Walk into your CFO’s office and say you want to hire someone. You will not get out of the room without answering four questions.
What is the role? What will they actually do? What is the return, and how will we know we got it? Could someone we already employ do the work instead?
Get past those and two more arrive: Who will manage them? What happens if it does not work out?
Nobody thinks that is unreasonable. It is the ordinary discipline that stops an organisation accumulating headcount it cannot explain.
Now watch the same organisation approve AI.
Someone senior says we need an AI strategy, we cannot afford to get left behind. Heads nod, because everyone in the room has read the same three articles. It goes in the minutes as a strategic priority. Six weeks later there are two hundred Copilot licences switched on, and if you ask what job they are doing, nobody in the building can tell you. The CFO would never have approved a person to do this job without all the questions being answered satisfactorily.
Same Board. Same CFO. Not one of the six questions.
First, in fairness to the people saying it
The fear is not irrational.
Directors carry a duty to the organisation in both directions. Sitting still while your competitors halve the time it takes to produce a report or answer a tender is a real risk, and a board that spent 2024 saying no to everything has cause to feel behind. The technology is genuinely good at some of the work these organisations do. Peers are moving. Funders are starting to ask. For a chief executive, “we are looking at AI” is an easier sentence to say to a member, a client or a journalist than “we have decided to wait”.
So the instinct is sound. Wanting to adopt AI is not the problem.
The problem is that “we cannot get left behind” is a feeling, and feelings do not survive contact with an assessor, a funder, a privacy regulator or a bad outcome. A hiring request has to become a business case before it becomes a decision. An AI request should have to do the same, and at the moment it usually does not.
Why the AI ask escapes the scrutiny
Four reasons, and none of them is that your CFO is asleep.
It arrives as strategy, not spend. Headcount hits the payroll line and gets tested. An AI strategy is a direction, and directions do not have a business case attached until somebody asks for one.
Often there is nothing to approve. The feature was already in the licence. The vendor switched summarisation on in a release note. Free tiers leave no invoice at all. Every financial control you own is triggered by a purchase, and much of this arrives without one.
Nobody wants to be the person who does not get it. There is a social cost to asking a basic question about AI in a board meeting, and no social cost at all to nodding. That asymmetry is doing real damage in Australian boardrooms.
The unit of adoption is invisible. A person has a start date, a desk and a position description. AI is a capability spread across tools you already own, and it does not present itself for approval.
Six questions every hire has to answer. Most AI proposals answer none of them, and the questions are not any harder to ask.
The six questions, translated
You can run these on any proposal in about twenty minutes.
1. What is the role?
AI is not a role, any more than a person is a role. You would reject a requisition that said “we need a human, our competitors have several”. Name the job: draft shift notes from support workers’ voice recordings, triage inbound service desk tickets, summarise 60-page tender documents into a two-page brief.
If nobody can write the position description, the organisation is not ready to buy. It is ready to experiment, and those are different decisions with different budgets.
2. What will it do all day, and what will it not do?
A role has edges. A new starter’s scope is written down and everyone respects it.
A general assistant switched on across your whole tenancy has no edges at all. It does whatever anyone points it at, on whatever data that person can already reach. That is not hiring a bookkeeper. That is handing the chequebook to the office and hoping.
3. What is the return, measured against what baseline?
If you cannot say how long the task takes today, you cannot claim to have improved it. Get the baseline before the pilot, not after.
Be honest about what a return actually is. Eleven minutes saved, spread across forty people, none of whom now do anything different with the time, is not a return. It is a feeling with a spreadsheet attached.
Worth knowing too that at least one Commonwealth department has already ruled efficiency out as sufficient justification on its own. The Department of Employment and Workplace Relations tells contracted providers that a business case built on cost alone will not clear the bar, and asks for a defined benefit for participants, communities or service delivery, supported by evidence. Even if you are nowhere near that department, that is the standard the sector is drifting towards.
