AI governance
AI governance and ISO 42001 readiness for Australian organisations
AI is already inside your organisation, whether you approved it or not. We put the policy, accountability and lifecycle controls in place so you can adopt AI with confidence and show boards, regulators and clients a clear, defensible position.
Our AI governance work
AIGP
Consultants certified by the IAPP as AI Governance Professionals
ISO 42001
Readiness and alignment for the AI management system standard
4 weeks
AI Governance Foundation: current use, guardrails, roles and a board-ready roadmap
Why this matters now
AI is embedded in everyday tools, workflows and decisions. Governance is how you enable that innovation while staying defensible on privacy, security, ethics and reputation.
What AI governance covers
AI governance is the set of policies, roles, processes and controls an organisation uses to oversee how AI is developed, bought and used. It provides the guardrails that keep AI safe, ethical, lawful and aligned with what the organisation is trying to achieve.
We design governance that fits your operating model: principles, roles, controls and reporting written in language leadership can actually use. It works whether you are rolling out Microsoft Copilot, ChatGPT or Gemini to staff, or building AI into products for customers.
What you get
- a board-ready AI governance pack
- roles, decision rights and escalation paths
- an AI inventory and risk triage for use cases
- acceptable use and AI policy suite
- AI risk and impact assessment templates, including the new Privacy Act automated decision-making tests
- controls aligned to your existing governance, privacy and security frameworks
AI Governance Foundation
Four weeks to a defensible position
A rapid assessment of current AI use, governance principles and guardrails, roles and responsibilities, finishing with a board-ready summary and a prioritised roadmap.
We finally had a clear, defensible position on AI, without slowing the business down.
Risk and Compliance Lead, SOCI infrastructure client
Our AI governance services
Strategy and policy
Risk and assurance
Lifecycle and standards
How we work with you
Initiate
Understand your goals, the AI already in use and what success looks like for your board and teams.
Assess
Workshops onsite or online to evaluate current practice, identify gaps and triage AI use cases by risk.
Build
Establish the policies, roles, controls and templates tailored to your organisation, reusing what already works.
Educate
Train leaders and staff on responsible AI use and the obligations that apply to your sector.
Steward
Ongoing oversight, monitoring and improvement as your AI use, the technology and the rules change.
ISO/IEC 42001 readiness
ISO/IEC 42001:2023 is the international standard for an AI management system (AIMS). Published in December 2023, it sets requirements for establishing, implementing, maintaining and continually improving how an organisation governs AI, and organisations can be certified against it.
It uses the same management system structure as ISO/IEC 27001, so if you already run an information security management system, much of the governance machinery can be reused. Its Annex A controls cover areas such as AI policy, roles, resources, impact assessment, the AI system lifecycle, data, information for interested parties and third-party relationships.
We help you decide whether certification is worth pursuing, run a gap analysis against the standard, and build the AIMS documentation and practices to close the gaps, whether or not you go on to certify.
AI governance and ISO 42001: frequently asked questions
What is ISO 42001?
ISO/IEC 42001:2023 is the international management system standard for artificial intelligence. It specifies requirements for an AI management system covering policy, roles, risk and impact assessment, the AI lifecycle, data, supplier relationships and continual improvement.
Is ISO 42001 certification mandatory in Australia?
No. It is voluntary. Organisations pursue it to give clients, regulators and partners independent assurance, or use it as a framework without certifying. Some procurement processes are starting to ask about it.
How is ISO 42001 different from ISO 27001?
ISO 27001 manages information security risk. ISO 42001 manages the risks and impacts of AI systems, including fairness, transparency and effects on people. They share the same structure, so they can be run as an integrated management system.
How long does ISO 42001 readiness take?
It depends on how much governance already exists and how many AI systems are in scope. Our gap analysis gives you a clear plan and effort estimate before you commit to certification.
Where should we start if staff are already using AI tools?
Start with visibility and guardrails: find out which AI tools are in use, publish an acceptable use policy, set decision rights for new use cases and protect sensitive data. Our four-week AI Governance Foundation is designed for exactly this.
Do the Privacy Act changes affect our AI use?
Yes. From 10 December 2026 your privacy policy must describe computer programs that make or substantially inform significant decisions about people using their personal information. Read our automated decision-making guide.
Start with clarity
If AI is already in use, governance is the safest lever you can pull right now.