Six Practices Replaced Ten Guardrails. Remap Now.

Ten guardrails became six practices. The renumbering landed on 21 October 2025, and a control matrix, board paper or internal audit programme written in late 2024 still cites Guardrail 1 to 10 as though that numbering were current.

The bottom line up front. A control keyed to a guardrail number now points at a superseded reference, the correction is a clause-level remap taken from the official crosswalk published inside the guidance itself, and it is worth finishing before 10 December 2026, about seven weeks from 21 October 2026, when a separate and binding Privacy Act obligation lands on the same register the remap touches.

The change is stated on the old standard's own page. The Voluntary AI Safety Standard publication page, published by the Department of Industry, Science and Resources through the National AI Centre and dated 5 September 2024, carries this update: "On 21 October 2025, we published the Guidance for AI Adoption, which outlines 6 essential practices for safe and responsible AI governance. This updated and simplified guidance for industry evolves the Voluntary AI Safety Standard."

The department's word is evolves. No source says the standard has been withdrawn, repealed or archived, and both of its pages returned content when they were last checked for this piece on 26 September 2026.

This is general information and education, not legal, compliance or financial advice.

What the department changed, in its own words

The guidance describes its own edit under the heading "How we developed the guidance". The implementation guidance published by the National AI Centre records that the update "condensed 10 guardrails into 6 essential practices", removed redundant language, and widened the audience to organisations that build AI systems as well as those that deploy them. The file on ai.gov.au was published on 5 May 2026 and carries the October 2025 edition, as at 26 September 2026.

The same document tells a former adopter where to go, using its own abbreviation for the Voluntary AI Safety Standard (VAISS): "For organisations that used the VAISS, all practices have now been integrated into the Implementation practices. Please refer to the VAISS x Implementation practices crosswalk." That crosswalk is Appendix 2, headed Crosswalk VAISS x Guidance for AI adoption: Implementation practices, beginning at printed page 30 of the same file.

Read that as an instruction rather than a courtesy. A crosswalk built from intuition is now a departure from an available source.

Why does nothing in your control matrix fail visibly?

Because the superseded numbering still renders, and no control matrix checks its references against their source.

The 10 guardrails page still instructs the reader that "To completely adopt the standard, your organisation will need to adopt all 10 guardrails", and still sets out ten numbered headings in order, running in summary from 1 accountability process through to 10 stakeholder engagement. The page carries the same update banner above the guardrails, but the guardrail sections themselves carry no caveat. An audit test written as evidence against Guardrail 4 still finds its guardrail, still collects its evidence, and still passes. The defect sits in the citation, not in the control, and it holds whether or not the old page is still served tomorrow.

That matters most where the citation travels outward. ASIC's REP 798 Beware the gap: Governance arrangements in the face of AI innovation, released on 29 October 2024 following a review of 23 Australian Financial Services (AFS) licensees and credit licensees, states: "We support the Australian Government's Voluntary AI Safety Standard and intention to introduce mandatory guardrails ensuring testing, transparency and accountability for AI in high-risk settings." A board paper citing the guardrails and REP 798 alongside them cites a chain with one superseded link.

That quotation is from October 2024 and shows only what regulator material of that period was keyed to, not the current position on mandatory guardrails.

The same correction applies to this site. TheAICommand's earlier piece on turning the voluntary AI guardrails into audit evidence is written against the ten-guardrail framing, so its translation layer now points at a superseded structure, even though it cites no guardrail by number. Correcting a live piece in the open is cheaper than leaving a reader to find the numbering elsewhere.

Scope it before solving it. The first prompt finds every place the old numbering is written down.

You are helping [ORGANISATION] scope a reference update. Use only the documents attached to this message. Do not use outside knowledge, and do not rewrite anything.

Attached are governance documents from [BUSINESS_UNIT] with names and personal details removed. They include the AI policy, the current control matrix, the most recent board paper on AI, and the internal audit programme.

Task: list every place these documents refer to the Voluntary AI Safety Standard, to a guardrail by number, or to a set of ten guardrails.

Return one markdown table with these columns: document name, section or clause, the exact wording as it appears, reference type (standard named / guardrail number / ten-guardrail framing), and whether the surrounding sentence would still read correctly if the reference were replaced.

