Free download
The AI Governance Pack
What goes in it, and the one document most organisations leave out.
Get the packWhat it is
A governance pack holds three kinds of document: policy, process, and register. Most organisations write only the first. This is the contents page for all three, plus the register template that makes the rest of it mean something.
Nineteen elements across five layers, each with a test you can apply. A twelve-field AI use case register with a worked example. A three-tier risk model. A thirty-day sequence. And where all of this sits in Australian law as at July 2026.
What is in it
The three-document framing
Policy, process, and register. Most organisations write only the first, which leaves a set of rules about a system nobody has looked at. This is why a policy-only pack governs nothing.
Nineteen elements in five layers
The contents page for a full pack, from the register through decisions, operations, suppliers and assurance. Each element carries a test: the question it should answer without anyone having to go and find out.
The AI use case register
Twelve fields, with a worked example filled in. A spreadsheet is enough, and it is the shortest document in the pack.
A three-tier risk model
Tiering keeps controls proportionate. The tier follows the consequence of being wrong, not the sophistication of the technology.
A thirty-day build sequence
Week by week, in order. A register and an approval gate beat a complete policy suite with no list behind it.
The Australian legal position
Where this sits in existing law, mapped element by element to the National AI Centre's six essential practices.
Who it is for
Directors, executives, and whoever has been handed the AI question.
It is written for organisations that have to answer to somebody: regulated entities, member-owned bodies, and boards with a risk committee.
Get the pack
Tell us where to send it. The download link appears on this page as soon as you submit.
Get the pack
Free, and yours to copy and adapt inside your organisation. No payment, no account.
The structure is the cheap half
The expensive half is judgment: which use cases are tier 1 in your organisation and not in someone else's, and what a director should ask when the presentation in front of them was built by the company selling the system. Two of the harder parts are things we sell, and it is better to say so here than to leave it implied.