AI governance framework for Australian businesses

Short answer: AI governance is who in your business owns AI decisions, which uses are approved, what risk each one carries, and how you review and record the lot. Below is a six-part framework you can stand up in 30 days without a standing committee, mapped to the Australian Government's six essential practices for AI adoption.

Why a 40-person business needs AI governance now

If your business has more than a handful of employees, some of them are already using AI. At Bulletproof we see this in every audit we run: the tools are already in use, and the question is whether anyone has decided who owns that, and what happens when something goes sideways.

Three things have changed in the last 12 months that make governance urgent, not aspirational.

The Privacy Act's automated decision-making transparency requirement. The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024.¹ From 10 December 2026, organisations that use personal information in substantially automated decisions must disclose that in their privacy policies. If your team uses AI to triage customer enquiries, score job applicants, or flag anomalies in financial data, you need a system that knows where those uses are before the deadline arrives.

The Voluntary AI Safety Standard and the Guidance for AI Adoption. The Department of Industry, Science and Resources published the Voluntary AI Safety Standard in September 2024, setting out 10 guardrails for responsible AI use.² In October 2025, the government followed up with the Guidance for AI Adoption, consolidating those guardrails into six essential practices.³ Neither is mandatory. Both represent the government's view of what responsible AI use looks like, and aligning with them is reasonable due diligence if a regulator ever asks what you did to manage AI risk.

Sector regulators are already moving. APRA's Prudential Standard CPS 234 (Information Security), in force since July 2019, is technology-neutral and already covers AI systems that process, store, or transmit information within banks, insurers and superannuation funds.⁴ The Tax Practitioners Board published guidance in July 2026 (TPB(GS) 55/2026) on how the Code of Professional Conduct applies when AI is used in tax practice.⁵ If you work in a regulated industry, the governance question is already answered: you need a framework, and your regulator expects you to be able to show it.

None of this requires a compliance committee or a dedicated governance team. What it requires is a structure that tells your business who owns AI, which uses are sanctioned, and what the rules are when someone wants to try something new. That is what the framework below provides.

This page is the operating system. The document your staff actually follow is the AI policy template, which slots into Part 4 of this framework as the artefact the approval path deploys.

The six-part framework

Six components. Each one maps to at least one of the Australian Government's essential practices for AI adoption. You can write this on a single page, and a business of 20 to 200 people can run it without adding headcount.

1. Accountable owner

Name one person. Not a committee, not "the leadership team", not a shared inbox. One person who is responsible for approving new AI use cases, responding to incidents, and reporting to the board or senior leadership on how AI is being used.

In a business of 20 to 50 people, this is usually the operations lead or the GM. In a business of 50 to 200, it is often a risk, compliance, or IT lead. The title does not matter. What matters is that every employee knows who to ask when they are unsure whether a use of AI is permitted.

This maps to the Guidance for AI Adoption's first essential practice: "Decide who is accountable."³

2. Use-case register

A register of every AI tool and use case in your business. Not the ones you planned. The ones that are actually happening. This is the foundation, and most businesses are surprised by what the register turns up when they build it honestly.

Each entry needs four fields: the tool (name, vendor, licence tier), the use case (what it does, in one sentence), the data it touches (personal information, financial data, confidential material, or none of the above), and the owner (the person or team responsible for that use).

If you have not done this before, start with a one-question survey to all staff: "Which AI tools have you used for work in the last month?" The answers will include tools nobody sanctioned and uses nobody anticipated. That is the point.

This maps to the essential practice "Understand impacts and plan accordingly": know what AI you are using and what it affects.³

3. Risk tiers

Not every AI use carries the same risk. A chatbot that drafts internal meeting agendas is not the same as a model that triages customer complaints or scores loan applications. Tiering your register by risk is what lets you apply proportionate controls instead of treating every use case like a high-stakes deployment.

Three tiers are enough for most businesses:

The Privacy Act's automated decision-making transparency requirement (from 10 December 2026) applies squarely to the high tier, and arguably to parts of the medium tier. If you cannot point to a tier for every AI use in your register, you cannot say with confidence which ones will need to be disclosed.

This maps to the essential practice "Measure and manage risks": apply controls proportionate to the context of use.³

4. Approval path

When someone in your business wants to use a new AI tool or apply an existing tool to a new use case, what happens? If the answer is "they just start using it," your register is already out of date.

A workable approval path for a mid-size business has three steps:

1. Request: the person fills in a one-page form covering the tool, the intended use, the data involved, and why they want it.
2. Tier and review: the accountable owner assigns a risk tier. Low-tier uses can be approved immediately. Medium-tier uses require a review of data handling and human oversight. High-tier uses require a documented impact assessment before approval.
3. Deploy with the policy: if approved, the use goes into the register, the person is pointed to the AI policy for the rules that apply, and any conditions (such as mandatory human review of outputs) are recorded.

This is not bureaucracy. It is a five-minute conversation for a low-tier request, and a structured assessment for anything that touches personal data or affects individuals. The goal is speed with a paper trail, not friction for its own sake.

This maps to the essential practice "Maintain human control": ensure appropriate human involvement in AI-assisted decisions, proportionate to the risk.³

5. Review cadence

A framework that is never reviewed is a framework that rots. Set a review cadence and put it in the calendar.

