to emerging technology and AI specifically against five out of the six strategic risks. Opportunities included AI enhancing customer support options, such as reducing cultural and linguistic barriers in participating in the IP system. Threats included the pace of change of technology and government requirements around AI, as well as lack of transparency around AI use.

2.47 The Strategic Risk Forecast does not refer to any of the AI tools that IP Australia has implemented or is planning to implement. Tools recently implemented by IP Australia include public-facing AI (see Case Study 1), and the forecast does not identify how these may impact on the threats or opportunities aligned to its enterprise risk categories. The Strategic Risk Forecast does not include controls or treatments for the strategic risks. IP Australia advised the ANAO on 11 February 2026 that ‘treatments, controls or actions [are] delegated to appropriate risk owners … and [are] monitored through the Agency’s governance committee structure.’

2.48 IP Australia’s Risk Management Framework does not prescribe group level risk registers that would provide operational-level detail regarding risk management. Senior Executives are responsible for risk management within their respective business units and projects, including how risks are identified, managed, monitored and documented. IP Australia’s monitoring arrangements for AI could be strengthened (see Chapter 4), which would provide the agency with greater assurance that the strategic risk posture is reflected at an operational level.

IP Australia’s approach to managing AI use cases is underpinned by a risk-scaled governance framework, with requirements and oversight tailored according to the assessed risk rating

Artificial intelligence and automated decision-making risk assessments

2.49 IP Australia has established AI-specific risk assessment and management requirements that align to its agency level risk management framework, identified as ‘risk-scaled governance’. As discussed at paragraphs 2.29 to 2.33, the level of documentation approval and period of review of an AI use case is determined by the risk rating.

2.50 IP Australia’s requirement to complete an AI-specific risk assessment commenced in December 2024 to align with the release of its updated Automated Decision-Making Governance Policy. The same requirement is included in the AI Governance Policy. The risk assessment template sets out risk categories, and staff need to identify the consequence level, controls and control effectiveness. IP Australia has established AI-specific consequences aligned to AI risk categories.

2.51 Of the 30 AI tools in use by IP Australia, there are completed and endorsed risk assessments for 13, five have risk assessments in draft, and 12 do not have a documented risk assessment. IP Australia has identified one tool, the IP First Response generative AI chatbot, as a medium risk (see paragraph 3.21). The remaining 17 AI tools which have undergone a risk assessment have been assessed as low risk. For tools that have been assessed, IP Australia identified four where a privacy threshold assessment was required and determined that the tools are consistent with relevant legislation.

AI and ADM Assessment Panel

2.52 IP Australia has established the Artificial Intelligence and Automated Decision-Making Assessment Panel. The role of the panel is to review and ‘provide assurance’ over the risk assessment and rating of AI use cases and provide feedback to the business area on the risk rating. The panel is made up of subject matter experts from: IT security governance, strategy and architecture, data and information governance, legal, and risk. The panel is supported by a panel administrator who is responsible for organising panel meetings and maintaining records of the meeting.

2.53 The responsibilities of the panel are to:

• as subject matter experts, individually review and endorse the use case card, risk assessment and risk rating, and governance plan for each AI use case; and
• provide expert advice on the deployment, implementation and maintenance of AI and ADM use cases within IP Australia, including supporting policies and guidance materials.

2.54 Records of the panel assessment and endorsement are stored and linked in the AI and ADM Inventory. Feedback from the panel members is provided to the business area for its consideration. The process by which feedback is provided varies and includes markups to draft documents, emails, and other approaches that do not systematically record the feedback provided or the changes made in response. The lack of a formal process to capture feedback and responses for endorsed use cases can affect the ability to review decisions made (refer to paragraph 2.35).

2.55 Where a use case is not endorsed the feedback from the panel is collated and provided to the business area. The business area is responsible for actioning the feedback and submitting the use case for further consideration by the panel. If the use case is not endorsed or is identified as a higher risk after a second assessment by the panel, it is escalated for assessment by the AI and ADM Assessment Panel which includes the relevant Senior Responsible Officer (for the AI use case) as a member of the panel.

