NSW requires lifecycle registration while preserving assessment during platform transition

For a state CIO, risk office, agency leaders and procurement, the problem is maintaining visibility while AI features and governance systems change. Ask which systems escape intake, who knows when suppliers change models, and how exceptions are tracked. A bounded engagement could reconcile one agency's software and workflow inventory with its assessment records. The value hypothesis is a more complete, reviewable portfolio and less effort reconstructing decisions. This circular supports a governance conversation, not a guaranteed compliance result or demand forecast. Confirm local legal obligations and operating capacity before adapting any NSW requirement.

Fit is a governance integration pattern across inventory, intake, contracts and change management. Establish stable identifiers, source-system mappings, access controls and an auditable migration plan. Prerequisites include a local definition of AI use, accountable data owners and an approved risk process. Test whether a newly enabled embedded feature enters the register and whether a model, connector or data change triggers review. A proposed proof should reconcile sampled live systems to retained assessments and resolve missing histories. Deployment architecture remains a local decision; the circular does not validate a specific cloud, on-premises or hybrid implementation.

Name an agency portfolio owner and assign evidence maintenance to service owners, with security, procurement and workforce support. Reconcile existing records, migrate a small sample, train staff and run old and new processes until completeness is verified.

Proposed acceptance criteria

every sampled use has an owner, risk disposition and linked change history; no assessment evidence is lost; a simulated supplier change reaches the correct reviewer. Schedule recurring checks and executive exception review. These criteria are recommendations, not reported NSW results. Risks include incomplete intake, duplicate records and treating a future reporting date as permission to defer current controls.