Responsible AI as Working Controls, Not a Policy PDF

No. We do not offer ISO/IEC 42001 certification, we are not a certification body, and we do not hold the certification ourselves. Certification is issued by accredited certification bodies after an audit of your AI management system. What we provide is engineering: the inventory, evaluations, logging, oversight, documentation and incident controls. If you are preparing for certification, those controls and records can support that work, alongside a certification body and any management system consultant you engage.

It is voluntary guidance published by the National AI Centre on 21 October 2025 as updated, simplified guidance that evolves the 2024 Voluntary AI Safety Standard. It sets out six essential practices: decide who is accountable, understand impacts and plan accordingly, measure and manage risks, share essential information, test and monitor, and maintain human control. It comes in a shorter Foundations version and a more detailed Implementation guidance version for technical and governance professionals.

From 10 December 2026, APP 1 requires APP entities to include information in their privacy policies about decisions made by computer programs using personal information, or where a program does something substantially and directly related to making the decision, if the decision could reasonably be expected to significantly affect an individual's rights or interests. It is a transparency obligation. The engineering challenge is knowing where such decisions occur, which is why we start with an inventory. Your privacy and legal advisers decide what must be disclosed.

No. Your risk, legal and privacy teams, or advisers you appoint, own policy. We build the technical controls that put policy into practice and generate evidence: tests, logs, review workflows, documentation and incident processes. We are happy to work from a policy you already have, or alongside advisers writing one.

Often, yes. Logging, evaluation and monitoring can usually be added around an existing system at its interfaces. For AI features inside third party SaaS products, controls are more limited, so the work shifts to vendor due diligence, configuration review, usage monitoring and documenting what the vendor does and does not provide.

Where a system's outputs affect people, we define with you which groups and outcomes to compare, build test sets that represent them, and measure differences in error rates or outcomes. Some attributes are sensitive information under the Privacy Act, so how test data is sourced and handled is agreed with your privacy team first. Results are documented in the system card with any mitigations.

No engineering work can guarantee compliance on its own. We build controls to your requirements and provide evidence of what they do. Whether that meets a particular legal or regulatory obligation is an assessment for your legal, privacy and compliance advisers. This page is general information, not legal advice.

Responsible AI means designing, building and using AI systems so that someone is accountable for them, they are tested and monitored, people are told what they do, and humans stay in control where it matters. Australia's Guidance for AI Adoption turns that into six essential practices. AI governance is how an organisation makes sure those principles actually hold in each system, rather than only in a policy.

Every build is priced on its own scope. It starts with a Discovery Audit (a fixed fee, credited in full against the build). After the audit you get a fixed price Schedule of Work with three options: The Minimum, The Recommended and The Complete. The option you choose is paid in three stages against work you have accepted. We never publish day rates. Organisations with many AI systems across divisions often start with the inventory, because the inventory is what reveals the real scope.

An AI risk management framework is a structured way to identify, assess and treat the risks of AI systems across their life. Australian organisations usually start from the Guidance for AI Adoption; many also reference the voluntary NIST AI Risk Management Framework from the United States (AI RMF 1.0, released January 2023 and under revision at the time of writing), and ISO/IEC 42001 where they want a certifiable management system. We map the controls we build to whichever framework your risk team has adopted.

Data governance covers the data itself: ownership, quality, access, retention and lawful use. AI governance covers the systems that use data to make or assist decisions: what each is for, how it was tested, how it is monitored, who approves its outputs and what happens when it goes wrong. The two overlap on training and retrieval data, and AI governance depends on data governance being in reasonable shape.

Yes, in proportion to how it uses AI. A small business running one or two AI tools needs to know what they are, who is accountable, what personal information they touch and how a person can step in, which is the core of the Foundations version of Australia's Guidance for AI Adoption. It rarely needs a full programme. Which legal obligations apply depends on your size and the data you handle, which your adviser confirms.

Around 10 weeks for the first round, then periodic review. The inventory of AI systems and decisions takes weeks 1 to 2, risk tiering and control mapping follow, evaluation gates and logging are built across weeks 3 to 8, and documentation and incident readiness finish in weeks 7 to 9. Handover is in week 10, after which the inventory and controls are reviewed on a schedule you set.

We don't write policy, but we make one work in practice. Your legal, risk or privacy advisers own an acceptable use policy for staff. We build what enforces and evidences it: approved AI tools inside systems you control, logging of AI use in the systems we build, and an inventory showing which tools are in use and for what. Our guide to AI acceptable use policies covers what such a policy usually includes.