2.56 Since its inception, the panel has been retrospectively assessing deployed AI tools. On 7 August 2025, the panel estimated it would take around six to 12 months to complete its retrospective assessments. IP Australia advised the ANAO on 16 April 2026 that it has paused the work on retrospective use case assessments until an internal AI governance review is completed. As noted in paragraph 2.51, the panel has assessed 13 of the 30 AI tools that have been identified by IP Australia.

2.57 The AI Governance Policy prescribes a minimum frequency of use case review following the initial assessment and approval (between three and 12 months based on the risk rating). IP Australia advised the ANAO on 18 February 2026 that the review process has not yet been undertaken as part of IP Australia’s AI governance process and has not yet been conceptualised.

Work to complete an inventory of artificial intelligence tools in use is ongoing

2.58 Version 2.0 of the Policy for the responsible use of AI in government requires agencies to create a register of in-scope AI use cases including certain minimum information by December 2026. The Standard for accountability outlines the minimum requirements.⁶³

2.59 IP Australia established an AI and ADM Inventory in February 2025 to serve as a record of both AI and ADM systems across the agency.⁶⁴ IP Australia advised the ANAO on 16 April 2026 that the Inventory is ‘iteratively updated to document uses cases’, and that it had completed a point in time ‘stocktake of all historic and new use cases at IP Australia’.⁶⁵ The Inventory includes linked artefacts (use case cards, risk assessments and technical documentation for models). The categorisation of use cases as AI or ADM is not consistent across these artefacts.

2.60 Three use cases were endorsed for inclusion into the Inventory but are not included in the stocktake. IP Australia advised the ANAO on 31 March 2026 that it obtained licences for six commercial generative AI tools. These are not recorded on the stocktake or the Inventory. The absence of a complete inventory of AI impacts the ability of IP Australia to effectively oversee and be accountable for its AI use.

An accountable official for artificial intelligence has been appointed. The clarity of roles and responsibilities supporting AI adoption could be improved

2.61 Version 1.1 of the Policy for the responsible use of AI in government required entities to designate an accountable official(s) for implementing the policy within 90 days of the policy taking effect (that is, by 1 December 2024). Version 2.0 of the policy required entities to designate an accountable official and follow the Standard for accountability when designating officials and implementing the policy. The accountable official should have the ‘authority and influence to effectively drive the policy’s implementation in their agency.’ ⁶⁶

2.62 The responsibilities of accountable officials ‘may be vested in an individual or in the chair of a body. The responsibilities may also be split across officials or existing roles (such as Chief Information Officer, Chief Technology Officer or Chief Data Officer) to suit agency preferences’.⁶⁷ In November 2024, IP Australia appointed its Deputy Director General as its accountable official.

2.63 The AI Plan for the Australian Public Service requires entities to appoint Chief AI Officers (CAIO) by July 2026 ‘in recognition of the fundamental shift that generative AI is bringing to government operations.’⁶⁸ According to the AI Plan for the Australian Public Service, CAIOs are responsible for leading change while AI accountable officials are responsible for the governance required to comply with government policy. Department of Finance guidance provides flexibility to entities in determining who best meets the needs of the CAIO role, and that smaller entities may opt to have both roles filled by the same official.⁶⁹

2.64 IP Australia appointed the Deputy Director General as its Chief AI Officer in February 2026. IP Australia determined that, in appointing the Deputy Director General to both roles:

…it would be inconsistent with our [risk] framework and positive risk culture to set up a dichotomy between driving adoption and engagement with AI and being accountable for governance and risk of AI use by appointing two different officials.

Governance committees

2.65 Roles and responsibilities relating to AI governance are described in IP Australia’s AI Governance Policy. The policy refers to the Interim AI Governance Committee (IAIGC), which has a responsibility to ‘approve the policy and monitor its implementation’. In operation between October 2024 and November 2025 the IAIGC was established ‘for a specific purpose while [IP Australia] developed [its] approach for AI governance.’ The purpose of the IAIGC was to support the Investment, ICT and Property Committee⁷⁰ (IIPC) ‘in the governance of AI risks, to achieve the agency’s strategic objectives, within the risk appetite and parameters set by the Executive Board.’ The policy does not refer to governance committees other than the IAIGC.

