Book a call
Risk manager presenting an AI risk matrix to executives in a boardroom

AI governance

AI governance your auditors and board can check

We find every AI use across your sites, including tools staff use without approval, give each an owner and a risk rating, and set up controls and board reporting your auditors can test.

Talk to us about AI governance

What we deliver

  • AI inventory

    Every AI tool and feature in use, including shadow AI found in sign-in logs and a no-blame staff survey.

  • Risk rating

    Each use rated on data sensitivity and effect on people, with a named owner.

  • AI use policy

    Approved tools, data classes and an approval path for new tools.

  • Human review

    Where a person checks output before it reaches a customer or a decision about someone.

  • Privacy impact assessments

    For uses of personal information, plus the automated decision inventory behind the privacy policy disclosures required from 10 December 2026.

  • Board reporting

    A quarterly page of uses by risk rating, open actions and incidents.

Manager signing off a document beside a laptop

Mapped to the guidance you are asked about

Controls map to the six essential practices in the Guidance for AI Adoption, the NSW AI Assessment Framework and ISO/IEC 42001. We align with ISO/IEC 42001; an accredited body certifies.

  • Guidance for AI Adoption
  • NSW AI Assessment Framework
  • ISO/IEC 42001

How an engagement runs

  1. Discover

    A fixed-fee phase on one business unit, comparing AI in use with what is registered.

  2. Assess

    Risk ratings and privacy impact assessments agreed with each owner.

  3. Control

    Policy, approvals and review steps set up in Microsoft 365 and your systems.

  4. Report

    The first board report, then we run the cycle or hand it to your risk team.

Go deeper

Where we deliver

Questions

What does an AI governance engagement cover first?

An inventory of AI in use from sign-in logs and a no-blame survey, a risk rating and owner for each use, and the approval path for new tools. Policy wording is covered in the staff AI use policy answer.

Do we need ISO/IEC 42001 certification?

No Australian law requires it, though some enterprise and government buyers ask. Aligning controls first keeps certification open.

Who can help with AI governance in Sydney, Melbourne or Brisbane?

Solve8 runs the inventory, risk ratings and controls with your privacy, IT and risk leads, with workshops on site. Your legal adviser approves policy wording.

Related

Know what AI is running before the board asks

A 30-minute review with a senior consultant. You leave with a written one-page summary you can share internally.

Talk to us about AI governance How we work

Fixed-fee phases, agreed before we start. Stop after any phase.