AI governance and readiness
We set the policy, controls and evidence an organisation needs before it adopts AI.
AI adoption is a governance question before it is a technology one. We give the board and the technology team one position: which uses are allowed, with which data, under whose review.
What this covers
- AI use policy and acceptable use rules
- Use-case inventory and risk classification
- Data handling and access rules for AI tools
- Vendor and model due diligence
- Human review points and escalation
- Readiness assessment and adoption roadmap
Typical engagements
- AI use policy for an organisation that already uses AI tools
- Readiness assessment before a funded AI initiative
- Due diligence on an AI vendor or model
- Governance design for an agentic workflow
How an engagement runs
Enquiry
You describe what has to change. We reply in writing with questions.
Scoping
One conversation to agree the problem, the people affected and how the result will be accepted.
Proposal
A written scope, acceptance criteria, a price and a start date.
Delivery
We lead the work. Decisions, risks and changes are recorded as they happen.
Acceptance
The result is checked against the criteria agreed at the start.
Handover
Documents, access and records pass to your organisation.
Close
A short written close-out, and a support retainer if you want one.
Who this suits
Organisations whose staff already use AI tools and whose policies do not yet say what is allowed.
Boards and executives who must approve an AI initiative and want the risks named before they do.
We work to the Australian Government's Voluntary AI Safety Standard and the NIST AI Risk Management Framework, with the Essential Eight and the Information Security Manual for the systems AI runs on.
Our director is completing postgraduate study in applied AI at Charles Sturt University.
Typical platforms: Microsoft 365 Copilot, Google Workspace with Gemini, and the Anthropic and OpenAI APIs.
Related practices
Insights
Governance as code
Most governance lives in documents that no system reads. When policy is written as code, the system enforces classification, retention, lineage and access itself. Agentic AI makes that change necessary.
Agentic development governance
An AI agent that writes code needs the same controls as any other change to a system. We govern agent-written code with deny-by-default guardrails, an append-only audit trail and security evaluations before merge.