2.66 To identify key governance roles and responsibilities, the ANAO analysed the terms of reference and meeting papers of governance committees active during the period in which IP Australia developed AI relevant to this audit.⁷¹ AI at the enterprise level was regularly discussed at both strategic and operational committees, and operational aspects of AI such as design and approval of specific tools were managed through both strategic and operational forums. IP Australia finalised a Committee Governance Review in October 2025, which resulted in the transition of the IIPC to the Data and Technology Committee (a strategic governance committee). The Data and Technology Committee is ‘responsible for governance of ICT, AI, ADM, information, data and analytics to achieve IP Australia’s strategic objectives within the risk appetite and parameters set by the Executive Board.’ The AI Governance Policy has not been updated to reflect changes to AI governance at an enterprise level. There is no other artefact that documents the assignment of roles and responsibilities related to AI adoption to each of the relevant IP Australia governance committees.

Artificial intelligence system level responsibilities and accountabilities

2.67 The accountability principle of Australia’s AI Ethics Principles states that ‘people responsible for the different phases of the AI system lifecycle should be identifiable and accountable for the outcomes of the AI systems, and human oversight of AI systems should be enabled’.⁷² DTA’s Standard for accountability requires each in-scope use case to have an accountable use case owner.⁷³

2.68 IP Australia’s AI Governance Policy outlines roles and responsibilities for automated decision-making systems. The policy does not state the roles and responsibilities include AI systems. The policy defines the Deputy Director General as the accountable AI official for implementing the Policy for the responsible use of AI in government. The policy does not define the responsibilities of the accountable use case owner or who occupies the role. Responsibilities for matters such as assessment, approval and implementation of use cases are defined.

2.69 The AI Governance Policy stipulates ‘approval’ of an AI use case is required. The approver depends on the risk rating of the AI use case, with use cases that have been risk rated as ‘just right’ requiring no further approval. AI use cases risk rated as ‘warm’ or above must be approved by at least a Director (Executive Level 2 officer).

2.70 Effective governance requires that responsibilities and accountabilities, including decision-making and oversight roles, are clearly defined and communicated.⁷⁴ For AI, ‘existing decision-making and accountability structures should be adapted and updated to govern the use of AI’.⁷⁵ It should be clear who is responsible and accountable for determining and implementing an entity’s overarching approach to AI and for individual AI systems or uses of AI.⁷⁶

3.1 AI systems used in operational settings can introduce risks and assurance challenges across the lifecycle, which is ‘the sequence of phases that an AI system goes through, from its conception, all the way through its development, testing, deployment, use and eventual retirement.’⁷⁷ Australian Government and international better practice guidance emphasises that entities should establish controls that enable transparency, traceability and risk management throughout the lifecycle, and which are tailored to the system’s purpose, complexity and potential impacts.

• The Policy for the responsible use of AI in government outlines the framework to ensure that AI is being designed, developed, deployed and monitored effectively. Principles include that ‘AI use is lawful, ethical, responsible, transparent and explainable to the public.’⁷⁸
• The Australian Government AI technical standard ‘sets consistent practices for government agencies adopting [AI] systems across the AI lifecycle’ and is voluntary for entities to implement.⁷⁹
• The Organisation for Economic Co-operation and Development (OECD) report Advancing Accountability in AI recommends five elements of risk management and governance across the AI lifecycle: monitoring and reviewing, documenting, communicating, consultation and embedding risk management culture.⁸⁰

3.2 IP Australia has deployed four AI tools to the patent examination process that are intended to support efficiency, consistency and quality. IP Australia’s design, development and deployment of these AI tools predates the policy, the OECD report and the technical standard.

3.3 This chapter assesses whether IP Australia has fit-for-purpose arrangements for the design, development and deployment of AI tools in the patent rights process. It focuses on whether IP Australia has put in place appropriate lifecycle practices, including: clear problem definition and design documentation; identification and management of legal, privacy, ethical and security considerations; development practices that support testing, reproducibility and assurance; and deployment practices that support controlled release, change management and operational monitoring. The ANAO conducted detailed testing on one tool (the Patent Auto Classifier or PAC tool) due to the greater extent of customisation and development undertaken by IP Australia for this tool.

