AI governance that fits your organisation

Governance has a reputation for slowing things down. Done badly, it does. Done well, it is what lets an executive approve an AI system knowing what it does, what data it touches and what happens when it is wrong. The goal is proportionate control, not a framework copied from a bank.

Tier by risk

Not every use case needs the same scrutiny. An internal drafting assistant on public content is different from an automated decision affecting a customer's entitlement. Define three or four tiers with clear criteria: data sensitivity, degree of automation, impact of error, and external exposure. Match the required evidence and approvals to the tier.

Decide who decides

Write down who can approve a use case at each tier, what they need to see, and who owns the system once live. Ambiguity here is where programmes stall. A small AI review group with business, technology, privacy and security representation usually works better than a committee.

Take privacy seriously and specifically

Where personal information is involved, map its flow through the system, including to model providers. Apply the Australian Privacy Principles: collect the minimum, use it for the purpose collected, retain it no longer than needed, and be clear with individuals. This is not legal advice; involve your legal advisers, and do it early rather than as a gate at the end.

Back policy with technical controls

• Identity-aware retrieval so the system only surfaces what the user may see
• Prompt injection and content safeguards
• Output validation and human review for higher tiers
• Audit logging of inputs, outputs and decisions
• Cost and rate limits so a fault cannot become a bill

Run it as an operating rhythm

Governance is not a document. It is a cadence of reviews of quality, incidents, cost and new use cases, with the authority to change things. Keep the paperwork light and the rhythm consistent.