Where to start
Boards can start with AI governance for boards, which covers the oversight duties directors already hold. Then read what AI governance is and the AI governance framework. The framework maps the 6 essential practices of the Guidance for AI Adoption to the steps of governing one use.
02
Board briefings
Oversight frameworks and decision criteria for board members and executives.
7 articles
AI capability audit: questions every CEO should ask
Questions a CEO can use to test AI claims against what the organisation can deliver, across strategy, data, people, deployment and vendors.
AI oversight metrics and KPIs for boards
Board-level AI measures in 4 groups: value creation, risk exposure, capability maturity and competitive position.
AI transparency and explainability requirements
What organisations need to explain about AI decisions that affect people, and the records that make those explanations possible.
The board's role in AI vendor selection
When the board should engage in AI vendor decisions, and the questions on data, lock-in, security and exit to ask.
Competitive AI intelligence for boards
How a board can track competitors' AI moves from public disclosures and industry research, and test its own investment timing.
Accountability when an AI agent acts with your credentials
Who owns the outcome when an AI agent acts in a signed-in session, and the delegation limits to set before it does.
Board questions before 10 December 2026
The oversight questions directors can put to management before Australian Privacy Principle (APP) 1.7 applies on 10 December 2026.
03
AI risk and compliance
Guides to managing AI risk, meeting regulatory requirements and keeping AI systems secure.
11 articles
AI compliance checklist for Australian organisations
A checklist that maps each AI use to the Australian laws that apply, from privacy and consumer law to workplace and industry rules.
AI disruption risk: what boards should assess
The operational, regulatory, reputational and competitive risks AI adoption creates, and how a board sets its appetite for each.
AI security and cybersecurity risks
AI-specific security threats, such as prompt injection, data poisoning and model theft, and the controls that address them.
Algorithmic bias in business AI
Where bias enters business AI, how to test for it and why high-risk systems need checks before and after deployment.
Audit and accountability in AI systems
How to make AI decisions traceable, with records of inputs, outputs, human review and the reasons for each decision.
Data governance for AI (Australian Privacy Act)
How the Australian Privacy Principles apply to the data AI systems collect, use, store and share.
GenAI copyright and IP risks
The copyright and intellectual property risks in generative AI inputs, outputs and training data, and the contract terms that limit them.
What APP 1.7 requires Australian organisations to disclose
What APP 1.7 requires an organisation to describe in its privacy policy from 10 December 2026, and what can stay internal.
How to map automated decisions in 90 minutes
A 90-minute method for listing the workflows where software already influences a decision about a person.
Who should review an ADM privacy policy in Australia
Who should review an automated-decision privacy policy: operations for the workflows, privacy counsel for the wording and an executive for publication.
AI agent go-live: define what the agent may do before release
A checklist for the release decision on an AI agent that reads systems, changes records or communicates externally.
Last reviewed
Frequently asked questions
What is the difference between AI governance and an AI management system?
Governance sets who decides about AI and on what terms. The management system is the set of policies, processes and records that carries those decisions out and improves them over time.
Who is responsible for AI governance?
The board oversees it and management runs it. Each AI use also needs a named business owner, who answers for its results and its risks.
Does an organisation need ISO/IEC 42001 certification?
Certification is voluntary. An organisation can use the standard to design its AI management system whether or not it seeks certification.
The first conversation applies these articles to your own approval, control and reporting decisions.