Governance That Makes You Faster

You need settled decisions; whether they live in a formal policy depends on your size and sector. For a small organisation, a one-page document covering acceptable use, approval and data handling is genuinely sufficient and considerably more likely to be read. Larger and regulated organisations generally need something more formal, integrated with existing risk and procurement frameworks. The failure mode to avoid is producing a comprehensive policy that nobody reads while staff continue pasting customer data into public tools, which is the situation in a great many organisations right now.

There is no single comprehensive AI act at present, but that does not mean AI is unregulated. Existing law applies fully: the Privacy Act 1988 governs personal information, Australian Consumer Law prohibits misleading and deceptive conduct, anti-discrimination law applies to automated decisions, and sector regulators have their own obligations. The Australian Government has been consulting on mandatory guardrails for AI in high-risk settings, and the position continues to develop. Organisations should assume existing obligations apply today and that specific AI requirements may follow. This is general information, not legal advice.

Largely by removing the reason they are doing it. Shadow usage happens because people have work to do and an approved path does not exist or is too slow. A prohibition without an alternative moves the behaviour out of sight rather than stopping it. The approach that works is to provide a sanctioned tool that handles the common cases, be specific about what must never be entered anywhere, and make the approval path for new tools genuinely fast for low-risk cases. Finding out what people are already using, without blame, is usually the most informative first step.

It needs a named accountable owner, and where that sits depends on your structure. Risk, legal or the CIO are all common and workable. What matters more than the reporting line is that the owner has authority to make decisions, visibility of what is actually happening, and enough understanding of the technology to be proportionate. Governance owned by someone with no visibility of usage becomes theatre, and governance owned by someone with no authority becomes advice that gets ignored.

Every six months at minimum in the current environment, and immediately on any material change. A new high-risk use case, a regulatory development, a significant incident, or a change in your major AI supplier. The technology and the regulatory position are both moving faster than typical annual policy cycles accommodate. Assign the review to a named person with a calendar date rather than leaving it to be triggered by events, since the events that trigger it are usually the ones you wanted to have prepared for.

No. It is a practical prompt list to help an organisation settle the decisions that commonly arise, drawn from general Australian principles. It is not legal advice, it is not exhaustive, and it cannot account for your sector, size, contractual obligations or the specific systems you operate. The regulatory position is also developing. For decisions with real consequence, obtain advice from a qualified professional and check the current position with the relevant regulator.