AI assurance

NIST’s August 2026 TEVV-Athlon draft makes real-world AI evaluation a current governance issue. Businesses should connect every test to pre-agreed acceptance thresholds, a named decision owner and clear retest triggers.

AI risk assessments often stall innovation when unclear ownership and inconsistent evidence requirements create bottlenecks. Business leaders must own AI risk decisions, supported by clear triage and third-party evidence standards to speed value delivery without compromising controls.

The Australian Cyber Security Centre's procurement and AI supply-chain guidance shows why vendor assurance must be refreshed when services change. OAIC guidance adds a clear requirement for organisations to conduct privacy due diligence on commercially available AI products.

The Air Canada chatbot decision shows why organisations remain responsible for automated outcomes. The AICD and Human Technology Institute's 2026 Director's Guide adds practical board questions for assigning AI decision rights and oversight.

This piece looks at the questions Australian business and risk leaders should be asking before their own AI model drifts

Unclear ownership and weak third-party evidence can stall AI initiatives for months. This article explains why business-led accountability and structured evidence checklists are critical to smooth AI risk management and faster decision-making.

Germany's data regulator fined Vodafone €45 million partly for failing to vet a third-party partner, a 2026 DataGrail report found 64% of AI vendors hide their subprocessors, and a German court has ruled companies — not their AI vendors — are liable when the tool gets it wrong. Three real 2026 examples show why vendor assurances can't substitute for your own verification.

When a single ungoverned AI tool gave attackers a path from a Vercel employee’s device into Vercel’s internal systems, and a poisoned VS Code extension let attackers pull roughly 3,800 repositories out of GitHub, the common thread wasn’t a coding flaw — it was an unmanaged non-human identity. With AI agents now driving machine identities to roughly 109 per human inside the average enterprise (CyberArk, 2026), most governance frameworks still treat identity as a human-only problem.