AI Survey Agents for Government: The Procurement and Privacy Questions Buyers Actually Ask
Short answer: Evaluating an AI agent for citizen surveys is not a sales-tool evaluation. As at 26 August 2026, Australian Government agencies — specifically non-corporate Commonwealth entities — must apply the DTA’s Policy for the responsible use of AI in government (Version 2.0), and a survey agent phoning citizens is almost certainly an in-scope AI use case needing a documented impact assessment. Privacy, disclosure, accessibility, records and hosting all attach before procurement starts.
Our post on AI survey agents for government and councils covered what the technology does at scale. This is the companion for whoever signs the paperwork: what decides whether a deployment is allowed, not whether it is useful.
The rules that apply, as at August 2026
The controlling document is the Digital Transformation Agency’s Policy for the responsible use of AI in government, currently Version 2.0, effective 15 December 2025, replacing v1.1 which took effect 1 September 2024. Its implementation page says it applies to all non-corporate Commonwealth entities under the Public Governance, Performance and Accountability Act 2013, and carves out defence and the national intelligence community.
Deadlines are staged. Under strategy and oversight, agencies must designate an accountable use case owner per in-scope use case and stand up an internal register within twelve months of the policy taking effect (December 2026). The impact assessment section adds one more: existing unassessed use cases must be scoped and all relevant actions applied by 30 April 2027.
A citizen survey agent is almost certainly in scope
Appendix C sets the criteria, and an agent that rings residents hits two. The DTA’s appendices page lists: “It is possible the public will directly interact with, or be significantly impacted by, the AI or its outputs without human review” and “The AI is designed to use personal or sensitive data or security classified information”.
In-scope means running an AI use case impact assessment, commenced at design stage and finalised before deployment, using either the Australian Government AI impact assessment tool or an internal process integrating its provisions. That starts before you shortlist.
The national assurance framework is still live
The National framework for the assurance of artificial intelligence in government is still published by the Department of Finance, which records it as agreed and released by the Data and Digital Ministers Meeting on 21 June 2024, and stamps the page “Updated: 24 February 2026”.
Privacy: the APPs, the Privacy Code, and the PIA
Three things bite here, often conflated. First, the APPs. The DTA’s guidance for the AI impact assessment tool notes they “apply to personal information inputted into an AI system, as well as the output generated or inferred by an AI system that contains personal information”, and works through APP 1, 3, 5, 6, 10 and 11.
Second, secondary purpose. OAIC guidance on conducting surveys explains that client surveys often constitute a secondary purpose, permitted under APP 6.2(a) where related to the primary purpose and “the use or disclosure would be within the individual’s reasonable expectations”. A satisfaction survey after a service interaction usually clears that bar. A consultation call to a list collected for an unrelated programme may not.
Third, the PIA. The OAIC says the Australian Government Agencies Privacy Code, a binding legislative instrument commenced 1 July 2018, requires agencies to “undertake a written Privacy Impact Assessment (PIA) for all ‘high privacy risk’ projects or initiatives that involve new or changed ways of handling personal information”, keep a register of all PIAs and publish it. The PIA and the AI impact assessment are two documents, not one, and the register is public.
Procurement: what we could and could not confirm
The Commonwealth Procurement Rules apply, current version dated 17 November 2025. The DTA announced on 2 December 2025 that it had also released Guidance on AI procurement in government, which the policy’s preparedness and operations section lists under recommended actions — “strongly recommended”, not mandatory. (It sits on BuyICT behind a JavaScript portal, so we have not quoted from it.)
BuyICT still exists: buyict.gov.au is live, and the DTA’s BuyICT page (updated 5 November 2025) lists six whole-of-government arrangements: Cloud Marketplace Panel (SON3668352), Data Centre Panel 3 (SON3945937), Digital Marketplace Panel 2 (SON4102906), Hardware Marketplace Panel (SON3541738), Software and ERP Marketplace Panel (SON3490955) and Telecommunications Marketplace Panel (SON3713272).
Being plain about the limit: none of those six is AI-specific, and we could not confirm from a primary DTA source that a whole-of-government AI panel exists as at 26 August 2026. Secondary reporting suggests AI subcategories are being added inside existing panels, but that could not be verified on a DTA or BuyICT page, so ask the DTA rather than assuming. In practice a survey agent is bought as software or a cloud service, or by open or limited tender. The obligations attach either way.
