AI governance is how an organisation makes and controls decisions about AI.

What does it cover?

Purpose, ownership, information, evaluation, permissions, human involvement, monitoring, changes and retirement. The depth should reflect the actual use, consequence and applicable obligations.

Governance also connects investment to outcomes. A system can meet technical requirements and still fail to improve the work it was meant to support.

Who is responsible?

Business leaders own operating outcomes. Technology, privacy, security, legal, finance and risk functions have relevant responsibilities and specialist roles.

The board oversees material strategy and risk. Management needs clear delegation to operate. An AI committee should connect those responsibilities rather than obscure them.

What makes it Australian?

The organisation needs to assess applicable Australian privacy, consumer, discrimination, workplace and sector requirements. Those obligations differ by context.

Voluntary frameworks can support a method but do not replace law or create an automatic compliance certificate.

What does good practice look like?

A team can describe what the system is for, who owns it, what it may do and what evidence supports reliance. It knows what requires escalation, what happens when the system fails and which changes need reassessment.

Those arrangements should be demonstrable in operation, not only in policy language.

Where should we start?

Choose one consequential use. Trace it from purpose through approval, control and monitoring. Identify unresolved facts and assign owners.

Use the AI governance framework or read board-level governance.