Broad, all roles
AI Ethics & Governance
7 min read
From principles to practice: mapping the six practices to the eight principles
GP
Guru Prasad, Founder, AAAI. Published 21 September 2026.
In October 2025 the National AI Centre published the Guidance for AI Adoption, six essential practices that turn Australia's eight AI Ethics Principles, released in 2019, into things an organisation can actually do. No practice maps to exactly one principle, and no principle is covered by exactly one practice. An organisation that can only quote the principles has nothing to show a regulator, a customer or a board asking how those principles are applied day to day.
In brief
- The National AI Centre's Guidance for AI Adoption (21 October 2025) operationalises Australia's eight AI Ethics Principles (2019). It builds on and stays aligned with them, it does not replace them.
- Some practices support several principles at once. Measure and manage risks touches Reliability and Safety, Privacy Protection and Security and Fairness. Maintain human control touches Accountability, Contestability and Human Centred Values.
- Two principles, Fairness and Privacy Protection and Security, have no single dedicated practice. They are only covered when the other practices are carried out properly, which is the strongest argument for adopting all six rather than picking favourites.
Plain English
Australia's AI Ethics Principles are eight voluntary statements, released in November 2019 by the then Department of Industry, Science and Resources, describing what responsible AI use looks like: wellbeing, human centred values, fairness, privacy protection and security, reliability and safety, transparency and explainability, contestability, and accountability. The Guidance for AI Adoption is the National AI Centre's October 2025 update to its earlier Voluntary AI Safety Standard, restating that standard's ten guardrails as six essential practices: decide who is accountable, understand impacts and plan accordingly, measure and manage risks, share essential information, test and monitor, and maintain human control. To operationalise a principle means turning a values statement into a repeatable process a team actually follows, with a named owner, a record and a way to check it happened.
Australian context
The National AI Centre, part of the Department of Industry, Science and Resources, published the Guidance for AI Adoption on 21 October 2025, describing it as building on and remaining aligned with the AI Ethics Principles released on 7 November 2019, not replacing them. The table below sets out how each essential practice maps to the principles it puts into practice.
| Essential practice |
Principle(s) it operationalises |
| 1. Decide who is accountable |
Accountability directly. Also supports Human Centred Values by giving people a name to hold responsible. |
| 2. Understand impacts and plan accordingly |
Human, Societal and Environmental Wellbeing directly. Also supports Fairness by requiring an assessment of who is affected and how. |
| 3. Measure and manage risks |
Reliability and Safety directly. Also supports Privacy Protection and Security and Fairness, since risk registers are where those two show up in practice. |
| 4. Share essential information |
Transparency and Explainability directly. Also supports Contestability, since people cannot challenge a decision they were never told about. |
| 5. Test and monitor |
Reliability and Safety directly, on an ongoing basis rather than once. Also supports Privacy Protection and Security through continued security testing. |
| 6. Maintain human control |
Accountability and Contestability directly. Also supports Human Centred Values by keeping a person, not just a system, in the decision. |
Fairness and Privacy Protection and Security do not have a practice of their own. They only show up properly when practices 2, 3 and 5 are done well, which is the practical case for treating the six practices as one system rather than a checklist to pick from.
Sources: National AI Centre, Guidance for AI Adoption, October 2025; Department of Industry, Science and Resources, Australia's AI Ethics Principles, 2019.
The risk and the opportunity
An organisation that publishes the eight principles on an internal wiki and stops there has adopted nothing. Picture a mid sized consultancy that added a page titled "Our AI Ethics" to its website in 2023 and has not touched an AI governance document since. When a client asks who signed off on the AI tool used to shortlist job applicants, or how a rejected candidate can contest the outcome, there is no accountable owner, no risk register and no complaints path. The principles were quoted, none of the six practices exist behind them. That gap is exactly what a regulator, an auditor or a customer will test for, and it stays invisible until someone asks.
Compare that with an organisation that has named an accountable owner for each AI system in use, documented who those systems affect and how, logged and reviewed the risks at a cadence that matches how sensitive the system is, told affected people when AI is part of a decision about them, and kept a human able to override the outcome. That organisation is not just safer, it can answer every question above in minutes, because the eight principles are no longer a statement of intent, they describe a process that already runs. The six practices are the difference between an ethics policy and an ethics system.
A four-step coverage check
List every AI system in use and name who is accountable for each one.This is practice 1, and it is the one nothing else works without.
Write down who each system affects and what could go wrong for them, not just for the organisation.This is practice 2, and it is where Fairness gets tested.
Set a risk review cadence proportional to how sensitive the system is, and test it before and after deployment.This is practices 3 and 5 together.
Confirm two things exist for every system: a way to tell affected people AI was involved, and a way for a human to review or override the outcome.This is practices 4 and 6 together.
What this means for you
Practitioners
You are usually the one who sees practice 4 (share essential information) and practice 6 (maintain human control) fail first, because you are the one fielding the question from an affected person.
Do this: for every AI assisted process you run, know who the accountable owner is and how someone can ask for human review.
Directors and delivery leads
Deciding who is accountable and measuring and managing risks are governance decisions, not technical ones, and they sit with you.
Do this: ask for a one page register of every AI system in use, its accountable owner and its last risk review date, before the next board or leadership cycle.
CIOs and CEOs
The gap between principles and practices is a legal and reputational exposure, not only an operational one, particularly once the mandatory AI Standards flagged for early 2027 arrive expecting documented practices rather than policy statements.
Do this: commission the four-step coverage check above across your highest risk AI systems this quarter, not after legislation forces it.
Frequently asked
Do the six essential practices replace the eight AI Ethics Principles?
No. The National AI Centre describes the Guidance for AI Adoption as building on and remaining aligned with the AI Ethics Principles, not superseding them. The principles state the values, the practices are how an organisation puts those values into effect.
Is every practice tied to exactly one principle?
No. Several practices support more than one principle, and two principles, Fairness and Privacy Protection and Security, are not the direct focus of any single practice. They are covered only when the practices that touch them, mainly understand impacts and plan accordingly, measure and manage risks, and test and monitor, are carried out properly.
Are the six essential practices mandatory?
Not currently. Like the AI Ethics Principles, they are voluntary guidance from the National AI Centre. Separate mandatory AI Standards were announced in July 2026, with legislation expected in early 2027. Organisations that have already adopted the six practices will have most of the groundwork done before that becomes a compliance requirement.
Mapping principles to practices is groundwork every organisation using AI needs, regardless of sector. AAAI's certifications build the accountable-owner, risk-register and human-control skills this mapping calls for, from a foundational grounding through to a flagship credential for people leading AI governance.
Explore AI Core
Explore CAIS