• Quarterly: the accountable owner reviews the use-case register. Are there new uses that were not submitted through the approval path? Has the risk profile of any existing use changed? Are the approved tools still on the same licence terms?
• Six-monthly: review the AI policy itself against any regulatory changes. Australian AI regulation is moving quickly: the Privacy Act's automated decision-making provisions take effect in December 2026, and the government has signalled further legislation.⁶
• Immediately on incident: if an AI tool produces an output that causes harm, discloses personal information, or triggers a complaint, the accountable owner investigates and documents the incident, the response, and any changes to controls. For APRA-regulated entities, material information security incidents must be notified to APRA within 72 hours.⁴

This maps to the essential practice "Test and monitor": establish ongoing review and improvement processes for AI systems in use.³

6. Records

Good governance leaves a trail. If a regulator, a client, or your own board asks how you manage AI, you should be able to point to four things:

• The use-case register (what AI is in use, at what risk tier)
• The approval log (what was approved, by whom, with what conditions)
• The review history (when the register and policy were last reviewed, what changed)
• The incident log (what went wrong, what was done about it)

The Voluntary AI Safety Standard's Guardrail 9 requires records sufficient to allow a third party to assess compliance.² Even if you are not formally aligning with the Standard, keeping these four records is the minimum for demonstrating due diligence.

This maps to the essential practice "Share essential information": keep records that allow stakeholders and third parties to assess compliance.³

The one-page summary

Here is the framework on a single table. Copy it, fill in the names and dates, and pin it to your governance register.

How to stand this up in 30 days

You do not need a project team. You need one person with enough authority to make decisions and enough time to run four meetings.

Week 1: Name the owner and find out what is happening. Appoint the accountable owner. Send a one-question survey to all staff: "Which AI tools have you used for work in the last month, and what for?" Collect the answers. You will find tools you did not know about and uses you did not sanction. That is normal.

Week 2: Build the register and tier it. Turn the survey results into the use-case register. Add any tools the business provides centrally (Microsoft Copilot, ChatGPT Team, Claude for Business, or whatever you use). Assign a risk tier to each entry. Flag anything in the high tier for an impact assessment.

Week 3: Set up the approval path and the policy. Decide how new AI use cases will be submitted and approved. A shared form and a conversation with the owner is enough for most businesses. If you do not have an AI policy yet, use the AI policy template for Australian businesses and customise it to your approved tools and data rules. This is the artefact the approval path deploys.

Week 4: Communicate and run the first review. Brief each team (30 minutes, in person or video). Walk through two or three scenarios relevant to their work. Run the first register review meeting with the owner and one senior leader. Set the quarterly and six-monthly calendar reminders. Log the date. The framework is live.

If you are already using AI across your business and have not started this, you are past the point where governance is optional. The tools are in use. The question is whether the rules and the records catch up before something goes wrong. If you are still working out where to start with AI, the governance framework and the first pilot can run in parallel.

What boards actually ask

If you are reporting to a board or a senior leadership team, you need to answer their questions, not yours. The AICD's Director's Guide to AI Governance (version 2, June 2026) puts it plainly: "Directors do not need to be AI experts. But they do need a minimum viable understanding of AI to ask the right questions, make informed strategic decisions, and ensure appropriate governance structures and processes are in place."⁷

In practice, the questions boards ask about AI fall into five categories:

1. What AI is in use? This is the register. If you cannot answer it, nothing else matters.
2. What are the risks? This is the risk tiering. Boards do not need the technical detail. They need to know how many high-tier uses you have and what controls are on them.
3. Who is accountable? This is the owner. A board expects a named person, not a committee or a team.
4. Are we compliant? For most businesses, this means the Privacy Act and, if applicable, APRA CPS 234. For accountants, it now includes the TPB's guidance on AI and the Code of Professional Conduct, which requires informed client consent before disclosing client information to a third-party AI platform.⁵ Our guide to AI for accountants in Australia covers that in detail.
5. What has gone wrong? This is the incident log. Boards care about incidents, responses, and whether controls were changed as a result.

The framework above gives you a ready answer to all five. If your board has not asked yet, they will. The AICD guide is clear: boards that ask the right questions, set clear accountabilities and oversee effective risk controls will be best placed to use AI responsibly.⁷

ISO/IEC 42001 is the international standard for an artificial intelligence management system.⁸ It provides a useful reference for larger organisations building more formal governance structures, but it is not required by Australian law. For a business of 20 to 200 people, the six-part framework above covers the same ground in a form you can actually run.

Frequently asked questions

What is AI governance?

AI governance is the system that decides who in your organisation owns AI decisions, which uses are approved, what level of risk each use carries, and how you review, record and improve over time. It is not a document. It is an operating rhythm. The document your staff follow is the AI policy. The framework is the system that keeps the policy current and enforced.

Do Australian businesses legally need an AI governance framework?

There is no standalone AI governance law in Australia. But the Privacy Act 1988 already governs how personal information is used in AI systems, and from 10 December 2026 organisations must disclose automated decision-making in their privacy policies. A framework is how you meet those obligations systematically, rather than scrambling when the deadline arrives.

What is the difference between an AI policy and an AI governance framework?

The policy is the document your staff follow: which tools are approved, what data is off limits, who reviews outputs. The framework is the operating system around it: who owns AI decisions, how new use cases get approved, how risk is tiered, when the whole thing gets reviewed, and what records you keep. You need both.

How long does it take to set up an AI governance framework?

For a business of 20 to 200 people, 30 days is realistic. The first week is naming the owner and auditing what AI your team already uses. The second is building the use-case register and tiering risk. By week four you are running your first review meeting and the framework is live.

Does APRA CPS 234 apply to AI governance?

Yes. CPS 234 is technology-neutral and applies to any information asset, including AI systems, within APRA-regulated entities such as banks, insurers and superannuation funds. Material AI-related security incidents must be notified to APRA within 72 hours, and material control weaknesses within 10 business days.

What is ISO/IEC 42001?

ISO/IEC 42001 is the international standard for an artificial intelligence management system, published by ISO and IEC. It provides a framework for managing AI risks and opportunities systematically. It is a useful reference, but certification is not required by Australian law and is not a prerequisite for responsible AI governance.