AI policy

Deloitte's 2026 State of AI in the Enterprise research and KPMG's Global AI Pulse survey show a widening gap between AI governance intent and board-level readiness, while the EU AI Act's August 2026 self-assessment requirement turns internal best practice into a filed, auditable record. This post asks whether your organisation's AI risk self-assessment is a live decision tool or just a document that says one exists.

Many organisations have AI policies, but these often fail to guide day-to-day decision making. To manage AI risks effectively, policies need clear guardrails that business teams can apply consistently. This article explains how to translate high-level AI principles into practical standards and controls that enable confident, accountable AI use.

A NSW Reconstruction Authority contractor uploaded flood victims' personal data to ChatGPT in 2025, echoing Samsung's 2023 source-code leak. New 2026 survey data shows most staff still use unsanctioned AI tools — here's what boards should do about it.

Shadow AI is no longer hypothetical: a NSW government contractor uploaded flood victims' personal and health data to ChatGPT, while APRA and ASIC have both issued 2026 letters demanding stronger AI governance and cyber resilience. This post sets out what boards and risk leaders should be asking right now.