Four AI models are integrated into the patent rights process

3.4 A patent protects new inventions such as devices, substances, methods or processes. For a patent to be granted, an invention must be new, useful, inventive and a suitable subject matter.⁸¹ Once a patent is granted, it provides the inventor with exclusive commercial rights to the invention, freedom to license another manufacturer, and the right to take legal action that stops others from manufacturing, using and/or selling the invention without permission.

3.5 Patents may be granted in Australia following examination of a patent application by IP Australia. If there are issues raised during IP Australia’s examination, applicants have specified time to resolve the issues. A patent is granted when a patent application has been successful. IP Australia accepts patent applications from both national and international applicants. In 2024–25, 29,999 patent applications were filed with IP Australia.

3.6 A typical process for a standard patent application is described in Figure 3.1, illustrating key processes relevant to understand IP Australia’s use of AI, and the stages at which AI tools have been deployed or are being developed. None of the deployed AI tools make a decision that impacts a patent application. The tools are designed to create efficiency and quality in the administrative process of managing applications and managing manual tasks required as part of the examination process (see paragraph 4.7).

Figure 3.1: Patent application, assessment and granting process, including AI tools, as at April 2026

Note: IP Australia has deployed four AI tools into the patent examination process. Two additional tools, the Interactive Foreign Examination Report Summary and the Citation Retrieval Evaluation Search Tool are in conceptual stages of development that are expected to provide additional functionality to the FMA and APST tools respectively. IP Australia released the IP First Response chatbot for testing via the IP First Response website in late April 2026.

Note: Light blue boxes reflect processes with AI incorporated, while dark blue boxes are processes without AI.

PAC: Patent Auto Classifier

OBD: Outcomes Based Directions

APST: Automated Preliminary Search Tool

FMA: Family Member Analyser

Source: ANAO analysis of IP Australia documentation.

Application filing by applicant

3.7 IP Australia’s Customer Experience Group is responsible for reviewing patent applications to determine if they are complete. If issues are identified, the applicant is contacted to address the issue before the application will continue.

Classification and formalities

3.8 Every application is assigned one or more classification symbols to identify the type of invention (for example, a pharmaceutical or a mechanical device), using the International Patent Classification (IPC) system.⁸² The IPC is developed and managed by the World Intellectual Property Organization and is used internationally. IPC symbols are hierarchical codes that describe categories for inventions and consist of five parts or levels: section, class, sub-class, group and sub-group, each of progressively greater specificity. Figure 3.2 describes the IPC classification system for a type of shoe.

Figure 3.2: Application of the International Patent Classification system for a type of shoe

Source: ANAO presentation of World Intellectual Property Organization documentation.

Request for examination by applicant

3.9 Applications will not be assessed by IP Australia until the applicant submits a Request for Examination. The applicant must submit this request within five years (60 months) from the date the application was originally filed.⁸³ An applicant may withdraw an application at any point during the application process.

3.10 The Patents Act 1990 (the Patents Act) gives the Commissioner of Patents the power to direct an applicant to request examination.⁸⁴ This process is known as a direction and is used to manage the inventory of applications and examination requests. The applicant must submit a request for examination within two months of receiving the direction.

Examination — first report

3.11 Examination consists of one or more reports that assess whether the claims are suitable for a patent. Assessment is based on patentability, novelty and whether there is an inventive step.⁸⁶ Patent examinations are undertaken by specialised teams in the Patents Examination Group based on the type of invention that is being examined (refer to paragraph 3.8). As part of the patent examination process, examiners search through reports previously completed by IP Australia or an international patent office for the same and similar inventions to identify issues with the claims that may have already been identified.

