The Board-Ready AI Business Case Template for
Boards do not approve "we want to do AI". They approve specific bets.
Most internal AI business cases that land in front of an Australian board get rejected, and almost never because the idea is bad. They get rejected because the case is shaped wrong. It opens with capability ("we want to deploy an AI agent"), it pitches an unbounded ambition, the cost stack stops at year one, the risk register is three lines of hand-waving, and the kill criterion is missing entirely. A board reading that case has no idea what they are approving, what it costs if it fails, or when they are allowed to stop.
This is the companion piece to the seven prior articles in this series on AI agents in Australian businesses. We have already covered the technical and operational reasons a business should not run unsupervised DIY agent builds, what day-two production reality actually looks like, the staffing gap most internal teams underestimate, how to select a vendor without locking yourself in, the ACCC consumer-guarantees exposure you inherit the moment your agent speaks to a customer, the APRA and ASIC overlay for financial services, and the 50-point security checklist you should hold any deployment against.
This article gives you the shape of the document that turns all of that work into a board approval. It is the AU-specific business-case template for an Australian business, including the 24 to 36-month cost stack the Productivity Commission's 2024 report on the application of AI implies most cases are underestimating, the benefit baselines a CFO will actually accept, the risk register a director can defend, and the governance pathway that aligns with the AICD's 2024 AI Governance for Directors guidance and the DISR Voluntary AI Safety Standard.
Part 1: The five sections every AU AI business case needs
A board-grade AI case is a capital-allocation document carrying a regulatory overlay. It runs to five sections, in this order.
1. Strategic alignment: why this, why now, why us
What good looks like: one paragraph that ties the proposed AI bet to a specific strategic objective the board has already endorsed, a sentence on why the timing is now that is more concrete than "AI is the future", and a sentence on why the organisation has a structural reason it can execute this particular use case (data access, existing process maturity, customer relationship). Boards reject AI cases that read as "everyone else is doing it". The CSIRO and the National AI Centre's 2024 AI ecosystem report is useful baseline reading for sector context, but the alignment must be specific to your organisation.
2. The honest 24 to 36-month cost stack
What good looks like: the full economic cost of running the capability, carried well past the year-one licence fee. Boards have been burned often enough on AI pilots that morphed into multi-year cost commitments without a refreshed business case. We covered the operational stack in day-two production reality and the staffing component in the staffing-gap analysis. The cost stack section consolidates both into a single board-readable view, with explicit ranges and citations.
3. The benefit case
What good looks like: four to six benefit lines, each with a credible baseline measured today, a credible target, the source of the target evidence, and a named owner who will be held to the post-deployment number. Productivity gains alone rarely carry a case. Risk reduction and customer-experience proxies materially strengthen it.
4. The risk register
What good looks like: 10 to 12 named risks, each with likelihood, impact, control, control owner, and the cost of the control. The risks must include the ones the board is actually exposed to under Australian law: Australian Consumer Law misleading-conduct exposure, Privacy Act and Notifiable Data Breach liability, model deprecation, vendor concentration, and the staffing and capability gap.
5. Governance and review cadence
What good looks like: a clear answer to four questions a director will ask. Who decides? Who reviews? When do we scale, and when do we kill it? Reference to the DISR Voluntary AI Safety Standard and to ISO/IEC 42001:2023 is increasingly expected in AU board papers; the AICD's director guidance frames the duty of care.
Part 2: The 24 to 36-month cost stack
The single most common reason an AI case is approved at pilot and then rejected at scale is that the pilot case understated the run cost. The McKinsey Global Institute's 2024 State of AI and Gartner's 2024 AI cost guidance both note that organisations consistently underestimate the operating, observability, and governance cost lines once a model is in production. Here is the stack a board will accept for an AU deployment of one bounded agent use case (e.g. reconciliation, customer triage, or quoting).
24 to 36 month cost stack for a single AU agent deployment
Ranges are intentional. The lower bound assumes a single bounded use case and a tightly scoped vendor product. The upper bound assumes a custom-built agent with multiple integrations and internal staffing. The Productivity Commission report and the DISR National AI Capability Plan workforce data both indicate AU organisations consistently under-budget the specialist staffing line; the Tech Council of Australia's AI workforce reports put senior AI engineer salaries above $200,000 fully loaded.
Boards expect to see the corresponding offset against existing run-cost lines. That belongs in Part 3.
Part 3: The benefit case
A benefit case lands when every line has a baseline measured today and a target a CFO would accept. Avoid productivity-only cases. The OECD's 2024 AI in Business report finds that risk-reduction and quality benefits frequently exceed pure productivity gains over a 24-month horizon. Use this shape, replacing the metrics with your actual processes.
