AI governance

The Australian Cyber Security Centre's procurement and AI supply-chain guidance shows why vendor assurance must be refreshed when services change. OAIC guidance adds a clear requirement for organisations to conduct privacy due diligence on commercially available AI products.

The FCA's 2026 AI Live Testing cohort and Supercharged Sandbox show how Barclays, Experian, Lloyds Banking Group, UBS and other firms are building evidence through controlled testing. NIST's tailorable AI RMF Playbook provides a practical basis for proportionate triage.

The Air Canada chatbot decision shows why organisations remain responsible for automated outcomes. The AICD and Human Technology Institute's 2026 Director's Guide adds practical board questions for assigning AI decision rights and oversight.

This piece looks at the questions Australian business and risk leaders should be asking before their own AI model drifts

AI failures can disrupt critical operations and amplify risks. Boards and executives must move beyond compliance to embed AI resilience as a strategic priority, focusing on clear ownership, continuous monitoring, and agile response capabilities.

Deloitte's 2026 State of AI in the Enterprise research and KPMG's Global AI Pulse survey show a widening gap between AI governance intent and board-level readiness, while the EU AI Act's August 2026 self-assessment requirement turns internal best practice into a filed, auditable record. This post asks whether your organisation's AI risk self-assessment is a live decision tool or just a document that says one exists.

APRA's April 2026 letter named third-party AI risk as the biggest gap in bank and insurer oversight — and weeks later, a compromised account at AI tooling vendor Context.ai gave attackers a path into Vercel's infrastructure. This piece uses both to show why vendor assurance paperwork isn't AI risk management, and what to ask instead.

Generic vendor privacy assessments couldn't have flagged what happened at MediSecure or Latitude Financial — and that's the problem. This piece uses real breach and enforcement outcomes to show why a signed-off checklist isn't AI privacy control, and sets out the questions every organisation should be asking its AI vendors now.