What changed
The Department of Employment and Workplace Relations (DEWR) has revised both the External Systems Assurance Framework and the Right Fit for Risk (RFFR) accreditation requirements to bring them in line with whole-of-government security policies and applicable legislation.
Two documents are being replaced. The Scope document becomes the Provider Security Plan (PSP), and the Statement of Applicability becomes the PSP Annex (PSP-A). The RFFR core controls from the old Statement of Applicability have been updated and now sit in the PSP-A. Which controls apply to you depends on your assurance category.
DEWR’s RFFR FAQ also spells out how AI fits into accreditation. Providers can’t use AI to deliver DEWR services unless it has been explicitly approved under the Third-Party AI Assessment Framework, which DEWR published in September 2025. Once a use is approved, it becomes part of your RFFR accreditation and maintenance cycle. AI used for other parts of the business is allowed only if it is fully isolated from DEWR’s service delivery systems and data. If you can’t guarantee that isolation, don’t use it until the department says yes.
When it starts
The updated framework took effect on 1 October 2026, and DEWR says it will work with each provider on the transition over the following 12 months. If you already hold RFFR accreditation, your status and timeframes stay as they are.
Who is affected
Employment service providers holding RFFR accreditation are the main group covered. The Change of Circumstances requirement also applies to vendors of Third-Party Employment and Skills (TPES) systems.
What it means in practice
If your RFFR submission falls due within the next 9 months, you can keep using your current documentation. If you haven’t started your submission yet, you can choose to use the new PSP-A instead.
All providers and TPES vendors must notify DEWR within 5 business days of any change in circumstances. Notifiable changes include:
- changes to the legal entity or organisational structure
- changes to key personnel
- changes to how information is handled
- changes to subcontracting arrangements
- changes to IT systems or third-party IT vendors
- the introduction of AI in service delivery
You notify DEWR by completing a Change of Circumstances Form.
Related: Some mutual obligation penalties are back for job seekers, but not all of them
General information only, not legal advice. Check the official source before acting.
Source: Department of Employment and Workplace Relations. Licence: CC BY 4.0.
