Short answer: good AI governance starts with eight questions your board can ask this quarter. They cover who owns AI risk, what AI is already in use, how personal information is protected, and when a human must make the final call.
I work with leadership teams that are adopting AI, and I build AI products myself. The checklist below is the one I use in board sessions. It is mapped to Australia’s Voluntary AI Safety Standard, the Guidance for AI Adoption and the Privacy Act, as at 9 October 2026.
What is AI governance?
AI governance is the set of roles, policies and checks an organisation uses to decide how AI is chosen, used and monitored. Its goal is simple: get the value from AI while protecting people, data and the business. For a board, it means knowing what AI is in use, who is accountable, and how risks are reported.
The 8-point AI governance checklist for boards
Ask management to answer each question in writing. Short, honest answers are better than long policies nobody reads.
1. Who is accountable for AI?
Name one executive who owns AI risk, and decide which board committee oversees it. Accountability is the first guardrail in the Voluntary AI Safety Standard and the first practice in the Guidance for AI Adoption.
2. What AI are we already using?
Ask for an inventory: every AI tool, system and supplier feature, who uses it, and what data it touches. Include “shadow AI”, where staff use personal accounts for work. You cannot govern what you cannot see.
3. What is our AI policy and risk appetite?
A one-page policy should say which tools are approved, which uses are banned, and which need sign-off. Agree as a board how much risk you will accept for customer-facing or high-impact uses.
4. How do we protect personal and confidential information?
The Privacy Act and the Australian Privacy Principles apply when AI handles personal information. The OAIC recommends not entering personal information, and especially sensitive information, into publicly available AI tools. Ask how staff are stopped from doing so.
5. How do we test and monitor our AI?
Ask how each important AI use was tested before launch, how its accuracy is checked over time, and what happens when it makes a mistake. Testing and monitoring are core guardrails in the national guidance.
6. When does a human make the final decision?
Decide which decisions AI may support and which it may never make alone, such as those about jobs, credit, health or legal rights. From 10 December 2026, privacy policies must explain when personal information is used in automated decisions that could significantly affect people.
7. What do our AI suppliers do with our data?
Check contracts for data use, training on your data, where data is stored, security standards and what happens when the contract ends. Many AI risks sit with suppliers, not in-house systems.
8. Are our people and our board trained?
Policies only work when people understand them. Ask what training staff receive, and when the board last had a hands-on AI briefing. Directors who have used the tools ask better questions.
How does the checklist map to Australian guidance?
| Checklist item | Main Australian reference |
|---|---|
| 1. Accountability | Voluntary AI Safety Standard; Guidance for AI Adoption |
| 2. AI inventory | Guidance for AI Adoption; AICD director’s guide |
| 3. Policy and risk appetite | Voluntary AI Safety Standard (risk management) |
| 4. Personal information | Privacy Act 1988 and APPs; OAIC AI product guidance |
| 5. Testing and monitoring | Voluntary AI Safety Standard (testing guardrail) |
| 6. Human decisions | Privacy Act automated decision rules from 10 Dec 2026 |
| 7. Suppliers | Voluntary AI Safety Standard (supply chain); OAIC guidance |
| 8. Training | Guidance for AI Adoption; AICD director’s guide |
What should the board do next?
- Put AI on the next board agenda and send management these eight questions.
- Ask for the AI inventory first; it shapes everything else.
- Approve a one-page AI policy within one quarter.
- Book a hands-on AI session for directors so the questions come from experience.
Our executive AI programme takes leadership teams through this checklist with their own tools and data, and the AI governance page explains how we support boards. For a quick primer on the next wave of AI, read what agentic AI is.
