Last Updated: May 2026 · By Ehtisham Saeed, RTO Marketing Specialist
AI in an RTO is not a tools decision. It is a governance decision that happens to use tools.
Across the Australian VET sector right now, two failure modes are running in parallel. One group of RTOs has banned AI entirely and is losing time to manual tasks competitors have automated. Another group has let AI run unchecked through admin, marketing, and content development without policy, audit trail, or risk review. Both are wrong. Both are exposed.
The Australian Skills Quality Authority (ASQA) released draft AI Principles for RTOs in March 2026 and is running sector workshops through April and May 2026. The Standards for RTOs 2025, in effect since 1 July 2025, demand outcome-based quality and continuous self-assurance. AI sits squarely inside both regulatory frames, but the official guidance is still emerging. The right move for an RTO right now is to adopt AI on a governed plan that anticipates where the regulator is heading, not wait for prescriptive rules that will not arrive until late 2026 at the earliest.
This guide walks through a 90-day plan that gets an Australian RTO from zero (or chaos) to governed, productive AI use, structured to satisfy the 2025 Standards, the Privacy Act 1988, the Australian Framework for Generative AI in Schools, and the draft ASQA AI Principles. This is the technical anchor of the AI for RTO operations cluster.
Why an AI Adoption Plan Matters Now
Three pressures converge in 2026 to make a documented AI adoption plan a non-negotiable rather than a nice-to-have.
For a beginner: AI is a category of tools (ChatGPT, Claude, Microsoft Copilot, Gemini, and a long list of specialised products) that can generate text, summarise documents, answer questions, and process data. The plan exists because using these tools well needs structure that most RTOs do not yet have.
For an intermediate operator: the Standards for RTOs 2025 reframed the regulatory question from “did you have a policy?” to “can you demonstrate the outcome and the evidence trail?” AI use without policy and audit trail fails the outcome test before any specific finding is made. The plan is how you build the evidence trail.
For a compliance manager: the Australian Framework for Generative AI in Schools, endorsed by Education Ministers in June 2025, sets six principles (Teaching and Learning, Human and Social Wellbeing, Transparency, Fairness, Accountability, Privacy and Security). ASQA’s draft AI Principles for RTOs, released in March 2026 for sector consultation, are expected to mirror this framework. The Privacy Act 1988 already applies to every AI tool that touches personal information, with penalties up to $50 million per serious breach following the 2024 reforms. The plan exists to satisfy all three regulatory layers simultaneously.
The 90-Day Plan in One Picture
The plan runs in three phases of 30 days each. Each phase has a single dominant goal and a single test for completion.
- Days 1-30: Foundation. Goal: publish an AI use policy, a risk register, and identify one low-risk pilot use case. Test: the policy is signed by leadership and the risk register is populated.
- Days 31-60: Pilot. Goal: run three pilot use cases under the policy, measure productivity gain and output quality, document the audit trail. Test: at least one pilot demonstrates measurable productivity gain with no compliance flags.
- Days 61-90: Operationalise. Goal: scale the use cases that worked, formally retire the ones that did not, train all relevant staff, and publish the standing AI policy. Test: at least 80 percent of relevant staff have been inducted into the standing policy and are using AI on documented workflows.
The plan deliberately does not start with tool selection. The tools matter less than the governance frame. Most RTOs already have access to AI tools (ChatGPT free, Microsoft Copilot via existing 365 licences, Gemini via existing Google Workspace). The constraint is the policy and the audit trail, not the software.
Phase 1, Days 1-30: Foundation
The first 30 days build the governance scaffolding everything else hangs from. Skip this phase and the rest of the plan collapses into ad hoc use without evidence trail.
Week 1: Appoint the AI Champion and Run a Use Audit
Appoint a single named person inside the RTO as the AI Champion. This is the role that owns the plan, not the role that owns the tools. The AI Champion sits in operations or compliance, has executive sponsorship, and reports monthly to the leadership team. In a small RTO this is often the Compliance Manager or the Operations Manager. In larger RTOs it may be a dedicated role.
The AI Champion’s first task is a use audit: ask every staff member whether they are already using AI tools, for what tasks, and on what data. This is fact-finding, not enforcement. Expect to find ChatGPT, Copilot, and Gemini already in use, often on student data. The audit is the baseline against which the policy will be measured.
Week 2: Draft the AI Use Policy
The AI use policy is a one-to-two page document that answers six questions:
- Which AI tools are approved, conditionally approved, or prohibited?
