AI governance

Grant Thornton's 2026 AI Impact Survey, Forrester and MIT research on failed AI pilots, and the EU AI Act's Article 26 deployer obligations all point to the same gap: boards are funding AI faster than they are assigning who owns it. Here's why business-led ownership, not another control layer, is what actually makes AI risk management work.

Deloitte's $290,000 government report scandal, AICD's warning on AI vendor concentration risk, and the UK's new Critical Third Parties regime all expose the same gap: accountability for AI-enabled outcomes can't be outsourced to the vendor that built the tool. Here's what risk and governance teams should check before relying on vendor AI assurances.

A federal court ruling against Workday in the Mobley v. Workday case, a Fair Credit Reporting Act class action against Eightfold AI, and new Fortune 100 board-oversight data all point the same way: ethical AI conduct is now a liability and governance issue, not a values statement. This post sets out what risk and governance teams should be asking right now.

APRA's April 2026 letter named four AI governance failures inside Australia's largest banks and insurers; ASIC has tied AI-driven cyber risk to its FIIG Securities enforcement precedent.

APRA's April 2026 letter to industry and ASIC's Report 798 both warn that boards are leaning on AI vendor assurances instead of independently verifying them. Here is what Australian organisations should be checking before they trust the compliance pack.

Shadow AI is no longer hypothetical: a NSW government contractor uploaded flood victims' personal and health data to ChatGPT, while APRA and ASIC have both issued 2026 letters demanding stronger AI governance and cyber resilience. This post sets out what boards and risk leaders should be asking right now.

Without a clear AI use-case lifecycle—from identification through retirement—organisations risk fragmented governance, hidden risks, and missed control opportunities. Executives and risk managers must demand disciplined visibility and stage-gate controls to keep AI aligned with strategy and risk appetite.

Third-party AI vendor risk is the widest compliance gap in Australian companies, your vendor's model update is now a regulatory event.