Say yes to AI, with rules your team can follow.
For boards, owners and executives who know staff are already using AI and need control without killing momentum. We put a practical AI policy, approved tools, data rules and human oversight in place, informed by guidance from the OAIC and the National AI Centre, then implement them in your systems. We work alongside your lawyers and IT provider; we don't give legal advice.
Signs you need this
If two or more of these sound familiar, there's likely time and money to recover.
Staff are already using AI
People are pasting emails, client notes and spreadsheets into whatever tool they found. You can't manage a risk you can't see.
Nobody owns the question
IT, legal, marketing and operations each assume someone else is handling AI. Decisions stall, or get made by default.
Software helps decide things about people
Tools that sort job applicants or approve credit applications may be making decisions that significantly affect individuals. From 10 December 2026, Privacy Act changes require many organisations to describe these automated decisions in their privacy policy.
Clients and tenders ask how you use AI
Procurement questionnaires and client due diligence can include questions on AI use and data handling. Without a documented answer, you risk losing work at that stage.
What changes for the business
Faster, safer adoption
Clear rules on approved tools and data let staff use AI confidently, instead of avoiding it or working around you. You get the productivity without guesswork about what's allowed.
Lower privacy and data risk
Data classification and approved business tools keep personal and confidential information out of public AI services, as the OAIC recommends. That reduces the chance of a data breach you would have to assess and potentially notify.
Clear accountability
A named senior owner, an AI register and set review points mean every AI system has someone responsible for it. Problems are caught internally rather than discovered by a customer.
Ready for the automated decision rules
We find where software makes, or plays a substantial and direct part in, decisions that could significantly affect individuals, and brief your lawyers on what your privacy policy may need to cover. You reach 10 December 2026 knowing your exposure.
Evidence for clients and procurement
A documented policy, register and vendor assessments let you answer AI and data questions in tenders and client reviews with evidence. That protects revenue in contracts where trust is part of the decision.
Controls sized to your risk
The Australian Government's Guidance for AI Adoption has a Foundations version for organisations starting out and more detailed Implementation practices for mature or higher-risk use. We match your controls to where you are, so governance doesn't become a bottleneck.
What we build
AI use policy
A plain-English policy covering approved and prohibited uses, data rules, review requirements and who to ask, written so staff will actually read it.
Data classification and approved tools
A simple classification of your information, such as public, internal, confidential, personal and sensitive, mapped to which AI tools may handle each class.
AI register
A record of every AI system in use, including AI built into software you already have, with owner, purpose, data, risk rating and review date.
Vendor assessment checklist
Questions for any AI supplier on data use, model training, storage location, security, testing and exit, applied to your current and proposed tools.
Human oversight and incident process
Review points for higher-risk uses, and a process for reporting and fixing AI errors, including when a suspected data breach must be assessed under the Notifiable Data Breaches scheme.
Implementation and staff training
Tool settings, permissions and logging configured so the rules are enforced in your systems, plus role-based training on the policy.
Technology we work with
- Microsoft 365 Copilot
- Microsoft Purview
- SharePoint and OneDrive
- Google Workspace and Gemini
- ChatGPT Business and Enterprise
- Claude for Work
- OpenAI and Anthropic APIs
- Cloudflare
How it runs
Timings are indicative and depend on your systems, data and approvals.
Discover
We find what AI is already in use, including features inside existing software, and what data each tool touches.
1 to 2 weeks (indicative)
Assess
Each use is rated for risk, with automated decisions about individuals and personal information flagged for your legal advisers.
1 to 2 weeks (indicative)
Set the rules
Policy, data classification, approved tools, register and oversight points are drafted with your leadership and reviewed by your lawyers where needed.
2 to 3 weeks (indicative)
Implement
Tool settings, permissions and logging are configured, the register is populated, and staff are trained.
2 to 4 weeks (indicative)
Review
Scheduled reviews of the register, incidents and new tools, with the policy updated as guidance and law change.
Quarterly
Worked example
Accounting firm: a knowledge assistant staff can trust, and an end to the document chase
An illustrative 60-person accounting and advisory firm loses senior time to routine questions, has no rules for AI, and chases client documents by email. The system starts with an AI use policy, then gives staff an assistant grounded in the firm's own procedures, with citations and permissions, and moves document collection into a client portal.
- Job created in the practice management system
- Portal sends the client a document checklist
- Uploads filed against the job
- Staff prepare the work
- Knowledge assistant answers from approved sources, with citations
- Manager and partner review
- Client sees status in the portal
Guardrails, fit and measurement
Guardrails we apply
- We are marketers and technologists, not lawyers. Legal interpretation sits with your legal advisers, and we work alongside them.
- Oversight is proportionate to risk, from automated monitoring for low-stakes uses to mandatory human review for high-stakes decisions, as the Guidance for AI Adoption describes.
- Every recommendation cites the guidance or law it relates to, so your advisers can check it.
- We never certify a business as compliant. We document what was checked, against which source, and when.
