Free resource

AI policy and governance pack

A working AI use policy you can adapt, the governance decisions that have to be made before you write one, the questions to put to any vendor in writing, and a twenty minute readiness assessment. Written for Australian organisations and free to download.

Book A Call

What is inside

Four parts, eight pages, all of it usable

This is a working document rather than a brochure. Two of the four parts are written to be adapted and adopted directly.

01

The five decisions behind any AI policy

Which tools are approved, what may be entered into them, who checks output before it is relied on, where the processing happens, and who owns the document. Each one paired with what goes wrong when it is left open.

02

An AI use policy, ready to adapt

Seven short sections covering purpose, approved tools, data classification, accountability for output, disclosure, records and reporting. Written in plain language with bracketed placeholders, so it can be lifted into your own template and kept to two pages.

03

Six vendor questions to ask in writing

Where processing happens, whether your content trains a model, retention after deletion, who at the vendor can read your data, what you get back if you leave, and what accuracy is claimed and measured on. A verbal assurance cannot be produced later.

04

A twenty minute readiness assessment

Ten scored statements and three bands with honest interpretations, including what to do at each. Most organisations land in the middle band, where the rules exist and the measurement does not.

Who it is for

Two situations this is written for

The pack assumes AI is already in use somewhere in your organisation, because in most cases it is.

You need a policy and do not want to start from a blank page

Part two is the document. Adapt the bracketed sections, keep it to two pages, and give it an owner and a review date. The most common failure is a policy nobody reads, so length is a feature rather than an omission.

Start at part two

You are being asked whether you are ready

Part four is a scored assessment you can complete with the person who owns the data and the person who owns the risk. It gives you a number, a band and a next step rather than an opinion.

Start at part four

Free download

Send me the AI policy and governance pack

We use your details to send you this document and to answer you if you get in touch. We do not add you to a mailing list and we do not pass your details to anybody else. See our privacy policy.

Common questions

Questions about the pack

What people ask before giving an email address for something.

What does it cost?

Nothing. We are vendor funded, so the service costs your business nothing.

Will I be added to a sales sequence?

No. You receive the pack, and we contact you only if you ask us to. There is no drip campaign attached to this download.

Is this legal advice?

No. It does not replace a privacy impact assessment where you handle personal or health information, and where you hold Australian government data your obligations come from that agency framework. The pack helps you prepare for those questions rather than answer them.

Does it cover the state government frameworks?

It notes where they change what you have to evidence. Victorian public sector bodies and their suppliers work to the Victorian Protective Data Security Standards, New South Wales agencies to the state Cyber Security Policy, and Queensland departments to Information Security Policy IS18.

Can we use the policy as it is written?

It is written to be adapted rather than adopted verbatim. Replace the bracketed sections, decide the five questions in part one first, and have somebody accountable sign it off.

What if we want help after reading it?

Book a call. We compare the whole market, test accuracy on your own material, and hand you a shortlist with the commercials attached.

We are vendor funded and completely free to your business. Always focused on the right outcome.

Work out what is worth automating first

Most organisations finish the assessment with two or three processes worth automating and no clear view of what the market charges for them. That is the part we do.