This is a practical due-diligence checklist for Australian public sector teams evaluating Claude, not a reaction to any specific product announcement; procurement, data residency, and accountability requirements in government differ enough from a typical private-sector buyer that a generic AI vendor evaluation misses genuinely important checks specific to public sector obligations.
The checks that matter more in government than elsewhere
None of this is unique to Claude specifically; the same checklist applies to any AI vendor a public sector team evaluates, and agencies that have already built this diligence process once for a different tool can largely reuse it, adjusting only for vendor-specific answers to each check rather than starting the framework from scratch every time a new tool comes up for evaluation, which is a genuine time saving for agencies evaluating more than one AI vendor over a given year.
A private business evaluating an AI vendor mostly cares about cost, capability, and basic data security; a government agency has all of that plus a layer of procurement and accountability obligations that a private buyer simply doesn't carry, records management requirements under the Archives Act, formal risk assessment frameworks, and public accountability for decisions the AI system informs, even where a human remains formally in the loop.
Data residency and processing location, checked explicitly against your agency's specific requirements, not assumed
Records management: how outputs and decision-support content get captured for archival and FOI purposes
A documented risk assessment against your jurisdiction's AI-in-government framework
Clear internal accountability for any decision the AI system materially informs
Where the diligence gap actually shows up
The gap we see most often isn't a vendor misrepresenting anything, it's an agency assuming a private-sector AI product's default settings and terms automatically satisfy public sector obligations they were never actually built against, and only discovering the gap during an internal audit or a records request months into use, at which point retrofitting proper records capture is considerably more expensive than building it in from the start.
A NSW state agency piloting Claude for internal policy drafting support had assumed the standard business-tier data terms covered their records management obligations under state archives legislation, until an internal audit six months in flagged that draft outputs weren't being captured in a way that satisfied the agency's own retention schedule. Building the proper capture layer retroactively, rather than as part of the original rollout, cost an estimated $22,000 in additional integration work that a diligence check against the archives requirements up front would have caught before the pilot even started.
Working with procurement, not around it
Government procurement processes exist for good reason, and the fastest path to a defensible AI rollout is bringing procurement and records management teams into the evaluation early, not after a pilot's already running informally, since retrofitting formal sign-off onto an existing informal pilot is a harder conversation than getting it right from the start.
Handling the accountability question directly
Public sector use of AI carries a specific accountability question private business mostly doesn't face in the same way: when an AI system materially informs a decision affecting a member of the public, who is accountable for that decision, and can the agency clearly explain the AI's role in it if asked under FOI or in a review. Getting a clear, written answer to that question before a pilot goes live, rather than discovering the gap when a decision is actually challenged, is worth the upfront discomfort of asking it directly.
This is also where a documented, human-in-the-loop design matters practically, not just as a compliance checkbox: a system where a human genuinely reviews and can override the AI's output before a decision is finalised gives the agency a clear, defensible accountability chain that a fully automated decision path simply does not provide, and that distinction is usually the difference between a rollout that survives external scrutiny and one that does not.
What this isn't
This is a due-diligence checklist for the evaluating agency, not a claim about what any specific AI vendor does or doesn't support; every agency's specific jurisdiction and framework differs, and this list is a starting point for your own risk assessment, not a substitute for it.
Automata AI runs AI procurement diligence reviews for Australian public sector teams evaluating Claude or any AI vendor. Get in touch via /contact before your pilot starts, not after your first records audit, and we will work directly with your procurement and records management teams from the outset, translating the vendor terms into a specific answer against your own jurisdiction's framework.
