About Sam

My background

I bring experience spanning across privacy, data governance, regulatory compliance and governance transformation, with organisations across financial services, superannuation, payments, tertiary education, the public sector and other regulated environments.

My experience includes developing and implementing governance frameworks, policies and standards; privacy and data risk assessments; personal information discovery and mapping; privacy impact assessments; data ownership and stewardship; incident management; third-party governance; and governance monitoring and reporting.

More recently, my work has increasingly focused on AI governance.

I have worked on the development of enterprise AI governance frameworks, policies and standards, AI lifecycle governance, risk and materiality classification, validation requirements, human oversight, contestability and redress, incident management, monitoring and reporting.

This combination of experience shapes how I approach AI governance today.

Why my Privacy and Data Governance background matters for AI

AI governance does not exist in isolation.

AI systems depend on data. They can process personal information, influence decisions, introduce new third-party dependencies and create risks that cross traditional organisational boundaries. That means effective AI governance needs to connect with privacy, data governance, technology, cyber security, risk, legal and compliance functions.

My background allows me to look beyond the AI system itself and consider the broader governance environment in which it operates. Rather than creating a separate governance structure for every emerging technology, I look for opportunities to build on what an organisation already has, strengthen existing controls and introduce new governance where it is genuinely needed.

My approach

I believe governance should be proportionate to risk and practical enough to operate in the real world. A framework can be technically comprehensive and still fail if nobody understands how to use it. A policy can satisfy a compliance requirement and still provide very little guidance when someone needs to make a decision. And an approval process can introduce so much friction that people simply find ways around it.

My approach is therefore grounded in implementation. I focus on questions such as:

• What decision needs to be made?

• Who should be accountable?

• What information do they need?

• What level of review is proportionate to the risk?

• What evidence should be retained?

• What happens when circumstances change?

• And how can this become part of normal business operations?

The objective is governance that people can actually use.

Independent and technology-neutral advice

I am not tied to an AI platform, software vendor or technology implementation. My role is to provide an independent governance perspective. That means helping organisations understand what they are using, where the risks sit, what governance is appropriate and where additional controls may genuinely add value.

Sometimes the answer is a new framework or process.

Sometimes an existing governance mechanism can be adapted.

And sometimes the right answer is to simplify what is already there.

How I work

I work directly with business leaders and teams across risk, legal, privacy, data, technology, compliance and operations. Engagements can range from targeted advisory work and governance reviews through to the development and implementation of broader governance frameworks. For organisations that need ongoing AI governance capability but do not require a dedicated full-time role, I also provide fractional AI governance support. This provides access to specialist governance expertise as AI use develops, helping organisations assess new use cases, maintain governance processes, address emerging issues and continue maturing their approach over time.

Areas of expertise

My work includes:

• AI governance frameworks and operating models

• AI policies, standards and lifecycle governance

• AI risk and materiality assessment

• AI assurance and validation requirements

• human oversight and accountability

• AI monitoring, reporting and incident management

• privacy governance and privacy by design

• privacy impact assessments

• personal information discovery and mapping

• data governance frameworks

• data ownership and stewardship

• data minimisation and lifecycle governance

• third-party and vendor governance

• governance maturity and gap assessments.

Work with me

If your organisation is adopting AI, strengthening its privacy or data governance, or trying to turn governance requirements into something that works operationally, I can help. You do not need to know exactly what framework or solution you need before getting in touch.

We can start with the problem you are trying to solve.