How to read this page
This page sets out frameworks and questions so you can make informed decisions; it does not tell anyone what they should do. I write as a non-Indigenous educator providing AI literacy. I do not advise on cultural protocols or on what any community should decide. Where a question is about culture, knowledge, or what is right for a community, the people to take it to are Aboriginal and Torres Strait Islander leadership, the ARN, CAAHSN, the relevant communities and their Elders, and the appropriate governance bodies.
What this page can do is describe, accurately and neutrally, what the established frameworks say, and surface the questions worth asking when AI tools meet Aboriginal and Torres Strait Islander data and knowledge. The authority over those decisions rests with Aboriginal and Torres Strait Islander people.
The frameworks below are written by and with Aboriginal and Torres Strait Islander people. The aim here is to point you to them clearly, not to summarise away their detail. Each links to the full source in the resource library.
What the terms mean
Indigenous Data Sovereignty is the right of Aboriginal and Torres Strait Islander peoples to govern the collection, ownership, access and use of data about their people, communities, cultures, lands and resources. Indigenous Data Governance is how that right is put into practice: the arrangements, rules and decision-making that give communities authority over their data.
Indigenous Cultural and Intellectual Property (ICIP) is the rights and interests of Aboriginal and Torres Strait Islander peoples in their cultural heritage: knowledge, stories, language, songs, designs, art, and the data that records them. ICIP rights include things mainstream copyright does not protect, such as the collective ownership of cultural knowledge and the right to maintain its integrity.
Why this matters for AI: AI tools are trained on enormous amounts of material taken from the internet, and they store and sometimes learn from what users type in. Both of those touch directly on data sovereignty and ICIP, which is why the questions below are practical, not abstract.
The frameworks, in plain language
Each of these is a full document in its own right. The summaries are a starting point; the resource library has the sources.
CARE Principles for Indigenous Data Governance (Global Indigenous Data Alliance, 2020). A companion to the common "FAIR" data principles, adding four Indigenous-centred requirements: Collective Benefit (data should benefit Indigenous peoples), Authority to Control (Indigenous peoples govern their data), Responsibility (those using the data build respectful relationships and capability), and Ethics (minimise harm, and consider future uses).
Maiam nayri Wingara principles (Aboriginal and Torres Strait Islander Data Sovereignty Collective, 2018). Five principles, including the right to control the data ecosystem; data that is contextual and disaggregated to community level; data that is relevant and supports self-determination; data structures accountable to Indigenous peoples; and data that protects both individual and collective interests.
AIATSIS Code of Ethics for Aboriginal and Torres Strait Islander Research (2020). The national code for research with Aboriginal and Torres Strait Islander peoples, built on self-determination, consent and benefit. It calls for a data management plan that sets out how data is stored, who can access it, whose permission is sought, and what secondary uses may occur, which is directly relevant when an AI tool is a possible secondary use.
True Tracks and the ICIP principles (Terri Janke, 2021). A widely used set of ten principles for working with ICIP, including free, prior and informed consent, attribution, integrity, and benefit sharing. Terri Janke and Company has also written specifically on AI, copyright and Indigenous culture.
NHMRC guidance. The National Statement on Ethical Conduct in Human Research (Chapter 4.7) sets out the core values for research with Aboriginal and Torres Strait Islander peoples. The NHMRC's 2025 Guide for Assessing Research Involving AI treats using AI to search, summarise or code literature as routine research use, while using AI to process participant data or make predictions triggers fuller ethical assessment. NHMRC also states that grant applicants may use AI in preparing applications but must certify accuracy, while peer reviewers must not use AI to assess applications.
Framework for Governance of Indigenous Data (National Indigenous Australians Agency, 2024). An Australian Government framework for governing Indigenous data held by government in partnership with Aboriginal and Torres Strait Islander people.
Where AI raises new questions
The frameworks above predate the current wave of AI, but they apply to it directly. A few specific tensions are worth naming.
- Training without governance. A model trained on Aboriginal and Torres Strait Islander health data without community governance runs against the Authority to Control principle.
- Aggregation without context. Tools that roll Indigenous data up into national figures, without the community-level disaggregation Maiam nayri Wingara calls for, can erase exactly the context that makes data useful and safe.
- Secondary use. Putting data collected for one purpose into an AI tool can be a new, unconsented secondary use, which both CARE and the AIATSIS Code speak to.
- Whose knowledge is in the model. These tools learned mostly from material produced in very different contexts. The CSIRO's 2025 scoping work with Aboriginal and Torres Strait Islander health leaders put it plainly: AI systems must first "make cultural sense", data sovereignty must be protected under Aboriginal and Torres Strait Islander custodianship, and Indigenous organisations should be central to how AI is designed and overseen.
- Implementation gap. A 2024 review in Nature Digital Medicine of 85 studies using routinely collected Indigenous health data found only 21% described Indigenous guiding principles and only 41% reported on data sovereignty, a gap that adopting AI without care could widen.
Questions you might ask
These are prompts for thinking and for conversations with the right people, not a checklist that makes a project safe on its own.
- Whose data is this, and who has the authority to decide how it is used?
- Has the community been engaged from the start, not just asked to approve at the end?
- What does the data management plan say about secondary use, and does putting this into an AI tool count as a new use?
- Who benefits from this, and how is that benefit defined by the community itself?
- Is the data identifiable or re-identifiable, and where would it actually go if it were entered into this tool?
- Is the AI's training data anything like the population this concerns, and what follows if it is not?
- Which governance bodies and ethics processes need to be part of this decision?
Where any of these opens a question of cultural protocol or community authority, that is the point to stop and bring in Aboriginal and Torres Strait Islander leadership and the relevant governance bodies. It is not a question this material can answer for you.
Where this connects
- The practical side, what you can and cannot put into a tool, de-identification, free versus workplace tools, and the Privacy Act and NT Information Act, is on the responsible-data page.
- Every framework named here has its full source, with a real link, in the ICIP and Data Sovereignty Resource Library.
Glossary
- Indigenous Data Sovereignty
- the right of Aboriginal and Torres Strait Islander peoples to govern data about their people, communities, cultures and lands.
- Indigenous Data Governance
- how that right is put into practice through rules, arrangements and decision-making.
- ICIP (Indigenous Cultural and Intellectual Property)
- the rights and interests of Aboriginal and Torres Strait Islander peoples in their cultural knowledge, stories, language, art and data.
- CARE Principles
- Collective benefit, Authority to control, Responsibility, Ethics; Indigenous-centred data governance principles.
- Maiam nayri Wingara
- the Aboriginal and Torres Strait Islander Data Sovereignty Collective, and its set of data sovereignty principles.
- Free, prior and informed consent (FPIC)
- consent given freely, ahead of time, and with full understanding; a core ICIP and ethics principle.
- Secondary use
- using data for a purpose other than the one it was collected for; entering data into an AI tool can be a secondary use.
- De-identification
- removing details that could identify a person; covered on the responsible-data page.
- AIATSIS Code of Ethics
- the national code for ethical research with Aboriginal and Torres Strait Islander peoples.
Take it with you: a one-page cheat sheet of this material is available to download from the button at the top of this page. Cultural-protocol decisions are not something a cheat sheet can settle; they sit with Aboriginal and Torres Strait Islander leadership.