AI Governance Consulting

Practical governance for organisations adopting and using AI

Artificial intelligence is becoming part of everyday business operations, from generative AI and productivity tools to analytics, automated processes, customer interactions and AI-enabled decision-making. For many organisations, adoption is moving faster than governance.

AI may already be used by employees, embedded within existing technology platforms or introduced through third-party vendors before the organisation has established clear expectations around accountability, risk assessment, acceptable use, human oversight or monitoring.

I help Australian organisations establish practical, proportionate AI governance that supports responsible AI adoption while managing the risks that come with it.

Whether you are beginning your AI governance journey, reviewing what is already in place or preparing to scale your use of AI, I can help translate governance principles into processes that work within your organisation.

What is AI Governance?

AI governance is the framework of accountability, policies, processes and controls used to guide how artificial intelligence is selected, developed, introduced, used and monitored within an organisation.

Effective AI governance helps answer some fundamental questions:

Where are we using AI?

What information is it using?

Who is responsible for it?

What could go wrong?

How significant would the impact be?

What controls and human oversight are appropriate?

How do we know it continues to operate as intended?

AI governance should provide clear answers without creating unnecessary barriers to innovation. The objective is not to govern every AI use case in exactly the same way. It is to establish a proportionate approach where governance increases with the potential risk and impact of the AI being used.

How I can help

AI governance engagements can focus on a specific problem or help establish a broader governance capability.

Talk to me about AI Governance

  • Develop a practical AI governance framework defining how AI is identified, assessed, approved, managed and monitored across your organisation.

    This can include governance principles, decision rights, accountability, lifecycle requirements, escalation pathways and oversight arrangements.

  • Understand where your organisation currently stands.

    I can review existing policies, processes, governance structures and AI practices to identify gaps, areas of strength and priority actions.

    The result is a practical roadmap for improving AI governance rather than implementing controls without understanding what your organisation actually needs.

  • Develop or review AI policies and supporting standards that establish clear expectations for employees, business teams, technology functions and third-party providers.

    Policies can address areas such as acceptable AI use, prohibited activities, accountability, data handling, human oversight, risk assessment, approval requirements and monitoring.

  • You cannot effectively govern AI if you do not know where it is being used.

    I can help establish an AI register and supporting processes to identify AI-enabled systems, tools, vendors and business use cases across your organisation.

    An effective register should provide meaningful governance information rather than becoming another spreadsheet that is completed once and forgotten.

  • Not every AI use case presents the same level of risk.

    I can help establish a risk or materiality classification approach that considers factors such as the purpose of the AI, the information it processes, the people affected, the level of automation, reliance on AI outputs and the potential consequences if something goes wrong.

    This allows governance requirements to be proportionate to risk.

  • Develop practical assessment processes for proposed or existing AI use cases.

    Assessments can consider privacy, data, security, reliability, transparency, explainability, fairness, human oversight, third-party dependencies and potential impacts on individuals or the organisation.

    The objective is not simply to document risk. It is to identify what needs to be done before an AI use case can be responsibly implemented.

  • AI governance needs evidence that systems are suitable for their intended use.

    I can help establish governance requirements for testing and validation, including when independent review may be appropriate, what evidence should be retained and how assurance should vary according to the significance of the AI use case.

  • Using AI does not remove organisational accountability.

    I can help define where human review, intervention and decision-making are required and clarify who remains responsible for decisions supported or influenced by AI.

  • AI is increasingly introduced through software and services organisations already use.

    I can help establish governance for third-party AI, including due diligence expectations, risk assessment, data considerations, contractual responsibilities, monitoring and accountability.

  • Governance should continue after implementation.

    I can help define what should be monitored, how issues should be escalated and what information executives, governance committees or boards need to understand about the organisation's AI environment.

  • AI can produce unexpected, inaccurate, inappropriate or harmful outcomes.