The question set
| Buyer concern | Question to ask the vendor | What a good answer looks like |
|---|---|---|
| Privacy | Which APPs did you design against, and what do you need from us for our PIA and AI impact assessment? | They name APP 5, 6, 10 and 11 unprompted, offer a data-flow diagram for your PIA, and ask your primary purpose. |
| Disclosure | Where in the call does the agent say it is an AI, and can we set that wording? | In the opening seconds, agency-editable, surviving interruption and callback. Not buried in a privacy notice. |
| Accessibility and language access | How does this meet WCAG, and what happens for a resident needing another language or an interpreter? | Named language coverage, a human or interpreter fallback, accessibility written into the contract. |
| Records and FOI | Can we export every transcript, prompt, input and output into our recordkeeping system for FOI? | Full export in an open format, agency-set retention, no vendor-side deletion clock. |
| Data residency | Where is data stored and processed, including by sub-processors and model providers? | Named regions and sub-processors, contractual restriction on movement, onshore or on-premise if classification demands. |
| Escalation | What triggers a handover, and what does the resident hear while it happens? | Defined triggers including any request for a person, warm transfer carrying context, logged reason per escalation. |
Four things that decide whether it works
Disclosure. The DTA’s Standard for AI transparency statements requires agencies to publish, at minimum, a “classification of use where the public may directly interact with, or be significantly impacted by, AI or its outputs without human review”, and to send the DTA a link at [email protected] whenever the statement is published or updated. The policy’s strategy and oversight section adds that the statement “must be reviewed and updated annually or sooner”. A survey agent belongs in that statement, and on the call.
Accessibility and language access. Criterion 4 of the DTA’s Digital Inclusion Standard requires compliance with the Disability Discrimination Act 1992, the latest Web Content Accessibility Guidelines and the Australian Government Style Manual, and advises agencies to “Offer multilingual support to cater to a diverse range of users” and include accessibility requirements in procurement.
Opt-out and escalation. Nothing in the policy removes a resident’s right to decline, and any request for a person should be an immediate escalation, not a fallback after three failed intents.
Records, FOI and residency. The National Archives’ advice on records created using AI technologies, dated January 2025, states that “AI generated content created or received by Australian Government agencies constitutes Commonwealth records for the purposes of the Archives Act 1983 and must be managed as such”, and counts prompts and inputs among them. On residency, the Hosting Certification Framework requires sensitive government data and systems rated PROTECTED to use certified services, but check that premise: its own site states the framework “is currently undergoing reform” and that certification registration for prospective providers was paused effective 3 November 2025, though certified providers are unaffected. Our post on AI agent data sovereignty in Australia goes deeper.
Where Zian fits
Government Survey Agent is one of Zian AI’s listed niched agents, alongside Local Council and Building Planning. The platform runs live phone, SMS, email and WhatsApp outreach in 30+ languages, integrates with CRMs via native connectors, API and Zapier, and supports private model deployment on customer infrastructure, which is the option that matters when hosting is the blocker.
What we will not claim: Zian has no announced Australian Government customers, no Hosting Certification Framework certification we can point you to, and is in waitlist and partnership beta, not general availability. If your procurement requires a certified provider today, say so early and we will tell you plainly whether we can meet that.
FAQ
Do we need a PIA as well as an AI impact assessment?
Almost certainly yes, and they are separate documents. The OAIC states the Australian Government Agencies Privacy Code requires a written PIA for all high privacy risk projects involving new or changed handling of personal information, plus a published register.
Can we survey people whose details we collected for something else?
Sometimes. The OAIC’s guidance on conducting surveys points to APP 6.2(a): a secondary use is permitted where related to the primary purpose and within the individual’s reasonable expectations, assessed case by case.
Is there a whole-of-government AI panel we should buy from?
We could not confirm one. As at 26 August 2026 the DTA’s BuyICT page lists six whole-of-government arrangements covering cloud, data centres, digital services, hardware, software and ERP, and telecommunications. None is AI-specific. Confirm with the DTA before assuming a panel route.
Who is accountable if the agent gets something wrong?
The agency. The policy assigns an accountable official for implementation and an accountable use case owner per in-scope use case, and requires high-risk use cases to be reported to the DTA and reviewed at least annually. Vendor contracts do not transfer that accountability.
Talk to us
Scoping a citizen-outreach agent and want a vendor that answers the assurance questions rather than deflecting them? Apply For Partnership at https://zian.ai/#waitlist.