Benefit baselines and targets a CFO will accept
| Metric | Today (baseline, evidence required) | Target (24 months, evidence required) | Improvement |
|---|---|---|---|
| Cycle time on the target process (e.g. quote turnaround) | Measured median in current ops report | 30-50% reduction, time-stamped from the same system | Source: internal ops report, vendor case data |
| Error or rework rate on the same process | Audit sample, last 90 days | Defined post-deployment audit at month 3 and month 12 | Source: internal audit, NIST AI RMF guidance |
| Headcount efficiency (FTE redeployed, not removed) | Time-tracking baseline by task | Hours redirected to higher-value work, named recipient roles | Source: workforce plan, board people committee |
| Customer experience proxy (NPS, complaint volume, FCR) | Trailing 12 months, source named | Conservative 5-10 point improvement on chosen proxy | Source: CX system, ACCC complaint trend data |
| Risk reduction (incidents avoided, control coverage) | Incident register, last 24 months | Defined control coverage measured against ISO 42001 | Source: risk register, AICD director guidance |
| Revenue-side benefit (conversion, retention, recovery) | CRM and finance system trailing baseline | Defined uplift target with clear attribution method | Source: CRM, finance system, model evals |
A credible baseline is one a finance committee can re-derive from a source system. A credible target is one a department head will sign their name against. If either is missing, cut the line rather than soften it. Boards detect "directional" benefit lines and discount the entire case.
For a worked operational example of how risk-reduction and quality benefits accrue in practice, see our Carbonly compliance automation case study and our RootCauseAI investigation tool case study.
Part 4: The risk register
A board paper that ignores the AU regulatory perimeter will be sent back. The register below is the minimum shape for an agent deployment. Each line names a risk, the likelihood and impact, the control, the owner of the control, and the indicative annual cost of operating the control.
AI program risk register, AU deployment
| Metric | Risk, likelihood, impact | Control, owner, annual control cost | Improvement |
|---|---|---|---|
| 1. ACL ss18 / 29 misleading conduct exposure when the agent speaks to customers | Likelihood: Medium. Impact: High (fines, ACCC action, brand) | Output review, disclaimers, escalation paths. Owner: GM Customer. Cost: $30,000 - $60,000 p.a. | Reference: ACCC Guidance + Moffatt v Air Canada precedent |
| 2. Privacy Act breach or Notifiable Data Breach event | Likelihood: Medium. Impact: High (regulator, reputation) | PIA, data minimisation, OAIC-aligned retention. Owner: Privacy Officer. Cost: $25,000 - $50,000 p.a. | Reference: OAIC NDB scheme, Privacy Act 1988 |
| 3. Model deprecation by vendor (model retired, API end-of-life) | Likelihood: High over 24 months. Impact: Medium-High | Multi-model fallback, frozen-version contracts. Owner: CTO. Cost: $15,000 - $40,000 p.a. | Reference: OpenAI / Anthropic published deprecation calendars |
| 4. Vendor concentration / lock-in | Likelihood: High. Impact: High at exit | Data portability clauses, exit testing. Owner: Procurement. Cost: $10,000 - $25,000 p.a. | Reference: AU vendor selection framework |
| 5. Staffing capability gap (cannot hire or retain operators) | Likelihood: High. Impact: High | Managed service or partner cover. Owner: COO. Cost: built into operating stack | Reference: DISR / Tech Council workforce data |
| 6. Brand / reputation incident (Moffatt, DPD, Chevrolet style) | Likelihood: Medium. Impact: High | Output guardrails, human-in-the-loop on sensitive paths. Owner: CMO. Cost: $20,000 - $40,000 p.a. | Reference: Moffatt v Air Canada, DPD chatbot, Chevrolet of Watsonville incidents |
| 7. Inaccurate or hallucinated output on regulated content | Likelihood: Medium. Impact: High (sector-specific) | Evals on regulated paths, retrieval grounding. Owner: Head of Compliance. Cost: $20,000 - $50,000 p.a. | Reference: NIST AI RMF, ISO 42001 |
| 8. Cybersecurity / prompt injection / data exfiltration | Likelihood: Medium. Impact: High | Security checklist coverage, red-team cadence. Owner: CISO. Cost: $30,000 - $70,000 p.a. | Reference: 50-point AI security checklist |
| 9. Unclear accountability and director duty of care | Likelihood: Medium. Impact: High at incident | Documented decision rights, AICD-aligned register. Owner: Board. Cost: nominal | Reference: AICD AI governance guidance 2024 |
| 10. Regulatory shift (Voluntary Standard moving to mandatory) | Likelihood: Medium over 24-36 months. Impact: Medium | Track DISR consultation, build to ISO 42001. Owner: GC. Cost: $10,000 - $20,000 p.a. | Reference: DISR Voluntary AI Safety Standard, AU mandatory-guardrails consultation |
| 11. Insurance gap on AI-amplified loss | Likelihood: Medium. Impact: High at incident | Broker review, endorsement update. Owner: CFO. Cost: $5,000 - $15,000 p.a. | Reference: insurer guidance on generative AI exposure |
| 12. Sunk-cost continuation past the kill criterion | Likelihood: Medium. Impact: Medium-High | Pre-agreed quarterly scale-or-kill gate. Owner: Sponsor + Board. Cost: nominal | Reference: governance pathway, Part 5 below |
The likelihoods and impacts here are baseline assumptions for a typical AU deployment. Each register should be re-rated against the specific use case. What earns the register its place is that every line has a named control owner sitting in the room when the board approves, which matters more than the precision of any individual score.