Not the right fit if
- You need a legal opinion on your Privacy Act obligations. That is your lawyers' job; we can work with them on the operational side.
- You develop or train AI models for sale, or operate high-risk systems that need formal assurance. You will need specialist assurance and legal support beyond what we provide.
- You want a policy to file and forget. Governance only works when tools, permissions and training are put in place alongside it.
What we measure
- Share of AI tools in use that are recorded in the AI register
- Staff completion of AI policy training
- Use of approved versus unapproved AI tools, where visible
- AI incidents reported, and time to resolve
- Register items reviewed on schedule
- Vendor assessments completed before purchase
Pricing
AI governance work is scoped individually, usually after an Altitude Diagnostic or a fixed-scope discovery, so we don't publish project prices.
Questions, answered.
Do we need an AI policy?
We don't give legal advice, so check your obligations with your lawyers. What we can point to is guidance: the National AI Centre's Guidance for AI Adoption says organisations that use AI should develop and maintain an AI policy, and the OAIC says organisations should establish policies and procedures for using AI systems. The OAIC is also clear that privacy obligations apply to personal information put into an AI system.
What changes on 10 December 2026?
From that date, under amendments made by the Privacy and Other Legislation Amendment Act 2024, APP entities must explain in their privacy policy the kinds of personal information used, and the kinds of decisions made, where a computer program makes or does something substantially and directly related to a decision that could reasonably be expected to significantly affect an individual's rights or interests. The OAIC's examples include approving or rejecting a credit application and recruitment software that sorts candidates. We can map where this happens in your systems; your lawyers should advise on the wording.
Can staff use ChatGPT or Copilot with client information?
As a matter of best practice, the OAIC recommends organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools. Business versions are different: Microsoft, OpenAI and Anthropic each publish statements saying business customer data isn't used to train their models by default. Your policy should spell out which tools are approved for which classes of data.
Is the Voluntary AI Safety Standard still the reference point?
The Guidance for AI Adoption, published in October 2025, follows the earlier Voluntary AI Safety Standard and condenses its 10 guardrails into six essential practices: decide who is accountable, understand impacts and plan accordingly, measure and manage risks, share essential information, test and monitor, and maintain human control. We use those six practices to structure your framework.
How much does AI governance cost, and how long does it take?
Governance work is scoped individually, usually after an Altitude Diagnostic or a fixed-scope discovery, depending on how many tools, teams and higher-risk uses are involved. Our indicative plan is 6 to 11 weeks from discovery to trained staff, followed by quarterly reviews.
Related services
- AI strategy & roadmapsAn AI roadmap built on evidence: nine lenses, a do-nothing baseline, confidence-labelled estimates and a Now/Next/Later plan your board can act on.
- AI assistants & knowledge systemsRole-specific AI assistants that answer from your own documents, cite the source and respect permissions. Built on Microsoft 365, Google or a custom stack.
- AI-augmented workforceHelp your existing team do more valuable work with AI: role-based training, approved tools, prompt libraries and adoption tracking. Capacity, not cuts.
Where this matters most
Find out what AI is already in use
We start by mapping the AI tools and features your team already relies on, then show what governance each one needs.
Sources
Third-party facts on this page, checked 14 October 2026.
- Guidance on privacy and the use of commercially available AI products, Office of the Australian Information Commissioner (OAIC). www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products
- Guidance for AI Adoption, National AI Centre, Department of Industry, Science and Resources. www.industry.gov.au/publications/guidance-ai-adoption
- Guidance for AI Adoption: Foundations, National AI Centre, Department of Industry, Science and Resources. www.industry.gov.au/publications/guidance-for-ai-adoption/guidance-ai-adoption-foundations
- Guidance for AI adoption: foundations, National AI Centre (ai.gov.au). www.ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-foundations
- New resources on transparency for use of AI and automated decision-making (30 September 2026), Office of the Australian Information Commissioner (OAIC). www.oaic.gov.au/news/media-centre/new-resources-on-transparency-for-use-of-ai-and-automated-decision-making
- APP 1.7 to 1.9 Transparency Obligation: Fact Sheet (September 2026), Office of the Australian Information Commissioner (OAIC). www.oaic.gov.au/__data/assets/pdf_file/0021/269013/APP-1.7-1.9-Transparency-Obligation-Fact-Sheet.PDF
- Privacy and Other Legislation Amendment Act 2024 (Cth), Schedule 1 Part 15 and commencement table, Federal Register of Legislation. www.legislation.gov.au/C2024A00128/asmade/2024-12-10/text/original/pdf
- Data breach preparation and response, Part 4: Notifiable Data Breach (NDB) Scheme, Office of the Australian Information Commissioner (OAIC). www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/preventing-preparing-for-and-responding-to-data-breaches/data-breach-preparation-and-response/part-4-notifiable-data-breach-ndb-scheme
- Data, Privacy, and Security for Microsoft Copilot, Microsoft Learn. learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy
- Business data privacy, security, and compliance, OpenAI. openai.com/business-data
- Is my data used for model training?, Anthropic Privacy Center. privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training