Free download
The AI Governance Pack
What goes in it, and the one document most organisations leave out.
Get the packWhat it is
A governance pack holds three kinds of document: policy, process, and register. Most organisations write only the first. This is the contents page for all three, plus the register template that makes the rest of it mean something.
Nineteen elements across five layers, each with a test you can apply. A twelve-field AI use case register with a worked example, and how to register a general-purpose tool without listing every prompt. A three-tier risk model. A fast lane, so people can experiment quickly instead of going dark. A thirty-day sequence, and how to right-size the whole thing for a smaller organisation. And where all of this sits in Australian law as at July 2026.
What is in it
The three-document framing
Policy, process, and register. Most organisations write only the first, which leaves a set of rules about a system nobody has looked at. This is why a policy-only pack governs nothing.
Nineteen elements in five layers
The contents page for a full pack, from the register through decisions, operations, suppliers and assurance. Each element carries a test: the question it should answer without anyone having to go and find out.
The AI use case register
Twelve fields, with a worked example filled in. A spreadsheet is enough, and it is the shortest document in the pack.
A three-tier risk model
Tiering keeps controls proportionate. The tier follows the consequence of being wrong, not the sophistication of the technology.
The fast lane
A standing pre-approval with four conditions, so people can experiment quickly instead of going dark. Bumpers rather than a gate, with the trip-wire that turns an experiment into a register line the moment it outgrows the boundary.
A thirty-day build sequence
Week by week, in order. A register and an approval gate beat a complete policy suite with no list behind it.
The minimum viable pack
Nineteen elements is not nineteen documents. Size the pack to your tier 1 entries rather than your headcount, with a crosswalk of which elements are genuinely new and which are amendments to documents you already own.
The Australian legal position
Where this sits in existing law, mapped element by element to the National AI Centre's six essential practices.
Who it is for
Directors, executives, and whoever has been handed the AI question.
It is written for organisations that have to answer to somebody: regulated entities, member-owned bodies, and boards with a risk committee.
Get the pack
Tell us where to send it. The download link appears on this page as soon as you submit.
Get the pack
Free, and yours to copy and adapt inside your organisation. No payment, no account.
The structure is the cheap half
The expensive half is judgment: which use cases are tier 1 in your organisation and not in someone else's, and what a director should ask when the presentation in front of them was built by the company selling the system. Two of the harder parts are things we sell, and it is better to say so here than to leave it implied.