AI Governance & Risk Consultancy

We help NSW businesses put in place the rules and controls they need before they deploy AI in customer-facing work. That means a written AI policy, a list of what can and cannot go into a prompt, and a log of what is asked and what comes back.

What we produce

• A one-page acceptable use policy for AI tools, that your team will actually follow.
• A data classification rule for what content can be processed by an AI model.
• Access controls for who can use the tool, and what they can ask.
• An audit log of prompts and responses for review.
• A human-in-the-loop rule for anything the tool drafts that goes to a customer.

Australian context

We align the policy to the Privacy Act 1988 and to the guidance the Office of the Australian Information Commissioner has published on automated decision-making. We do not over-engineer it. A small business does not need a 50-page AI ethics document. It needs a rulebook its team can follow from week one.

What an AI governance policy actually contains

Most AI policy documents we have seen are either a 50-page ethics essay that no one reads, or a single line that says "use AI responsibly". We write something in between: a one-page acceptable use policy that tells your team what can go into a prompt, what cannot, and who approves what.

Data classification rules

Not every piece of information is suitable for an AI tool. We classify your data: public, internal, confidential and restricted. The policy states which classes can be processed by which tool, and which must never leave the organisation.

Prompt and response logging

We log prompts and responses inside your tenant. You can review what was asked, what came back, and whether the answer was used. You can show an auditor exactly what was asked, what came back, and whether the answer was used.

Human-in-the-loop rules

Anything the AI drafts that goes to a customer, a regulator or a court is reviewed by a human before it leaves the organisation. The AI drafts. The human decides. Every AI output that leaves the organisation is reviewed by a human first.

Australian regulatory context

The Office of the Australian Information Commissioner has published guidance on automated decision-making and the Privacy Act. The Australian Communications and Media Authority has published guidance on generative AI. We align your policy to this guidance without over-reaching. A small business does not need a EU AI Act compliance file. It needs a rulebook its team follows from week one.