AI Governance Consulting

There is no single AI Act in Australia. What exists is a set of obligations you already have that apply to AI whether or not anyone has thought about it that way. The Privacy Act 1988 and the Australian Privacy Principles govern personal information regardless of what processes it — an AI system that touches customer data is in scope exactly as a spreadsheet would be. Australian Consumer Law still applies to what your AI says to customers; an automated misrepresentation is a misrepresentation. Anti-discrimination law applies to automated decisions in hiring and credit. Sector regulators add their own layers. On top of that sits Australia’s Voluntary AI Safety Standard, which is not law but is rapidly becoming the reference point people are measured against — including by customers running procurement questionnaires. The practical position: you are already regulated, just not by anything with "AI" in the title.

It is close to universal, it is rarely malicious, and treating it as a disciplinary matter is the fastest way to drive it underground where you genuinely cannot see it. People are using these tools because they work and because nobody gave them a sanctioned alternative. The realistic response has three parts: give them an approved tool with an appropriate data agreement so there is a legitimate path; write an acceptable-use policy in plain English that says what may and may not go into which tools, with examples from your actual business rather than abstractions; and be specific about the genuinely serious categories — customer personal information, health information, anything under an NDA, anything you would not email to a competitor. A policy that just says "do not use AI" is ignored by lunchtime and leaves you worse off than having no policy, because now you have a documented rule you are demonstrably not enforcing.

Considerably less than the compliance industry wants to sell you, and more than nothing. For most Australian mid-market businesses the useful floor is four artefacts: a plain-English acceptable-use policy people actually read; a register of AI systems in use, including the ones staff adopted without asking; a risk position per system, sized to what the system actually does; and a named human accountable for each one. That is a few weeks of work, not a programme. Governance should be proportionate to consequence — an internal meeting-notes summariser and a system that influences credit decisions are not the same risk, and treating them identically means either strangling the harmless one or under-governing the dangerous one. In practice, over-governance fails the same way as under-governance: everyone routes around it.

Probably not, and we will usually say so. ISO/IEC 42001 is the international standard for AI management systems, and it is genuinely useful if you are selling into enterprises or government buyers who ask for it, or if AI is central to your product and certification is a commercial differentiator. For a mid-market business using AI internally to reduce admin, it is a large cost for an answer nobody has asked you for. The pragmatic path is to align with the substance — the risk register, the accountability, the review cadence — without buying the certification, then certify if and when a customer actually requires it. If a consultant leads with certification before asking what you do, they are selling an audit rather than solving a problem.

One named person per system, senior enough to stop it. Not a committee — committees are where accountability goes to be diffused, and "the AI working group" has never once made a hard call. The accountable person does not need to understand transformer architecture; they need to understand the business process the system touches, and they need the authority to switch it off. Above that, someone senior should hold the overall position: the policy, the register, the board answer. In a business with the volume to justify it that becomes a real role. In most mid-market businesses it is a few days a month, which is exactly the gap a fractional AI officer fills.

Working artefacts, not a framework document. An acceptable-use policy in plain English with examples drawn from your business. A register of AI systems actually in use — and the discovery exercise behind it is often the most revealing part, because it always finds tools nobody knew about. A risk assessment per system, proportionate to what it does, with mitigations that are specific. A named accountable owner for each. A position on your Privacy Act 1988 obligations mapped to your real use cases rather than in the abstract. And a review cadence, because a policy written once and filed is decoration. Usually three to four weeks. The test is whether your staff can read the policy and know what to do on Monday.