Responsible AI as Working Controls, Not a Policy PDF

No. We do not offer ISO/IEC 42001 certification, we are not a certification body, and we do not hold the certification ourselves. Certification is issued by accredited certification bodies after an audit of your AI management system. What we provide is engineering: the inventory, evaluations, logging, oversight, documentation and incident controls. If you are preparing for certification, those controls and records can support that work, alongside a certification body and any management system consultant you engage.

It is voluntary guidance published by the National AI Centre on 21 October 2025 as updated, simplified guidance that evolves the 2024 Voluntary AI Safety Standard. It sets out six essential practices: decide who is accountable, understand impacts and plan accordingly, measure and manage risks, share essential information, test and monitor, and maintain human control. It comes in a shorter Foundations version and a more detailed Implementation guidance version for technical and governance professionals.

From 10 December 2026, APP 1 requires APP entities to include information in their privacy policies about decisions made by computer programs using personal information, or where a program does something substantially and directly related to making the decision, if the decision could reasonably be expected to significantly affect an individual's rights or interests. It is a transparency obligation. The engineering challenge is knowing where such decisions occur, which is why we start with an inventory. Your privacy and legal advisers decide what must be disclosed.

No. Your risk, legal and privacy teams, or advisers you appoint, own policy. We build the technical controls that put policy into practice and generate evidence: tests, logs, review workflows, documentation and incident processes. We are happy to work from a policy you already have, or alongside advisers writing one.

Often, yes. Logging, evaluation and monitoring can usually be added around an existing system at its interfaces. For AI features inside third-party SaaS products, controls are more limited, so the work shifts to vendor due diligence, configuration review, usage monitoring and documenting what the vendor does and does not provide.

Where a system's outputs affect people, we define with you which groups and outcomes to compare, build test sets that represent them, and measure differences in error rates or outcomes. Some attributes are sensitive information under the Privacy Act, so how test data is sourced and handled is agreed with your privacy team first. Results are documented in the system card with any mitigations.

No engineering work can guarantee compliance on its own. We build controls to your requirements and provide evidence of what they do. Whether that meets a particular legal or regulatory obligation is an assessment for your legal, privacy and compliance advisers. This page is general information, not legal advice.

Responsible AI means designing, building and using AI systems so that someone is accountable for them, they are tested and monitored, people are told what they do, and humans stay in control where it matters. Australia's Guidance for AI Adoption turns that into six essential practices. AI governance is how an organisation makes sure those principles actually hold in each system, rather than only in a policy.

Typical Australian market ranges are $15k to $30k for an AI system inventory and gap review, and $30k to $90k to build controls such as evaluation gates, decision logging, review design and incident runbooks for one to three higher-risk systems (AUD, ex GST). Organisations with many AI systems across divisions get a fixed fee proposed after the inventory, because the inventory is what reveals the real scope.

An AI risk management framework is a structured way to identify, assess and treat the risks of AI systems across their life. Australian organisations usually start from the Guidance for AI Adoption; many also reference the voluntary NIST AI Risk Management Framework from the United States (AI RMF 1.0, released January 2023 and under revision at the time of writing), and ISO/IEC 42001 where they want a certifiable management system. We map the controls we build to whichever framework your risk team has adopted.

Data governance covers the data itself: ownership, quality, access, retention and lawful use. AI governance covers the systems that use data to make or assist decisions: what each is for, how it was tested, how it is monitored, who approves its outputs and what happens when it goes wrong. The two overlap on training and retrieval data, and AI governance depends on data governance being in reasonable shape.