3.12 IP Australia’s Customer Service Charter states that first examination reports should be completed within 12 months of the applicant’s Request for Examination. As at March 2026, response times range from 11 to 20 months, depending on the type of invention.⁸⁷

Examination — further reports

3.13 If an examination report contains objections against some or all of the claims, the application is not accepted. The applicant has the opportunity to respond to the objections raised in the report; this can be done by either making amendments to the specification and claims that address the objections or providing an argument against the reasoning for the objections. IP Australia will issue additional reports responding to comments and amendments submitted by the applicant. The patent will ultimately lapse if no version has been accepted within 12 months of the first examination report being issued.

Acceptance, publishing and opposition

3.14 An application is accepted when there are no objections raised. The initial version of an application is published in the Australian Official Journal of Patents 18 months after the filing date, unless a final version has already been accepted. The final version is published in the journal after it has been accepted.

3.15 After the final specification has been published there is a period of three months for members of the public to submit an opposition to the patent. Oppositions received by IP Australia are reviewed by the Oppositions team. The substantive matters in an opposition are reviewed by Patent Oppositions and Hearings Officers. The Hearing Officer may recommend re-examination of the application. If oppositions are unsuccessful or not received, the patent is granted.

Quality assurance

3.16 IP Australia conducts a standards-based quality assurance process over patent examination reports.⁸⁸ The reports selected for the quality assurance process include all reports written by trainee examiners or other staff without delegation for approvals, as well as a random sample of reports.

The design of the four AI models are being retrospectively documented in line with new governance requirements

3.17 The ANAO assessed the design practices for the four AI tools that have been deployed in the patent rights process. Business requirements were considered and addressed as part of design. Broader governance documentation was incomplete at the time of design.

3.18 Since the introduction of IP Australia’s AI Governance Policy, business owners are required to complete documentation for AI use cases. The AI Use Case Card records the description of the use case, roles and responsibilities, and links to risk assessments (which includes consideration of ethics) and privacy impact assessments.

3.19 A summary of the design components for each of the four tools is shown at Table 3.1.

Table 3.1: Assessment of the planning, governance and design of IP Australia’s patent rights process AI tools

Note a: The four AI tools were designed in the context of IP Australia experimenting with AI in the patent examination process (see paragraphs 2.20 to 2.22). Criterion 28 of the Technical standard for government’s use of artificial intelligence, released in 2025 is currently voluntary, requires agencies to assess alternatives to AI.

Note: The components in this table were informed by better practice drawn from AS ISO/IEC 42001:2023 Information technology — Artificial intelligence — Management system, the DTA Technical standard for government’s use of artificial intelligence, and relevant IP Australia policy.

Source: ANAO analysis of IP Australia documentation.

AI tools being designed follow governance processes with improved consideration and management of key design issues

3.20 IP Australia is currently exploring new ways for small business IP rights holders to quickly identify and understand their enforcement options. In April 2025, the Venture Board agreed to progress a proposal to develop a generative AI-powered chatbot to be published on the IP First Response website. In May 2025, the IPAVentures team sought advice regarding the governance requirements for this proposed AI use case. Case study 1 sets out the governance approach of IP Australia for the IP First Response chatbot.

Development of the PAC AI model addressed development risks

3.21 To assess fit-for-purpose arrangements to support the development and deployment of AI models, the ANAO completed detailed testing of the Patent Auto Classifier (PAC) tool. While IP Australia has developed and deployed four tools in the patent rights process, the ANAO considered PAC in additional detail due to the greater extent of customisation and development undertaken by IP Australia.

3.22 IP Australia’s processes for the development of the PAC model address key risks in the development process, as shown in Table 3.2.

Table 3.2: Assessment of the development of the PAC model

Note a: The components in this table were informed by better practice drawn from AS ISO/IEC 42001:2023 Information technology — Artificial intelligence — Management system and the Technical standard for government’s use of artificial intelligence.

Source: ANAO analysis.

Deployment of the PAC AI model addressed deployment risks

3.24 The ANAO considered the deployment process for PAC in detail as the development of an internal tool can contain greater risks than procuring off-the-shelf. IP Australia has implemented an automated pipeline to deploy PAC from its version control system into a cloud environment. As shown in Table 3.3 this process addresses key risks in the deployment process.

