ST4S Framework v2025.1

Various improvements:

• This framework introduces major improvements to pre-existing criteria, the majority of which do not impact critical compliance.

Access controls (category A):

• Passkeys, secure login links, one time passcodes (OTPs) and similar are being incorporated into the framework.
• We have improved criteria on student login methods including for services which provide classroom activities through the use of a ‘room code’ or ‘join code’ etc. Apps should implement rate limiting and brute force protections on these methods.
• We have revamped the order and simplified some of the criteria to help improve whether a control applies to the organisation vs the service.

• Clarifying controls and how privacy criteria applies to services only receiving vs sending and receiving personal data.
• Services which act as the primary sending service (e.g. major student administration systems and core systems) will be required to apply privacy features to support schools in opting out particular students to protect their information from being disclosed to other apps and services not authorised.

AI Module:

• We are continuing to review the AI Module criteria and how personal information can be safely processed with privacy protections in an expected future release (subject to approval) under v2026.1.
• Services which provide interactive AI features used by students (e.g. image generation or chat bot conversations) must demonstrate additional safety testing including displaying critical safety messaging and alerts.
• Companies with interactive chat bots and image generation tools are strongly advised to review the Australian eSafety Comissioner’s publications in relation to the online safety code and other guardrails announced by her office in relation to AI features.
• Services which use speech to text (STT), text to speech (TTS) along with AI models to improve effectiveness (e.g. AI enhanced transcribing), or to provide accessibility use case (e.g. assistive technology which use AI features) will be assessable under v2026.1 however, companies may apply for an exemption to be assessed under v2025.1 now.  Please contact the ST4S Team first before requesting an assessment.