Part 5: Governance and the approval pathway
The pathway is what turns "approval of a single agent build" into a defensible program. It also gives the board the option to stop without losing face.
Governance and approval pathway for an AU AI program
The pathway has three properties that boards reward. It is reversible (the kill criterion is real and someone will use it). It is observable (every gate produces a report against the original case, with the original numbers still in it). It is regulator-defensible (the artefacts produced at each gate are the artefacts a regulator or court would ask for).
For ongoing program operation, see our managed AI services and AI strategy practice pages.
Part 6: Is this AI bet board-ready?
Before submitting, run the case against the five questions every director will ask.
Is this AI bet board-ready?
A case that passes all five gates is one a board can approve in a single sitting. A case that fails any one of them is one the board will defer pending more work, regardless of how strong the underlying idea is.
Part 7: The board readout, in CFO language
The executive summary slide is where most cases are won or lost. It should fit on one page and contain exactly this list, in this order, in this voice.
- The bet. One sentence naming the process, the agent's role in it, and the scope boundary. No capability language.
- The baseline. One line, from a named source system, dated, with the metric we are improving.
- The 24-month cost. Total, with the build line and the run line called out separately.
- The 24-month benefit. Total, with the productivity, risk-reduction and revenue lines called out separately.
- Net position at 24 months and payback month. Single number, with the worst-case sensitivity (e.g. "$420,000 net at 24 months; payback month 14; worst-case payback month 22").
- The top three risks and their controls. One line each, naming the control owner.
- The kill criterion. Single sentence. "If by month 6 we have not achieved [metric], the program is wound down with [residual cost]."
- The governance cadence. "Quarterly review against this paper, scale-or-kill gate at month 6."
- The approval requested. Single line: scope, capex, opex, start date, first review date.
- The sponsor and the named owners. Sponsor, control owners, and the executive accountable for the post-deployment benefit number.
That is the slide. Everything else is appendix. The discipline of compressing the case to those 10 lines is what turns a transformation pitch into a capital allocation a board will sign.
For deeper context on the operational and accountability shape this case sits on top of, the AI agent governance, data access and human override article in this series walks through the day-two accountability structure that should be referenced in the readout.
Where to go next
If you are preparing a board paper in the next quarter, the most useful hour you can spend is re-reading the prior seven series articles back-to-back: DIY agent risk, production reality, staffing gap, vendor selection, ACCC exposure, financial services compliance, and the 50-point security checklist. Each feeds a section of the case above.
For a confidential review of your specific board paper before submission, including the cost stack and risk register against AU regulatory expectations, book a 30-minute consultation. We work with AU executive teams who want their AI program approved on the first attempt and defensible at every review thereafter.
Related Reading:
- Why Australian Businesses Should Not DIY AI Agents Without Understanding the Risk - Series article 1: the technical case against unsupervised in-house builds.
- Operating AI Agents: The Production Reality for Australian Businesses - Series article 2: the day-two operational cost the pilot business case usually misses.
- The AI Agent Staffing Gap for Australian Businesses - Series article 3: why the staffing line in the cost stack is the line that breaks most cases.
- AI Agent Governance, Data Access and Human Override - The accountability structure that sits underneath the governance pathway in this article.
Research synthesised from the Productivity Commission report on the application of AI (2024), the DISR Voluntary AI Safety Standard (2024), AICD AI Governance for Directors guidance (2024), the CSIRO and National AI Centre AI ecosystem reports, the OAIC Notifiable Data Breach scheme, ISO/IEC 42001:2023, NIST AI Risk Management Framework, the McKinsey Global Institute State of AI 2024, Gartner AI cost guidance (2024), and the Tech Council of Australia AI workforce reports.