- What categories of data may be entered into approved tools?
- What categories of data may never be entered into any AI tool (student personal information, assessment evidence, audit responses, financial data)?
- Who in the RTO needs to validate any AI-generated output before it is used externally?
- How does the RTO maintain an audit trail of AI-assisted work?
- How often does the policy get reviewed, and who reviews it?
The policy aligns with the Privacy Act 1988, the Australian Privacy Principles, the Australian Framework for Generative AI in Schools, and the draft ASQA AI Principles. It does not need to be longer than two pages. Longer policies do not get read.
Week 3: Build the AI Risk Register
The risk register lists every AI use case the RTO is considering or already has, classifies each by risk tier (low, medium, high), and documents the controls applied to each. The three-tier framework discussed below provides the structure.
By the end of week 3, every staff member should be able to look at the risk register and see whether a given task is approved, conditionally approved with controls, or prohibited.
Week 4: Identify and Brief the Pilot Use Case
Choose one low-risk use case for the Phase 2 pilot. The criteria: low data sensitivity, clear measurable output, and an internal owner who is motivated to make the pilot succeed. The default starting pilot for most Australian RTOs is marketing content drafting (blog posts, social media copy, email drafts), because the input data is public, the output requires human editing, and the productivity gain is measurable.
Brief the pilot owner. Set the success metric. Schedule the 30-day pilot start date.
Phase 2, Days 31-60: Pilot
The second 30 days take the governance frame and apply it to three controlled pilot use cases. The goal is real productivity data, not just policy compliance.
Pilot 1: Marketing Content Drafting
The marketing function uses an approved AI tool (typically Claude or ChatGPT under the policy) to draft first drafts of blog posts, social media captions, course page copy, and email nurture sequences. Every draft is reviewed by a human marketer before publication. Every published piece is compliance-reviewed against the RTO marketing prohibited phrases list and the Information and Transparency Practice Guide.
The measurement: hours of marketing time per output before pilot, hours per output during pilot. Quality: is the output indistinguishable from human-written content? Compliance: are any Practice Guide breaches introduced by AI drafting?
Typical result: 50 to 70 percent reduction in first-draft time, with no quality drop after the human editing pass.
Pilot 2: Internal Document Summarisation
The operations and compliance functions use an approved AI tool to summarise long internal documents: training package release notes, ASQA fact sheet updates, Practice Guide revisions, validation meeting minutes, internal audit reports. The summaries feed into leadership briefings and decision papers.
The measurement: hours of summarisation time before pilot, hours during pilot. Quality: do the summaries capture the key implications correctly?
Typical result: 60 to 80 percent reduction in summarisation time, with the AI Champion validating the first 20 outputs to calibrate quality.
Pilot 3: Trainer Lesson Plan Support
Trainers and assessors use an approved AI tool to generate first-draft activity ideas, discussion prompts, and example scenarios for training delivery. Every output is reviewed and adapted by the trainer before use with students. No student data enters the tool.
The measurement: hours of session prep before pilot, hours during pilot. Quality: are the activities aligned to the unit of competency and the training package?
Typical result: 40 to 60 percent reduction in session prep time, with trainer judgement still owning the final activity selection.
What the Pilot Phase Documents
Each pilot maintains an audit log: prompt used, tool used, output generated, human edits applied, time recorded, compliance review outcome. The audit log becomes the evidence trail ASQA can review during a performance assessment. It is also the input to the Phase 3 decisions about which pilots scale and which retire.
Phase 3, Days 61-90: Operationalise
The third 30 days take the pilots that worked and scale them to all relevant staff, while formally closing the pilots that did not.
Weeks 9-10: Decide What Scales
The AI Champion presents the pilot results to leadership: which use cases delivered measurable productivity gain, which raised compliance concerns, which produced quality issues that disqualify them from wider rollout. Leadership signs off on the scale-out plan.
Weeks 11-12: Train All Relevant Staff
Every staff member who will use AI under the policy completes an induction. The induction covers the policy itself, the approved tools, the prohibited data categories, the audit trail requirements, and the validation expectations. A short test or sign-off confirms induction completion.
The induction is documented. The documentation becomes part of the staff training record. ASQA’s draft AI Principles emphasise staff capability as a self-assurance question, so this record matters during a performance assessment.