Rules: quote the wording exactly and never paraphrase it. Do not propose replacement text. If a document contains no such reference, list it with the word none. Finish with a count of documents reviewed and references found.

What to check: run a negative control. Before you read the output, write down one reference you already know exists, then confirm it appears in the table with its wording intact. If a reference you knew about is missing, the count at the end describes the documents the model attended to rather than those you attached, and the sweep has to be rerun in smaller batches.

The crosswalk is clause level, and it is many to many

The instinct is to assume ten items were merged into six, pair by pair, and that the pairs can be reconstructed. The published mapping does not work that way.

Appendix 2 maps Voluntary AI Safety Standard clauses onto implementation practice clauses. Four rows, read from the October 2025 edition, show the shapes a remap has to handle.

The dash in that last entry is reproduced here as a hyphen to suit house style.

None of that survives a find and replace. A control written against guardrail 3 does not become a control against practice 3. Where the target is a named section rather than a clause, the honest entry in the row is no resolvable target, escalated, not a number somebody has supplied for it.

There is a harder case, and it is the strongest argument in this piece for keeping a person at the decision point. Several rows in Appendix 2 point at targets that do not appear as numbered clauses in the body of the same document, among them 2.4.2, 4.5.1, 4.5.2, 4.5.4 and 4.6.1. Two of those targets belong to rows VAISS 7.1.5, which maps to "2.4.2", and VAISS 9.2.4, which maps to "4.5.1". The numbered sections of the guidance run 1.1 to 1.4, 2.1 to 2.3, 3.1 to 3.4, 4.1 to 4.4, 5.1 to 5.4 and 6.1 to 6.2, so practice 2 ends at 2.3 and practice 4 ends at 4.4, and those targets sit past the end of their own practice.

The two published forms of the guidance also number differently. Under heading 4.2 the PDF numbers its clauses 4.1.2 to 4.1.7 and the web version numbers the same six 4.2.1 to 4.2.6, so a target can resolve in one form and not the other. Record which form the crosswalk was built from and hold to it.

That was checked clause by clause against the October 2025 edition of the file, read on 26 September 2026. Treat the list as a floor: test every target against those ranges, then look it up in the numbered body, because a valid section number does not prove the clause exists.

Asked to complete the mapping, a model is likely to return a plausible target rather than stop at a gap in a government appendix. A person has to write no resolvable target, escalated, into the row, or the remap will look finished and be wrong in exactly the places that matter.

Which tier does each AI use case sit in?

Both tiers carry all six practices. The tier decides the depth and the audience, not the list.

Guidance for AI adoption: foundations, from the National AI Centre, tells the reader to "Work through all 6 essential practices to establish a strong baseline for responsible AI use", and addresses organisations starting to use AI or using AI in low-risk ways. Guidance for AI adoption: implementation guidance tells the reader to "Work through all 6 essential practices to strengthen governance, manage risk and maintain human oversight", and addresses organisations that build or customise AI systems, or that manage higher-risk use cases.

One structural difference decides how a control matrix cites each tier. The implementation tier is numbered, from 1.1 through to 6.2, and those numbers are what Appendix 2 points at. The foundations tier is written as getting started and next steps, so there is nothing in it to cite the way a control matrix cites a clause. A foundations-tier use case is referenced by practice rather than by clause, and evidenced at a lighter depth.

A crosswalk built from the two tiers will also miss a third document. The Essential AI practices hub lists three components: the foundations, the implementation guidance, and a separate guide on being clear about AI-generated content. The third sits outside the numbered six, so disclosure controls for AI-generated material need a row of their own.

The tier decision needs somewhere to live. The AI systems register page states the purpose plainly: "When team members, stakeholders or auditors need to know what AI systems exist in your organisation, the AI register provides clear answers." Word and Excel templates are published there, dated 22 April 2026 as at 26 September 2026. The same page warns that a register "should not replace more in-depth governance activities such as impact assessments and risk management". Treat the tier column as routing, not as an assessment.

How do you rebuild the crosswalk without inventing a mapping?

By grounding the work in two documents and nothing else, and by naming the person who signs the rows the documents cannot settle.

TheAICommand works to the Verified Draft Method: de-identify the inputs, ground the model in your own source material, keep a person at the decision point, verify against the primary source, and log what happened.

