AI governance that starts with the problem, not the model.
Somewhere in your organisation, a team is already using AI. Maybe it’s sanctioned, maybe it’s a free tool someone found useful and quietly adopted, shadow AI, in practice, and it’s more widespread than most leadership teams realise. Either way, the question is no longer whether to govern AI. It’s whether you find out about the risk before a regulator, a customer, or an audit does.
IAPP AIGPNIST AI RMFISO/IEC 42001ISO/IEC 42005AI6
Where it usually goes wrong
Most AI governance work we see starts in the wrong place. A policy gets written, a checklist gets circulated, and six months later nobody in the business can produce a straight answer to a simple question: which systems are actually in scope, and who is personally accountable for each one.
Where we start instead
Before we talk controls or frameworks, we spend time understanding what your organisation is actually trying to do with AI, what has already been built or bought, including the parts nobody officially signed off on, and where the real exposure sits.
Governance that is bolted on after the fact rarely survives contact with a busy project team. Governance built around how your people actually work has a chance.
Our approach draws on established practice rather than reinventing it. We work with the IAPP’s AI Governance Professional body of knowledge, align controls to recognised references such as the NIST AI Risk Management Framework and ISO/IEC 42001, and treat Australia’s own AI6 guidance as a practical, low-friction starting point rather than one more framework to reconcile. Where privacy and personal data are part of the picture, we bring genuine depth in data protection practice rather than treating it as an afterthought to the AI conversation. What we do not do is hand you a generic template and call it a framework.
An AI agent that plans and acts with real autonomy is not an employee and not a contractor. It’s an IT system, and the organisation deploying it remains accountable for what it does, the same as it would for any other system acting on its behalf.
In practice, this covers:
- A genuine inventory of where AI is operating today, including shadow AI nobody formally approved
- Named, individual accountability for each AI system in use, not a committee in the abstract
- AI risk assessment and use case triage
- Governance structures that fit how your organisation actually makes decisions
- Agentic AI accountability: deciding in advance what a system is trusted to do without a human checking every step, and how you’d know if it acted outside that boundary
- Model and vendor due diligence
- Alignment with the regulatory direction of travel, in Australia and internationally
We also help organisations that already have an AI policy on paper but no real confidence it is being followed, which is a more common starting point than most firms will admit.
We are a small, specialist practice by choice. You will deal directly with the people doing the work, not be handed off to a graduate analyst once the contract is signed. That matters in AI governance more than most disciplines, because the details of how a specific model is used in a specific process are exactly where the real risk hides, and exactly what a templated approach misses.
Contact us for an initial conversation about where AI is actually being used in your organisation today, and what a governance approach that fits your risk and your culture would look like.
Schedule a Consultation