Week 13: Publish the Standing Policy
The Phase 1 draft policy gets updated with what the pilot phase learned. The standing policy is published, signed by the CEO or equivalent, dated, and added to the Quality Management System document register with a review cycle (annual at minimum, or whenever ASQA publishes new AI guidance, whichever comes first).
The Three-Tier AI Risk Framework for RTOs
Not every AI use case carries the same compliance weight. The three-tier framework, adapted from the Australian Framework for Generative AI in Schools and the draft ASQA AI Principles, gives RTOs a proportionate governance approach.
Tier 1: Low-Risk Administrative AI
Use cases where AI processes public information or RTO-owned non-sensitive content. Examples: drafting marketing copy, summarising public ASQA documents, generating activity ideas for training delivery, formatting internal templates. Approval requirement: AI Champion sign-off on the use case category. Audit requirement: log of tool, prompt category, and human editing applied.
Tier 2: Medium-Risk Operational AI
Use cases where AI processes RTO operational data that is not student personal information. Examples: summarising internal validation meeting minutes, drafting board reports, analysing training delivery patterns, suggesting policy improvements. Approval requirement: AI Champion plus the relevant function head. Audit requirement: full prompt log, output log, and validation record per output.
Tier 3: High-Risk Student-Touching AI
Use cases where AI processes or influences anything connected to student outcomes, assessment evidence, or personal information. Examples: AI-assisted assessment grading, AI generation of student feedback, AI-driven personalised learning paths, AI processing of student personal information. Approval requirement: leadership team sign-off on a full risk assessment with documented controls. Audit requirement: complete evidence trail, with student consent where applicable, and an independent quality check on AI outputs before any student-facing use.
Most RTOs in the first 90 days operate exclusively in Tier 1, with one or two Tier 2 cases under careful governance. Tier 3 sits behind a documented approval gate that most RTOs choose not to cross in the first year.
Tool Selection: What to Use for What
The three categories of AI tool relevant to an Australian RTO right now:
General-purpose generative AI: Claude (Anthropic), ChatGPT (OpenAI), Gemini (Google), Microsoft Copilot. These are the workhorses for content drafting, summarisation, and Q&A. For Australian RTOs, the relevant licensing tier offers enterprise data protection (data is not used to train the underlying model). Microsoft Copilot via existing 365 licences is the easiest starting point for most RTOs because the data protection is already in the existing licence.
RTO-specific AI workspaces: Platforms like SupaHuman and other emerging products build templates and prompt libraries tailored to VET compliance, AQF levels, and training package structures. Useful when the RTO wants pre-built workflows rather than building from scratch.
Function-specific AI: AI inside existing RTO software (SMS, LMS, marketing automation, CRM). These tools embed AI capability into the workflow most staff already use, which lowers the change-management burden.
For a first 90-day plan, a single general-purpose tool with enterprise data protection plus the existing function-specific AI in your SMS and LMS is enough. Adding additional tools before the policy is mature creates compliance complexity without proportionate value.
Cost Expectations for an Australian RTO
The realistic cost of AI adoption for an Australian RTO in 2026, separated into three categories:
Tool licensing: a typical RTO with 10-20 staff using AI ends up at $200 to $800 per month in tool licensing once the pilot phase identifies which tools scale. Microsoft Copilot inside existing 365 licences may have zero incremental cost. Claude Pro, ChatGPT Plus, or Gemini Advanced subscriptions for individual users sit at AUD 30-45 per user per month.
Training and change management: the Phase 3 staff induction is typically 30 to 60 minutes per staff member, plus AI Champion time during the 90-day plan. If delivered internally, the cost is staff hours. If delivered by an external consultant, expect AUD 2,500 to 8,000 for a small to mid-sized RTO.
Ongoing governance: AI Champion time after Phase 3 is typically 2-4 hours per month for policy review, risk register updates, and induction of new staff. Quarterly leadership review adds 1-2 hours per quarter.
Total first-year cost for a typical mid-sized RTO: AUD 6,000 to 15,000, against an expected productivity gain of 5-8 hours per staff member per week across the staff using AI. The economics work for almost any RTO with five or more administrative staff.
The AI Champion Role
The AI Champion is the single point of accountability for the plan. The role does not need to be a senior position, but it does need executive sponsorship and a defined remit.
