109 AI Tools, 11% With a Strategy: The Audit Every Council Should Read

In January 2026, the Audit Office of New South Wales published its Local Government 2025 report — the annual health check on the state's 128 councils. Most years it is read by finance teams and quietly filed. This year it contained a section that every council executive in Australia, not just NSW, should sit with: the auditors went looking at how councils are adopting artificial intelligence, and what they found was a sector moving fast with the seatbelt unbuckled.

The headline numbers: 90 NSW councils reported adopting a combined 109 different AI tools, either in pilot or fully implemented, and another half of the sector is considering tools it has not yet deployed. Meanwhile, only 11 per cent of councils have a strategy for AI adoption. Fewer than half have implemented a formal AI policy. And just 10 per cent keep a centralised inventory of the AI tools they are actually running — which means the auditors' own count of 109 tools is almost certainly an undercount, because most councils are not counting.

Adoption is outrunning governance

None of this means councils are wrong to be adopting AI. The report itself records what councils are using it for — productivity, resident support, recruitment, cybersecurity, asset assessment — and these are exactly the places where AI genuinely helps. The problem the Audit Office identified is sequencing: tools are arriving before the governance that should surround them. As the report puts it, fewer than half of councils have integrated "the specific and unique risks" posed by AI into their existing governance frameworks.

There is a name for what fills that gap: shadow AI. When an organisation has no policy, no inventory and no approved pathway, staff do not stop using AI — they use it invisibly, with council data, on personal accounts, beyond any oversight. The councils with the least formal AI adoption are often the ones with the most actual AI use; they just cannot see it. A formal policy and an approved toolset is not a brake on adoption. It is how you make adoption visible, safe and defensible.

The 30 June deadline

The report makes two recommendations, and both carry the same date. The Department of Planning, Housing and Infrastructure — which houses the Office of Local Government — is asked to establish a mandatory framework for responsible AI implementation by councils, drawing on the existing Australian and NSW government frameworks, by 30 June 2026. And councils themselves are asked to review their AI readiness — governance arrangements in place, an integrated AI strategy developed — by the same date.

That deadline is now weeks away. Whether the mandatory framework lands on time or not, the direction is unambiguous: the era in which a council could adopt AI tools without an AI policy is ending in NSW. And councils elsewhere should not read the state border as a firewall. Audit offices talk to each other, and the underlying conditions — rapid adoption, thin governance — are the same in every state. Victorian, Queensland, South Australian, Tasmanian and WA councils should treat this report as a preview of their own next performance audit.

What good looks like

The encouraging part of the report is how achievable its expectations are. Nothing in it demands a data science team or a seven-figure budget. It asks for things any well-run council can stand up in a quarter: a current inventory of every AI tool in use, including the ones embedded inside existing software; a formal AI policy that tells staff what is approved, what is prohibited, and where the boundaries sit; an adoption strategy that ties AI investment to actual service priorities rather than novelty; and AI risk folded into the existing risk, procurement and IT governance machinery — not bolted on beside it.

Procurement deserves particular attention, because for most councils AI arrives through vendors, not in-house builds. Every AI procurement is a governance decision. Where does the data live, and does it stay in Australia? Is every interaction logged, transcribed and auditable? Can the system explain what it did on any given call, case or decision? What happens when it does not know the answer? Vendors who are confident in their product will answer these questions in writing. Vendors who change the subject are telling you something too. We say this self-interestedly — Cassie answers calls for Australian councils, and we would far rather sell into a sector that asks hard questions than one that does not — but the point stands regardless of whose product is on the table.

Governance is the licence for ambition

It would be easy to read this audit as a caution against moving fast. It is closer to the opposite. The councils that will adopt AI most aggressively over the next five years — and capture the most value from it — are the ones whose communities, councillors and auditors trust how they are doing it. Governance is not the alternative to ambition; it is the licence for it. The report's real message is that the sector has been granted a window to get its house in order while AI adoption is still early. Councils that use the window will be able to say yes to far more, far faster, than councils that spend the next audit cycle explaining why nobody knew which AI tools were running.