You are helping [ORGANISATION] remap an AI control matrix. Use only the two attachments and the clause ranges below. Do not use outside knowledge.

Attachment A: control matrix rows from [BUSINESS_UNIT], de-identified, each carrying a control reference, the control description, and the Voluntary AI Safety Standard clause the control was written against.
Attachment B: Appendix 2 of the Guidance for AI adoption implementation guidance, the crosswalk from Voluntary AI Safety Standard clauses to implementation practice clauses. Attach the file rather than pasting the table, so the row pairing survives.

Valid clause numbers in the guidance body are 1.1 to 1.4, 2.1 to 2.3, 3.1 to 3.4, 4.1 to 4.4, 5.1 to 5.4 and 6.1 to 6.2, with sub-clauses and letters beneath them.

Attachment B and those ranges come from one published form of the guidance. The PDF and the web version number the clauses under heading 4.2 differently, the PDF as 4.1.2 to 4.1.7 and the web version as 4.2.1 to 4.2.6. Name at the top of your output which form Attachment B came from, and never convert a target from one form to the other.

Task: produce three outputs.

1. A mapping table with these columns: control reference, control description, Voluntary AI Safety Standard clause, Appendix 2 target exactly as written in Attachment B, practice number, owner ([CONTROL_OWNER]), evidence the control produces, review date ([REVIEW_DATE]).
2. Exception list A: every control whose clause has no row in Attachment B.
3. Exception list B: every target clause in Attachment B that no control maps to. Attachment A is a filtered extract, so this is a list of candidate gaps to test against the full control matrix, not a gap count.

Rules: quote each target exactly as Attachment B writes it, including letters and multiple targets. Never infer a target that is not in Attachment B; write "no row in Appendix 2" instead. Write FLAG in any row whose Appendix 2 target falls outside the valid clause ranges above, or names a section instead of a clause, and add the words "no resolvable target, escalated", and write none in the practice number column. Use [SYSTEM_NAME] and [AI_REGISTER_ID] wherever a system would otherwise be named. Finish with three counts: controls in, controls mapped, controls in exception list A.

What to check: two checks in this order, then a caution. Spot check three target clauses against Appendix 2 by eye, comparing the clause numbers and letters character for character, including the letter in a target such as 5.4.1 a, and reject the whole output if one is wrong. Punctuation inside a prose target is not the test. Then reconcile the arithmetic, because controls in must equal controls mapped plus exception list A. A model that quietly drops a row it could not map passes the first check and fails the second, which is why the second is not optional.

The tier allocation is a separate prompt, because it is a separate kind of judgement and it ends with a person.

You are helping [ORGANISATION] allocate one AI use case to a guidance tier. Use only the text in this message.

Use case, de-identified: [SYSTEM_NAME] in [BUSINESS_UNIT] does the following. [Describe the task, the classes of data involved with no personal details, who relies on the output, and what happens when the output is wrong.]

Audience test, foundations tier, quoted from the guidance: organisations starting to use AI, or using AI in low-risk ways.
Audience test, implementation tier, quoted from the guidance: organisations that build or customise AI systems, or manage higher-risk use cases.

Task: write a recommendation, not a decision, for [CONTROL_OWNER] to accept or reject.

Structure: the recommended tier; the words from the audience test that support it, quoted; the reasons against that tier, stated as plainly as the reasons for it; what further information would change the recommendation; and a final line reading "Decision made by: ____ Date: ____".

Rules: quote the audience tests and do not paraphrase them. Do not state as a finding that the use case is low risk or high risk. Do not recommend controls. If the description is too thin to support a recommendation, say so and list what is missing.

What to check: that the recommendation quotes the audience test rather than paraphrasing it, and that the reasons against are specific to this use case. A paraphrased test is the tell that the model is reasoning from its own notion of risk rather than the guidance it was handed. Then check that a name and a date sit on that final line before the allocation reaches [BOARD_COMMITTEE] or the register.

What lands on the same register on 10 December 2026?

An obligation with a fixed date, no relationship to the six practices, and the same artefact underneath it.

