A practical starting point for AI governance in Australian organisations

Staff in most organisations are already using AI tools, whether or not there is a policy covering them. Leaders face a choice: try to block usage and push it underground, or put sensible guardrails in place that allow safe adoption. The second approach almost always works better.

This article outlines a pragmatic starting point. It is general information, not legal advice, and your obligations will depend on your sector and the data you handle.

Start with an acceptable use policy

A short, readable policy is the most effective first step. It should explain which AI tools are approved, what information must never be entered into them, how outputs should be checked and who to ask when unsure.

• Approved tools and how to request new ones
• Data classification rules for AI use
• Expectations for human review of AI output
• Disclosure requirements when AI is used in customer-facing work

Keep a register of AI use cases

Record each AI system in use or development: its purpose, the data it uses, who owns it, and the decisions it influences. The register makes risk visible and helps prioritise where deeper assessment is needed.

Assess risk in proportion

Not every AI use case needs the same scrutiny. An internal tool that drafts meeting summaries is very different from a system that influences credit or eligibility decisions. Tier your use cases by impact and apply heavier review to those that affect people's rights, finances, health or safety.

Align with existing obligations

Australian organisations already operate under privacy, consumer, anti-discrimination and sector-specific rules that apply to AI just as they apply to any other technology. Frameworks such as Australia's AI Ethics Principles, the NIST AI Risk Management Framework and ISO/IEC 42001 provide useful structure for building on top of those obligations.

Back policy with technical controls

• Single sign-on and logging for approved AI tools
• Data loss prevention rules for sensitive information
• Guardrails and evaluation for AI systems you build
• Regular testing for prompt injection and data leakage

Review and adapt

AI capabilities and regulatory expectations are both changing quickly. Set a regular cadence to review the policy, the register and the controls, and update them as you learn from real use.