The case for AI governance begins with what is already happening inside organisations. Employees use general-purpose tools. Business teams purchase AI-enabled products. Suppliers add AI features to software that is already deployed. Boards are asked to oversee the opportunity and the risk, often without a current view of where AI is actually being used.

The numbers show a visibility problem

Research published by the Governance Institute of Australia and sponsored by BoardPro surveyed 485 directors, executives and governance professionals across Australasia and beyond. It found:

79%used AI tools at least weekly
44%of boards had no agreed position on AI
2%had a formal framework with clear accountability and regular reporting
3 in 4received information on AI risks and impacts only occasionally or never

The survey covered 485 directors, executives and governance professionals. Among those respondents, practical adoption had moved well ahead of formal oversight. Organisations with a visible, repeatable management process are better placed to understand and govern their use of AI.

Source: Governance Institute of Australia research on AI in the boardroom.

Why the gap is easy to miss

AI rarely arrives through one controlled programme. It enters through several channels at once:

  • enterprise tools such as productivity assistants and contact-centre platforms;
  • AI features added to existing software by suppliers;
  • specialist products used in recruitment, education, care, finance or customer service;
  • small business-led experiments and pilots;
  • public generative-AI tools used by individual employees.

A technology inventory will capture some of this. A procurement register will capture some more. Neither necessarily tells management the organisational purpose, affected people, accountable owner, data involved, approval basis or what changed after approval.

Give the board a management view

Boards need a management view that supports oversight. The useful questions are practical:

  • Where is AI being used for a material business purpose?
  • Who is accountable for the outcome?
  • Which uses affect people, sensitive information, essential services or important decisions?
  • What has been assessed and approved?
  • Which controls, conditions or evidence are still outstanding?
  • What changed, what went wrong and what needs a decision?

The Australian Institute of Company Directors has similarly emphasised visibility, accountability, risk-based oversight and ongoing monitoring. Its director resources describe AI governance as a cross-functional activity rather than a responsibility that can sit only with IT. See the AICD and Human Technology Institute governance resources.

Existing law still matters

Existing Australian law already creates real governance work for many AI uses. Privacy, consumer, corporations, workplace, safety, anti-discrimination and sector-specific obligations can apply depending on the use. The OAIC states that the Privacy Act applies to uses of AI involving personal information and has published specific guidance for organisations selecting and using commercially available AI products.

See the OAIC guidance on privacy and commercially available AI products.

Accountable review

A governance framework helps an organisation identify issues, allocate responsibility, retain evidence and route questions to appropriately qualified legal, privacy, security and professional reviewers.

A practical business response

Start with a controlled baseline:

  1. State the organisation’s position on acceptable and prohibited AI use.
  2. Create one accountable operating model across business, technology, privacy, security and risk.
  3. Build a register with one record for each distinct organisational AI use.
  4. Assess each use in proportion to its impact and uncertainty.
  5. Record controls, evidence, approvals and conditions.
  6. Bring incidents, supplier changes and material changes back into review.
  7. Report the portfolio, exceptions and decisions required on a regular cadence.

This approach also aligns with the Australian Government’s voluntary guidance for safe and responsible AI adoption, which covers accountability, risk management, testing, human oversight, records and an AI inventory. The guidance is voluntary for the private sector and should be labelled that way.

Where software starts to earn its place

A spreadsheet can be appropriate for a small, stable portfolio with one owner and infrequent reporting. Dedicated workflow becomes valuable when the organisation has multiple owners, recurring assessments and approvals, supplier evidence, material changes, periodic reviews and a board or executive reporting cycle.

Software earns its place by keeping the governance method consistent and producing reports from a maintained record. This removes the quarterly chase through inboxes and spreadsheets.

Support informed adoption

Good governance makes AI adoption more deliberate. It helps leaders distinguish useful, proportionate experimentation from uses that need stronger controls or should be stopped. It also makes ownership and expected value visible, so the organisation can govern opportunity as well as risk.