The Office of the Australian Information Commissioner set out the obligation while consulting on guidance for it. The page "Consultation on Guidance for Transparency in Automated Decision Making", published 18 May 2026, records it: "From 10 December 2026, APP entities that use personal information in ADM with the potential to affect rights or interests will be required to provide information in their privacy policies about the kinds of personal information used and the kinds of decisions made using ADM." Submissions on that draft guidance closed on Monday 15 June 2026.

The date is fixed in statute rather than in guidance. The endnotes to the Privacy Act 1988 (Cth), Compilation No. 104, compilation date 4 June 2026, the current compilation when it was checked for this piece on 26 September 2026, record that Schedule 1 items 87 to 89 of the Privacy and Other Legislation Amendment Act 2024 (No. 128, 2024) commence "10 Dec 2026 (s 2(1) item7)". The same compilation warns that "The effect of uncommenced amendments is not shown in the text of the compiled law", so reading the current section text will not show a practitioner the obligation. On 21 October 2026 the commencement is about seven weeks away.

Be precise about the connection, because overstating it is the easy error. Automated decision-making transparency is not a requirement of the six essential practices, and the practices are voluntary guidance rather than law. The link is operational. The question of which systems use personal information in automated decision making with the potential to affect rights or interests is answered from the same inventory that carries the tier column. Building that inventory twice, once for a voluntary framework and once for a statutory obligation, is the waste worth avoiding while the register is open.

Do this Monday

The artefact is the AI control crosswalk, version 1: a single table kept beside the control matrix rather than inside it, so it can be reviewed in its own right.

The owner is the person accountable for AI governance under practice 1 or, where no such role exists, the risk owner who signs the control matrix. The reviewer is the internal audit lead. Tier allocations are accepted or rejected by [CONTROL_OWNER] for the business unit, and reported to [BOARD_COMMITTEE].

The columns, and three rows showing the shapes to expect:

The first hour, in four steps:

1. attach the AI policy, the current control matrix, the most recent board paper on AI and the internal audit programme, with names and system identifiers removed, and run the sweep prompt across all four;
2. filter the control matrix to the rows the sweep returned, and export them de-identified;
3. download the implementation guidance file from ai.gov.au and open Appendix 2 at printed page 30; and
4. attach that file as Attachment B, paste the exported rows as Attachment A, run the crosswalk prompt, and copy each practice name from the guidance beside its number as you go.

Same day, one more step: add a column headed Tier to the AI systems register, run the tier prompt on its top three use cases, and record the recommended tier, the [CONTROL_OWNER] it goes to and the date it was sent, leaving the decision line blank until it is accepted.

Where a tool will not accept a file that size, copy the appendix pages into a spreadsheet and attach that, because pasting Appendix 2 into a chat box destroys the row pairing.

The check that proves it worked has four parts. Every row carries either a target quoted exactly from Appendix 2 or the words no row in Appendix 2, with nothing invented between those two options. Controls in equals controls mapped plus exception list A. Every row whose target falls outside 1.1 to 1.4, 2.1 to 2.3, 3.1 to 3.4, 4.1 to 4.4, 5.1 to 5.4 or 6.1 to 6.2 carries FLAG and the words no resolvable target, escalated, because Appendix 2 carries targets past the end of their own practice. Every target inside those ranges has been looked up in the numbered body, because the ranges are a floor and not the test. A control written against VAISS 7.1.5 or 9.2.4 that comes back unflagged is a sign the gap was filled for you. And every register row carries either a tier with a name and a date beside it, or a place on a named list still to be allocated.

Set [REVIEW_DATE] before closing the file, and re-read the source then. The file carrying the October 2025 edition is dated 5 May 2026 on ai.gov.au, which is the ordinary way a quoted clause number goes stale without anybody being told.

The bottom line

Six essential practices published on 21 October 2025 superseded the ten guardrails as the current Australian AI governance reference, and the department frames that as evolving the standard rather than withdrawing it, so nothing in a control matrix breaks loudly. The remap is clause level, many to many, and published in Appendix 2, which makes an intuition-built crosswalk a departure from an available source. Several of the appendix's own targets do not resolve to a clause in the guidance body, so a model asked to finish the mapping is likely to invent the ending unless a named person owns the gaps. Rebuild the crosswalk, record a tier against every register entry, and do it before the Privacy Act commencement on 10 December 2026, about seven weeks from 21 October 2026.