Practical governance for AI, security and risk
AI Governance should speed you up
Most organisations meet governance as a brake. A policy that arrives after the decision, a control that stops something useful, a framework sized for an organisation ten times larger.
It does not have to work that way.
Done properly, governance is the thing that lets you move: it tells you which risks you have accepted, which you have not, and who decides. That is what makes a Board comfortable saying yes.
Making sense of the AI mess
Ten weeks to go
Are you ready for the 10 December Australian Privacy Principle changes?
From 10 December, your privacy policy must name every system that makes or shapes a decision about a client, and what data it uses. Intake scoring, rostering, AI note-takers and the odd spreadsheet all count. The 10 December Privacy Changes AI Systems Audit finds them, rates the risk, and gives your CEO a briefing and your compliance lead a plan. Fixed price, three to four weeks.
Get the brochure Read what changesAI Strategy
Decide where AI actually helps, what it will cost, and what needs to be in place first.
AI Governance
Practical frameworks for oversight and accountability, sized to your risk rather than to a standard.
AI Awareness Training
Twenty minutes online gets your team using AI well, not avoiding it.
Board Briefing or in person training.
Right Fit for Risk - RFFR
Right Fit for Risk accreditation for Government contracted providers, including the new AI assessment requirements.
RFFR AI Assessment
Get AI use in departmental service delivery assessed, approved and kept approved. For those that already have RFFR.
Free RFFR 5 minute AI self checkISO 42001
Build an AI management system that works in practice and survives certification.
ISO 27001
Information security management, proportionate controls, certification readiness.
Important News
AI Assessment is now part of the RFFR accreditation
If you hold a departmental contract, AI just became part of your accreditation. This is in force right now.
DEWR now requires AI use in contracted service delivery to be formally assessed and approved, and once approved it sits inside your RFFR accreditation and maintenance lifecycle. Most providers have not caught up with this yet. If you are one of them, it is worth a conversation before your next milestone.
Not sure what you are running?
Experience
I have seen what a bad day actually looks like
One of my IT leadership roles began two weeks after a ransomware attack destroyed the IT environment of a children’s services organisation. There were no computing services running on the day I walked in.
Rebuilding it taught me more about governance than any framework has. You find out quickly which controls would have changed the outcome, which ones were theatre, and how fast an organisation loses the ability to do its actual job when the systems are simply gone.
A few months later, once the environment was rebuilt and hardened, I met Human Error in person. Not the concept: the character Mimecast built its awareness training around, whose whole job is to click the thing you asked people not to click. After the year we had just had, the introduction felt earned.
Human Error, in person. He is extremely good at his job, which is the whole problem.
Not sure where to start?
Tell me what you're facing. You'll get a straight answer on whether this is the right piece of work, and what it would involve.