4. Could someone we already have do the work?
For a hire, this question kills half of all requisitions, and rightly.
The AI version is the same question in different clothes. Could a better template do it. Could a fixed process do it. Could a report somebody already builds do it. Is there a feature in a system you are already paying for.
A good number of the AI proposals I see are automation problems, or training problems, or a form with too many fields. That is not an argument against AI. It is an argument for knowing which problem you are solving before you buy something to solve it.
5. Who manages it?
Every person in your organisation has a manager, a probation period and someone who reviews their work before it reaches a client. Most AI in Australian organisations has none of the three.
This gets sharper with agents, meaning AI that does not just answer but acts: reads the mailbox, updates the record, sends the email. An agent running under a staff member’s own account, with that person’s full access, is an employee with no supervisor, no induction and no name in the logs.
6. How would we know it is not working, and how do we stop?
Probation exists because sometimes a hire does not work, and everyone agreed in advance what would happen next.
Ask the same of the tool. What will we measure. When do we review it. Who can switch it off, and how fast. What happens to our data if we stop paying. Name the person for each of those. “The vendor” is not a person.
And four questions you never have to ask a person
The six above are the ones you already know how to ask. These four have no equivalent in a hiring conversation, and they are where the risk actually sits.
Where does the work go? A staff member’s drafting stays in the building. A tool’s does not necessarily stay in the country. Is the data processed and stored in Australia, and can you point to the clause that says so rather than the marketing page that implies it.
What happens when it is confidently wrong? A graduate who was wrong one time in twenty and never flagged it would not last the month. That is roughly the behaviour you are buying, and the mitigation is a person who checks. Say who, by name, and make sure they have time in their day to do it.
Can the person on the other end find out and push back? If AI shapes a decision about someone’s service, roster, eligibility or job application, they may have a right to know. From 10 December 2026 a new transparency obligation in Australian Privacy Principle 1 requires privacy policies to disclose where computer programs make, or substantially contribute to, decisions that significantly affect people. Spreadsheets count. AI certainly does.
What do our funder, our regulator and our insurer say? A new employee arrives inside a system of employment law, insurance and background checks that somebody else designed. An AI tool arrives with none of that, and the answer differs by contract. Ask before, not after.
What to put to the board instead
Replace the resolution you have now with one you can test.
Not “the organisation will develop an AI strategy”. Try this: the organisation will not deploy an AI capability into service delivery until the six approval questions have been answered in writing and recorded in the AI register, and the board will see the register each quarter.
That single sentence does more work than a strategy document, because it creates a gate and a record. It is also most of what an ISO 42001 assessor asks for, most of what a DEWR Third Party AI application needs, and the beginning of the automated decision-making inventory you need before December.
One page per system. Six boxes matching the six questions, with the four risk questions underneath. If a proposal cannot fill the page, it is not ready. If it can, you have approved something you can still explain in twelve months.
The Board question
Do not ask the Board whether the organisation is across AI. Everyone will say yes and nobody will be lying, exactly.
Ask this instead. For each AI capability currently switched on in this organisation, could we produce the same one page we would have required before hiring a person to do that job?
If the answer is no, that is not an AI problem. It is a governance gap that already exists for people and purchases and has simply not been extended to the newest thing arriving in the building. Extending it is an afternoon per system, not a program of work.
Governance Works helps Australian boards and executives put practical AI governance in place, sized to the risk actually in front of them. The AI Governance Awareness Pack covers the ground in this post: a discovery audit of what is actually running, an assessment of each system, an acceptable use policy written for your organisation rather than a template, and a maturity assessment. For organisations heading towards certification, ISO 42001 readiness builds the same gate into a management system an assessor will recognise. Email hello@governanceworks.com.au or visit governanceworks.com.au.
Paul Berryman is Principal Consultant at Governance Works. This article is general information, not legal advice.
Governance Works · Liability limited by a scheme approved under Professional Standards Legislation.