Table 3.3: Assessment of deployment of the PAC model

Note a: The components were drawn from AS ISO/IEC 42001:2023 Information technology — Artificial intelligence — Management system and the Technical standard for government’s use of artificial intelligence.

Source: ANAO analysis.

3.25 IP Australia collects data on the accuracy of PAC classifications, which provides insight into the extent to which AI is involved in classifying patent applications and the accuracy with which this occurs. The ANAO analysed this data and as at November 2025, the model’s classifications are on average 64.7 per cent correct, with 27.5 per cent of its classifications missing and 7.8 per cent of its classifications being incorrect (see Figure 3.3).

Figure 3.3: PAC classification results, December 2022 to November 2025

Source: ANAO analysis of PAC classification data results.

3.26 The accuracy of PAC has remained consistent between December 2022 and November 2025. IP Australia retrains the model annually, which addresses the overall risk that model performance may deviate over time. Monitoring the underlying classification data IP Australia already collects to identify potential patterns may assist in identifying potential misclassification of applications early and improve performance.

4.1 As AI tools are integrated into business processes, entities need mechanisms to monitor whether tools remain fit-for-purpose, risks remain within tolerance and expected benefits are being realised. Monitoring should track operational performance and consider governance compliance, emerging risks and whether oversight bodies receive timely information to support decisions.

4.2 This chapter assesses whether IP Australia is effectively monitoring and reporting on the impact of its use of AI. It examines monitoring and reporting at two levels:

• whether IP Australia monitors, evaluates and reports on AI tools used in the patent rights process in a structured and consistent way; and
• whether IP Australia has enterprise-level arrangements that support strategic oversight of AI adoption, including visibility of risks and benefits realisation.

The ongoing monitoring and evaluation of AI can be improved

Monitoring of AI model performance

4.3 The ANAO examined the monitoring practices for the four AI models in use in the patent rights process. Monitoring processes were inconsistent and varied by tool, however the relevant models have been assessed by IP Australia as low risk use cases. Table 4.1 provides a summary of the ANAO’s assessment.

Table 4.1: Assessment of the monitoring of IP Australia’s AI models

Note a: IP Australia has assessed the four AI tools as low risk. IP Australia requires review of the use case 12 months after the initial risk rating.

Note: This table summarises the ANAO’s assessment of the arrangements in place to monitor AI model operations. The components were informed by AS ISO/IEC 42001:2023 Information technology — Artificial intelligence — Management system, the Technical standard for government’s use of artificial intelligence, and IP Australia policy.

Source: ANAO analysis.

4.4 Regular monitoring of the currency of security controls for AI systems is important to ensure that they continue to remain relevant and effective. The Information Security Manual⁸⁹ identifies ‘continuous cyber security improvement’ as a core principle whereby:

security risk management and associated cyber security activities are continually measured and reviewed using cyber threat intelligence and assurance activities, including exercises informed by real-world cyber threats, to identify, prioritise and incorporate improvements in governance arrangements, shared responsibilities and the effectiveness of controls.⁹⁰

Evaluating the impact of AI tools

4.7 The Commonwealth Evaluation Policy states that entities are expected to deliver support and services for Australians by setting clear objectives for major policies, projects and programs, and consistently measuring progress towards achieving these objectives.⁹¹

4.8 IP Australia has been experimenting with AI since 2018 (see paragraph 2.6). Initially, the impetus to engage with the emerging technology was not specifically about efficiencies but exposing staff to AI and building capability within the agency (see paragraph 1.19). In regard to the four tools tested as part of this audit, IP Australia advised the ANAO on 9 December 2025 that:

when these tools were developed, the common understanding was that any efficiencies realised would be reinvested into the quality of examination … rather than focusing on harvesting time savings, the intent of the tools was to provide better, more relevant information to examiners so that they could make well informed, robust decisions.

4.9 IP Australia operates on a cost-recovery basis, which is a process where the Australian Government charges for the costs of providing a specific government activity to a non-government recipient. Compared to 2018–19, the number of applications for all IP rights⁹² in 2024–25 has increased by 13.5 per cent compared to a 5.2 per cent increase in average staffing levels (see Figure 4.1).

