AI Governance &Readiness
Find out where AI is already used in your organisation, what data it touches and who answers for it. Then put policies and controls around it that your board can stand behind.
Know What's in Use
An inventory of every AI tool in the business, approved or not, and the data that goes into each one.
Clear Accountability
A named owner, a risk register and board reporting, so someone answers for each AI decision.
Recognised Standards
Governance mapped to ISO/IEC 42001, the National AI Centre's Guidance for AI Adoption and the NIST AI RMF.
Standards We Align To
AI Governance as a Board-Level Issue
Most organisations already use AI, whether or not anyone approved it. Staff paste customer records into free chatbots. Vendors switch on AI features in software you bought years ago. A quick prototype ends up running a real process. None of it shows up in a risk register until something goes wrong.
We help boards and executives get that under control without banning the tools people find useful. The work starts with an honest picture of current use, then builds the policies, controls and reporting to match. It follows ISO/IEC 42001, the international standard for AI management systems, and the six essential practices in the National AI Centre's Guidance for AI Adoption.
Scenario:
A financial services organisation is about to launch an AI-assisted credit assessment tool. A pre-deployment governance review finds the model treats some applicant groups differently. Left alone, that means discriminatory outcomes and a regulator asking questions. Because the review happened before launch, the team retrains the model, records the decision and adds human review for borderline cases.
There is also a deadline. From 10 December 2026, organisations covered by the Privacy Act must say in their privacy policies when a computer program uses personal information to make, or substantially help make, a decision that could significantly affect someone. You can only describe those decisions if you know where they happen.
A Clear Picture in About Four Weeks
The assessment is a structured review of how AI is used across your organisation, how well people understand it and where the exposure sits. It ends with a prioritised plan, not a pile of findings.
1. Discovery
Interviews with leadership, IT, security, legal and department heads about goals, risk appetite and how AI is used today.
2. AI Inventory
A catalogue of every AI tool in use, sanctioned or not, with the data flows and system integrations behind each one.
3. Skills Audit
Role-based questionnaires that show where staff understand what AI can't do, and where they don't.
4. Risk Evaluation
Data leakage, compliance, shadow AI, vendor dependency, output quality, and bias and fairness, each scored for likelihood and impact.
5. Report & Roadmap
A risk register, quick wins for the next 30 days, and a sequenced plan for policy, training and controls.
Sanctioned AI vs Shadow AI
The inventory sorts every tool into one of two columns. The urgent risk usually sits in the second one: free tools, company data, and no review of where that data goes.
| Aspect | Sanctioned AI | Shadow AI |
|---|---|---|
| Approval | Approved by IT or leadership | Used without IT's knowledge |
| Contracts | Licences and agreements in place | Personal or free-tier accounts |
| Data terms | Data handling terms reviewed | Nobody has read where the data goes |
| Integration | Documented and monitored | Ad hoc and untracked |
| Risk | Managed | Unmanaged |
Deliverables & Business Impact
Key Deliverables
Business Benefits
Four Pillars of AI Governance
Once the assessment shows where you stand, governance covers the whole AI lifecycle, from choosing a tool to retiring it.
Policy & Strategy
AI principles, an acceptable use policy and a board charter that set out what AI is for and where the limits are.
Model Risk Management
Validation, bias checks and performance monitoring for AI that makes or supports decisions about people.
Regulatory Alignment
Mapping to ISO/IEC 42001, the Guidance for AI Adoption, the NIST AI RMF and the Privacy Act, with a watch on changes.
Oversight & Monitoring
Board reporting, incident response for AI failures, and reviews as tools and use cases change.
How Exposed Is Your Organisation?
Twelve questions, about three minutes. Your answers stay in your browser. Nothing is sent or stored.
How an Engagement Works
Free Initial Consultation
A conversation about how AI is used in your organisation today and what concerns you about it.
Fixed-Scope Assessment
We agree the scope and quote the price before any work starts.
Ongoing Support
Policy reviews, board reporting and advice as new AI tools and rules arrive.
Further Reading
Agentic AI in the business: what Australia's cyber agency and its allies now expect
ASD's ACSC and its allies have published guidance on adopting agentic AI. Here is what it says, and a practical checklist and 90-day plan for Australian organisations.
AI Security · 8 min readShadow AI and the breach data: what boards should ask
IBM's 2026 breach report links unapproved AI use to a large share of incidents. Here is a practical playbook for Australian boards, and seven questions to put to management.
Compliance · 9 min readISO 42001: the first global standard for responsible AI, and why Australian enterprises should care
ISO/IEC 42001:2023 is the world's first AI management system standard. Here is what it requires, who is certifying, and why Australian organisations should act now.
Compliance · 9 min read10 December 2026: the Privacy Act automated decision-making rule your AI tools may trigger
From 10 December 2026, APP entities must describe certain automated decisions in their privacy policies. Here is a ten-week plan to find the AI and rules-based tools that trigger the rule.
Know Where Your AI Risk Sits
Start with a free initial consultation. We'll tell you plainly whether a full readiness assessment is worth doing for your organisation.