AI governance your team will actually follow
Your staff started using AI before anyone wrote a policy. Your vendors switched it on inside tools you already pay for. Now the board is asking what the company’s position is. I help mid-sized Australian and New Zealand companies answer that properly in weeks, not a year-long programme: an AI register, a policy people follow, and controls that run, aligned to the government’s AI6 guidance and ISO/IEC 42001.
Haden McAlpine · CISSP · ISO/IEC 27001 Lead Auditor · 25 years in IT, cyber and infrastructure
Why this is landing on your desk now
Three things have changed in the last year. In October 2025 the National AI Centre published the Guidance for AI Adoption, known as AI6 (AI6 explained). It condenses the earlier Voluntary AI Safety Standard into six practices, and it’s quickly becoming what boards, customers and insurers measure you against. From 10 December 2026, the Privacy Act requires your privacy policy to disclose automated decisions that significantly affect people. And in New Zealand, IPP 3A has applied since 1 May 2026, so collecting personal information about people from third parties, which plenty of AI tools do, now comes with a duty to tell them.
None of that needs a big programme. It needs someone who can work out what AI you’re actually running, decide what’s acceptable, and put enough control around it that you can answer the board, the customer questionnaire and the regulator with a straight face.
The six AI6 practices, and what “done” looks like
1. Decide who is accountable
A named owner for AI across the business, and an owner for each system on the register. Not a committee that meets once.
2. Understand impacts and plan accordingly
A short impact assessment for each use case that touches customers, staff or decisions about people.
3. Measure and manage risks
AI risks added to the risk register you already have, with treatments, rather than a separate framework nobody maintains.
4. Share essential information
Staff know what’s approved, customers are told where it matters, and your privacy policy covers automated decisions.
5. Test and monitor
Acceptance testing before go-live and someone watching outputs afterwards, scaled to the risk.
6. Maintain human control
Clear points where a person can override or stop the system, and evidence that they actually do.
What I deliver
AI register
Every AI tool and AI feature in use, including the ones switched on inside Microsoft 365, your CRM, your HR system and your helpdesk, with an owner and a risk rating.
AI use policy
A policy written for how your people work: approved tools, what data can go where, and who is accountable for the output. Short enough that people read it.
Controls that run
Data loss prevention, access scoping and logging for AI tools, plus a check in procurement so new AI features don’t slip in unnoticed.
Board pack
A short paper the board can approve: where you use AI, the risks, the controls, and the decisions they need to make.
ISO/IEC 42001, if you need the certificate
Most mid-sized companies don’t need ISO/IEC 42001 certification yet. Some do, usually because an enterprise customer or a government buyer has started asking. AI6’s implementation guidance is broadly aligned with 42001, so the work above is the foundation either way. If you already run an ISO 27001 information security management system, 42001 sits on top of it rather than beside it, and that saves a lot of duplicated effort.
Why me
I’m a CISSP and ISO/IEC 27001 Lead Auditor, and I build AI systems as well as govern them: MCP servers, Claude, ChatGPT and Copilot integrations, and data agents. My own practice runs on governed AI staff with scoped permissions and human sign-off. So the controls I recommend are ones I’ve had to live with, not ones I read about.
Common questions
What is AI6?
AI6 is the Australian Government’s Guidance for AI Adoption, published by the National AI Centre in October 2025. It sets out six essential practices for organisations that develop or use AI: decide who is accountable, understand impacts and plan accordingly, measure and manage risks, share essential information, test and monitor, and maintain human control. It is voluntary, but it is quickly becoming the benchmark boards and customers use.
Is AI governance a legal requirement in Australia?
There is no general AI law in Australia yet, but existing laws already apply to AI. The Privacy Act applies to personal information used in AI systems, and from 10 December 2026 privacy policies must disclose automated decisions that significantly affect people. Directors’ duties, consumer law and anti-discrimination law also apply to outcomes produced by AI.
Do we need ISO/IEC 42001 certification?
Usually not yet. Certification makes sense when a customer, tender or regulator asks for it. The AI register, policy and controls come first either way, and if you already hold ISO 27001 the step to 42001 is much smaller.
How long does it take?
An AI governance sprint for a mid-sized company typically runs four weeks: inventory in the first week, policy and risk work in the middle, and controls plus the board pack at the end. It is a fixed fee agreed before we start.
Do you work with New Zealand companies?
Yes. The approach is the same, mapped to the NZ Privacy Act 2020, including IPP 3A on indirect collection, and to the Biometric Processing Privacy Code where it applies.