Figure 4.1: Percentage change in all IP rights applications and staffing compared to 2018–19

Source: ANAO analysis of IP Australia’s annual reports and portfolio budget statements from 2018–19 to 2024–25.

4.10 When comparing against the processing times for all IP rights in 2018–19, the average time taken for an IP right to be registered from the date it was lodged increased by 8.9 per cent in 2024–25. Patent processing times took 45.9 per cent longer on average in 2024–25 compared to patents registered in 2018–19. In 2024, IP Australia forecasted that without an increase in patent examination staff the number of patent applications in the examination pipeline would continue to grow until 2030–31.

4.11 IP Australia uses a resource planning and forecasting tool to estimate workload and staffing needs for patent examination which is referred to as the Patents Production Model.⁹³ On 2 December 2025, IP Australia advised that it measures the impact of AI and ADM tools through operational metrics and performance reporting and that any efficiency gains resulting from these tools are reflected through revisions of the Patent Production Model. IP Australia’s analysis, undertaken in December 2024 and March 2026 as part of these processes, indicated that patent assessment quality had been maintained, and patent examiners provided qualitative feedback that AI tools had supported them in undertaking tasks more effectively. While IP Australia has been successful in integrating AI into aspects of the patent rights application process, it has not substantiated a link between the effect of AI tools and changes in the efficiency of patent examination.

4.12 IP Australia has previously expressed an intention to quantify benefits resulting from AI use in the patent examination process. The Cognitive Futures Strategy (refer to paragraphs 2.6 to 2.8) established a project to document benefits profiles for AI tools. Of the four tools tested by the ANAO, three had draft benefits profiles. The tangible benefits that were estimated included savings of average staffing levels and increased quality of searches. The three benefits profiles were not finalised and did not include project costs for comparison to estimated benefits.

4.13 IP Australia introduced a Benefits Management Framework in 2019, and an updated version was endorsed in 2022 to ‘support all IP Australia staff and contractors involved with managing projects and programs and/or tracking/monitoring benefits’.⁹⁴

4.14 IP Australia’s patent rights AI tools are established and integrated into business processes and have scaled beyond pilots and proofs of concept at which benchmarks might be more readily established and comparisons more easily made. There are opportunities for IP Australia to consider how future tools and improvements to existing tools might be aligned with its frameworks to ensure that benefits are measured and realised.

Strategic oversight of AI benefits realisation can be improved

4.16 Section 35 of the Public Governance, Performance and Accountability Act 2013 requires entities to publish a corporate plan. A corporate plan is designed to be an entity’s primary planning document that sets out how the entity undertakes its key activities and how it will measure performance in achieving its purposes.⁹⁵

4.17 Two of IP Australia’s strategic objectives under its Corporate Plan 2025–26 are to:

• increase innovation and adaptiveness in our stewardship of the IP rights system; and
• create innovative contemporary digital and data driven customer services and staff experiences.⁹⁶

4.18 The Corporate Plan states that a significant initiative has been to ‘continue to innovate with AI and Automated Decision Making (ADM) tools in accordance with government requirements for their responsible use, enhancing our efficient and effective administration of the IP system.’⁹⁷

4.19 To manage risks associated with this initiative, IP Australia applies a risk-based governance framework that ‘assesses AI and ADM on a case-by-case basis, managing risks with appropriate guardrails’ so to ensure ‘the ethical and responsible implementation of any AI and ADM tools that deliver tangible benefits’.⁹⁸

4.20 IP Australia has governance committees that have a role in oversight of AI (refer to paragraph 2.66). The Data and Technology Committee’s purpose is to achieve the agency’s strategic objectives, within set risk tolerances, through its governance of ICT, AI, ADM, data and analytics.

4.21 The Data and Technology Committee exercises oversight of IP Australia’s AI and ADM policies, and has a standing agenda item to discuss AI and ADM governance. Committee minutes did not record reviews of endorsed AI or ADM tools or whether they had achieved intended tangible benefits in line with strategic objectives.

4.22 IP Australia’s Benefits Management Framework identifies that benefits must be aligned to its strategic objectives. The framework states that this alignment is necessary so that agency investment decisions are based upon the realisation of benefits that support the delivery of strategic goals.