The AI Champion’s responsibilities:
- Owns and maintains the AI use policy
- Maintains the AI risk register
- Approves new use cases against the three-tier framework
- Audits the audit logs on a defined cycle (monthly during the 90-day plan, quarterly thereafter)
- Inducts new staff and re-inducts existing staff when the policy changes
- Briefs leadership on regulatory changes (ASQA AI Principles updates, Privacy Act amendments, Framework revisions)
The AI Champion is not the only person who uses AI. Every staff member uses AI under the policy. The Champion owns the system that governs that use.
What Success Looks Like at Day 90
By day 90, a successful adoption shows the following:
- A signed AI use policy, dated, with a review cycle
- An AI risk register listing every approved use case and the controls applied
- Three pilot use cases evaluated, with at least two scaled to operational use
- All relevant staff inducted with documented sign-off
- An audit log of AI use spanning the full 90 days
- 5 to 8 hours per week per staff member recovered from administrative tasks
- Zero compliance findings linked to AI use during the period
- A scheduled quarterly review by leadership
If any of these are missing at day 90, the plan continues into a Phase 4 corrective sprint rather than the original 90-day timeline. The plan is not measured in calendar days; it is measured in completed milestones.
Frequently Asked Questions
Does an Australian RTO need ASQA approval before using AI?
No. There is no ASQA approval gate for AI use. The 2025 Standards apply outcome-based quality and self-assurance expectations to AI the same way they apply to other operational decisions. The RTO is responsible for its own governance, with ASQA reviewing the evidence trail during performance assessments. The draft ASQA AI Principles released in March 2026 set expectations rather than prescriptive rules.
Can ChatGPT or Claude be used with student data?
Not on consumer-grade subscriptions. Consumer ChatGPT and Claude Free terms allow the provider to use input data for training. Enterprise or Pro/Team subscriptions with data protection clauses are required before any operational data (let alone student personal information) enters the tool. Even with enterprise data protection, student personal information should sit in Tier 3 use cases with full risk assessment, and most RTOs avoid this in the first 12 months.
What does ASQA expect to see during a performance assessment regarding AI use?
Based on the draft AI Principles released in March 2026 and the sector workshops running through 2026, ASQA expects: a published AI use policy, a risk register or risk assessment per use case, evidence of staff training, an audit trail of AI-assisted work, and documented quality validation of AI outputs that touch training and assessment. The exact form will be confirmed in the final Principles, but RTOs adopting the framework in this guide will be well-positioned.
Should an RTO use AI in assessment?
With significant care. AI-assisted grading or AI generation of assessment evidence falls into Tier 3 of the risk framework and requires full risk assessment, documented controls, human validation of every AI-influenced decision, and clear documentation of the AI’s role in the assessment process. Most Australian RTOs in 2026 limit AI in assessment to administrative support (formatting, summarising student submissions for human review) rather than judgement.
How does AI use interact with the Privacy Act 1988?
The Privacy Act and the Australian Privacy Principles apply to every AI tool that touches personal information. Personal information sent to an AI tool that stores, processes offshore, or trains on input data is a notifiable breach if not authorised. The 2024 Privacy Act reforms allow penalties up to $50 million per serious breach and give individuals direct standing to sue. The AI use policy must explicitly prohibit personal information in non-protected AI tools.
Can AI write ASQA audit responses?
AI can help draft, summarise, and structure responses, but the substance of the response (the evidence, the analysis, the corrective actions) must come from the RTO’s own work. ASQA expects responses to reflect the RTO’s actual processes, not AI-generated content. Using AI to dress up a response that lacks underlying evidence will fail under outcome-based assessment.
How often should the AI use policy be reviewed?
Annually at minimum, and additionally whenever: ASQA publishes new AI guidance, the Privacy Act is amended, a new AI tool is introduced to the approved list, or an internal audit identifies a gap. The standing schedule should be in the policy document itself.
What Happens Next
The 90-day plan ends with a governed AI capability inside the RTO that scales productivity, satisfies the 2025 Standards, and creates the evidence trail ASQA will look for during the next performance assessment. The plan is the starting point, not the destination. Beyond day 90, the AI Champion runs the quarterly review cycle, the policy adapts to new ASQA guidance, and additional use cases enter the pipeline through the same three-tier framework.
Want a structured audit of where your RTO currently sits on AI governance? Start by running your current marketing through RTO Scanner to identify any AI-generated content that has slipped through compliance review. The free scan checks against the prohibited phrases ASQA flags and validates your RTO code against training.gov.au.
