This article argues that Australia can pursue auditable accountability for public-sector artificial intelligence without enacting a single comprehensive AI statute, provided that existing legal duties, policy frameworks, standards, and procurement mechanisms are organised into an explicit assurance stack. An “AI Act” is used here to mean a unified statute that imposes system-wide ex ante obligations on providers and deployers. Australia currently relies on a more distributed model. The article’s claim is that this model can still be made defensible, but only if abstract norms are translated into evidence disciplines that preserve contestability and reviewability. Using a doctrinal and functional method, the article shows how legality, procedural fairness, record-making, reason-giving, procurement discipline, privacy obligations, and audit practices can be aligned to produce a minimum reviewable trace for AI-influenced public decisions. The original contribution is twofold. First, the article conceptualises Australia’s public-sector AI governance arrangements as an assurance stack whose layers only matter if they generate reviewable artefacts. Second, it proposes a bounded minimum reviewable trace that preserves the system configuration, material inputs and outputs, evaluation basis, reliance statement, and contestability pathway for a particular decision. The article also reframes selective hardening as a practical governance response for higher-risk uses, and presents an Assurance Requirement Level as a qualitative policy heuristic rather than a quantitative model. Concrete illustrations drawn from welfare eligibility and emergency-care triage demonstrate how the trace would work in practice. The article concludes that procurement is the principal operational lever for pushing evidence duties upstream, but that the stack will only succeed if audit offices, tribunals, ombudsmen, and agencies are equipped to interpret and test the artefacts they require.