4.23 Strategic monitoring and reporting of project benefits can support entities in ensuring strategic goals are being achieved through the effective use of resources. Monitoring and reporting should be proportionate to the risk of the project and differentiate between business-as-usual projects and experimentation and novel developments.

Reviews into AI governance are being implemented but are not consistently monitored

4.26 The Commonwealth Evaluation Policy supports entities to improve evaluation practices and capability, with the intent of improving the way entities assess implementation, measure the impact of government programs and activities and frame policy decisions on revised or new programs.⁹⁹

4.27 Between September 2023 and January 2026, IP Australia undertook seven reviews into its governance arrangements related to AI and ADM, with several findings and recommendations for implementation. IP Australia advised the ANAO on 16 April 2026 that ‘where appropriate, recommendations have either been addressed or are being addressed through other relevant strategies or programs of work’. IP Australia has not systematically tracked and monitored these recommendations to inform ongoing continuous improvement of IP Australia’s AI governance.

4.28 IP Australia advised the ANAO on 16 April 2026 that to ensure necessary improvements are being implemented, an external reviewer was engaged in December 2025 to review the current state of its AI and ADM governance arrangements and identify improvements.¹⁰⁰ As at 8 May 2026, the contract for the engagement had been extended from April to June 2026.

Appendix 1 Entity response

Appendix 2 Improvements observed by the ANAO

1. The existence of independent external audit, and the accompanying potential for scrutiny improves performance. Improvements in administrative and management practices usually occur: in anticipation of ANAO audit activity; during an audit engagement; as interim findings are made; and/or after the audit has been completed and formal findings are communicated.

2. The Joint Committee of Public Accounts and Audit (JCPAA) has encouraged the ANAO to consider ways in which the ANAO could capture and describe some of these impacts. The ANAO’s corporate plan states that the ANAO’s annual performance statements will provide a narrative that will consider, amongst other matters, analysis of key improvements made by entities during a performance audit process based on information included in tabled performance audit reports.

3. Performance audits involve close engagement between the ANAO and the audited entity as well as other stakeholders involved in the program or activity being audited. Throughout the audit engagement, the ANAO outlines to the entity the preliminary audit findings, conclusions and potential audit recommendations. This ensures that final recommendations are appropriately targeted and encourages entities to take early remedial action on any identified matters during the course of an audit. Remedial actions entities may take during the audit include:

• strengthening governance arrangements;
• introducing or revising policies, strategies, guidelines or administrative processes; and
• initiating reviews or investigations.

4. In this context, the below actions were observed by the ANAO during the course of the audit. It is not clear whether these actions and/or the timing of these actions were planned in response to proposed or actual audit activity. The ANAO has not sought to obtain assurance over the source of these actions or whether they have been appropriately implemented. During the course of the audit, IP Australia advised that it had:

• endorsed and released an updated ICT Strategy in December 2025, that includes IP Australia’s plan to explore and apply new capabilities such as artificial intelligence;
• commissioned KomplyAI to undertake a review (which commenced in December 2025) of the current state of IP Australia’s AI and ADM governance arrangements and provide recommendations for improvement;
• made changes to the structure of governance committees;
• required all staff to complete the AI in Government Fundamentals course by June 2026; and
• released the IP First Response generative AI chatbot to public trial in April 2026.

Appendix 3 Key Australian Government and Parliamentary AI initiatives

Table A.1: Timeline summary of key Australian Government and Parliamentary initiatives relating to AI since November 2019

Source: ANAO analysis of Australian Government AI information

Appendix 4 Mandatory requirements of the Policy for responsible use of artificial intelligence in government

1. Version 2 of the Policy for the responsible use of AI in government outlines principles and mandatory requirements that entities must follow. The requirements are divided into sections: strategy and oversight, preparedness and operations and AI use case impact assessment.

Note a: Australian Government, Digital Transformation Agency, Policy for the responsible use of AI in government, Appendix C, p. 21, available from https://www.digital.gov.au/ai/ai-in-government-policy, [accessed 8 May 2026].