What does AI governance look like for a 30-person business?
It should fit on a few pages and be light enough to keep current. For around 30 staff, we recommend:
- A one-page AI policy covering approved uses, banned data and who approves new tools.
- An approved-tools list with the business account each tool must be used through.
- Discovery of the AI tools already in use, repeated regularly.
- A regular review of the tools list, the risk register and any incidents.
- One accountable owner, usually an executive, who approves new AI uses.
Each AI use then gets a line in a simple risk register:
| Use | Main risk | Treatment | Owner |
|---|
| Drafting client emails with a business AI account | Client personal information entered into the tool | Business account with training switched off, staff briefing, no tax file numbers or health details | Operations manager |
Which AI frameworks should an Australian business follow?
You don’t need every framework. We use each for what it does well and map your controls across them, so one piece of work supports several obligations.
| Framework | How we use it |
|---|
| Guidance for AI Adoption (National AI Centre, 2025) | Six essential practices: decide who is accountable, understand impacts and plan accordingly, measure and manage risks, share essential information, test and monitor, and maintain human control |
| NIST AI RMF 1.0 (2023) | Structures the risk process across Govern, Map, Measure and Manage, with the NIST AI 600-1 profile for generative AI |
| ISO/IEC 42001:2023 | Provides the management system and Annex A controls if you want certification |
| OWASP Top 10 for LLM Applications (2025) | Sets the security risks we test for in chatbots, agents and document search tools |
The Guidance for AI Adoption is the current Australian guidance. Published in October 2025, it supersedes and builds on its predecessor, Australia’s Voluntary AI Safety Standard, and its ten guardrails. If you have no management system yet, our ISO 27001 consulting service can set up the foundation that ISO/IEC 42001 builds on.
The Australian Signals Directorate (ASD) has also released the ASD Essentials series, which includes an “Executive artificial intelligence accountability” principle. It sets out what executives are accountable for when their organisation uses AI, and ASD treats AI as an asset to include when scoping the Essentials domains. Our ASD Essentials page explains the series.
For organisations covered by the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs) apply to personal information in AI inputs and outputs. The OAIC explains which small businesses are covered, and its guidance on commercially available AI products sets out what it expects.
The Privacy and Other Legislation Amendment Act 2024 also added automated decision-making transparency obligations. Once they commence, privacy policies will need to explain when a computer program uses personal information to make a decision, or to do something substantially and directly related to making it, where the decision could significantly affect someone’s rights or interests. The OAIC has published guidance on these transparency obligations, and we help you identify which of your processes they cover.
How do we test AI systems for security weaknesses?
Any AI system that reads untrusted text can be attacked through that text. Our penetration testing team tests these systems hands-on, guided by the OWASP Top 10 for LLM Applications and the MITRE ATLAS knowledge base of attacks on AI systems. For agents, we also use the OWASP Top 10 for Agentic Applications 2026. The main risks we look for are:
- Prompt injection (LLM01): we try direct attacks and instructions hidden in emails, web pages and uploaded files.
- Sensitive information disclosure (LLM02): the system revealing personal data or documents a user should not see.
- Excessive agency (LLM06): an agent holding more permissions or tools than its job needs.
- System prompt leakage (LLM07): the hidden instructions, and any credentials or business rules in them, being exposed.
- Vector and embedding weaknesses (LLM08): document search that skips access checks or can be poisoned.
Each finding is reported in a consistent format. For example: “Indirect prompt injection through uploaded PDF. Risk: high. Evidence: a hidden instruction in a test document made the assistant email its summary to an external address. Fix: require approval for outbound email and strip hidden text before processing.”