    I can help integrate AI-related events into existing incident management arrangements and establish appropriate escalation, investigation, remediation and governance processes.

Already using AI but don't know where to start?

You do not need to build an entire AI governance framework before taking action.

For many organisations, a sensible starting point is to establish visibility.

  • What AI tools are employees using?

  • Where is AI already embedded within your technology environment?

  • Which vendors are providing AI capabilities?

  • What business decisions are being supported by AI?

  • What data is being provided to those systems?

  • Who owns each use case?

Once you understand your AI environment, governance can be prioritised according to actual risk rather than assumptions.

AI Governance should be proportionate

One of the risks with emerging governance disciplines is creating processes that are more complicated than the problem they are trying to solve. AI governance should not require every use of AI to pass through the same lengthy approval process. A low-risk productivity use case may require basic safeguards and employee guidance. An AI system influencing significant decisions about customers, employees or other individuals may require considerably stronger assessment, testing, oversight and monitoring.

I help organisations develop governance that reflects these differences. This allows lower-risk AI adoption to proceed efficiently while directing greater scrutiny towards the AI applications that warrant it.

From principles to operational governance

Many organisations now understand the principles associated with responsible AI. The harder question is:

What does this mean operationally?

  • Who completes the assessment?

  • Who approves the use case?

  • What gets recorded in the AI register?

  • When does Legal need to be involved?

  • When should Privacy review it?

  • When is independent validation required?

  • Who determines whether human oversight is sufficient?

  • What happens if the AI changes?

  • What gets reported to executives or the board?

These are the questions that turn responsible AI principles into governance. My focus is helping organisations design those practical mechanisms.

Building on the governance you already have

AI introduces new risks, but that does not mean every organisation needs an entirely separate governance ecosystem. Most organisations already have established approaches to privacy, cyber security, data governance, technology risk, vendor management, compliance and enterprise risk.

Effective AI governance should connect with these existing structures.

My background across AI governance, privacy, data governance and regulatory risk allows me to look at AI within this broader environment and identify where existing governance can be extended and where genuinely new controls are required.

The result should be governance that becomes part of normal business operations rather than another isolated compliance process.

Who I work with

I work with Australian organisations that need practical, independent support to establish or strengthen AI governance.

This may include organisations that are:

  • introducing generative AI or other AI-enabled tools

  • developing an organisation-wide approach to AI

  • experiencing increasing employee use of AI

  • implementing higher-risk AI use cases

  • introducing AI through third-party technology providers

  • responding to executive or board questions about AI risk

  • preparing for increased regulatory expectations

  • reviewing whether existing AI governance is effective

  • moving from an AI policy towards operational governance.

Engagements can range from targeted advisory work through to the development of an end-to-end AI governance framework.

Independent AI Governance Advice

AI governance sits at the intersection of technology, data, privacy, risk, legal obligations and business decision-making.

My approach is independent and technology-neutral.

The objective is not to sell an AI platform or encourage your organisation to adopt more AI.

It is to help you understand the AI you are using, the risks it creates and the governance needed to manage those risks appropriately.

Need ongoing AI Governance support?

Some organisations need more than a one-off project.

If your organisation needs ongoing access to AI governance expertise but does not require a permanent dedicated role, I also provide Fractional AI Governance support.

This can provide ongoing assistance with AI assessments, governance decisions, new use cases, reporting, policy maintenance, oversight and continuous improvement as your organisation's use of AI develops.

Start with where you are

You do not need to have your AI strategy finalised or know exactly what governance framework you need before getting started. If your organisation is already using AI, considering new AI capabilities or trying to understand whether its current governance is sufficient, we can start by looking at where you are today. From there, we can identify what matters most, what can use your existing governance structures and where additional controls are genuinely required.

Looking for practical AI governance support?

Let's discuss how AI is currently being used within your organisation and what governance would be appropriate for your environment.

Learn about Fractional AI Governance
Discuss Your AI Governance Needs