Many AI governance efforts stall because they start with a long policy and no mechanism. A framework that works is small, enforced and proportionate. It answers four questions for every AI system: what is it, how risky is it, who is accountable, and what proof do we hold that it is under control. This guide sets out the parts that matter and the order to build them.
Start with an AI inventory
The inventory, or AI register, is the foundation. Federal agencies are required to keep an internal register of in-scope AI use cases, and APRA has signalled that regulated entities should hold an AI inventory. For any organisation, the register should record the system and its purpose, type of AI, owner, vendor and model, data used, users and affected people, risk tier, approvals, controls and review date. Include AI built into SaaS products and tools staff adopt on their own. Discovery usually combines procurement records, network and identity logs, and a short staff survey.
Tier by risk, then match controls to the tier
A simple three or four tier scheme works. Typical factors are impact on people's rights or entitlements, degree of autonomy, sensitivity of the data, scale and reversibility.
| Tier | Example | Minimum controls |
|---|---|---|
| Low | Drafting assistant with no sensitive data | Acceptable-use policy, approved tool list, staff guidance |
| Medium | Internal knowledge assistant over staff documents | Owner, access-controlled retrieval, evaluation set, logging, periodic review |
| High | Model that scores or ranks people, or an agent that takes actions | Impact assessment, independent validation, human review, monitoring, board visibility, annual review |
Accountability and the approval path
Use a RACI so nobody is unsure who decides. A typical split: the executive sponsor is accountable for the use case, the system owner is responsible for operation and monitoring, the risk, privacy and security functions are consulted, and an AI governance board approves high-tier systems. Keep the board small and make low-risk approval a lightweight, same-week process, otherwise teams will route around governance.
Make controls enforceable
Policies fail when nothing enforces them. Route model calls through a gateway that checks approval status, applies guardrails and logs requests. Make approved patterns the easy path: pre-approved models, prompts and templates teams can reuse. The AI governance and LLMOps platform architecture shows the pattern.
Evidence by design
For each system keep an evidence pack: purpose and risk assessment, data sources, evaluation results, test and red-team reports, approvals, monitoring dashboards and incident history. Generate it from the pipeline rather than assembling it before an audit.
Review and improve
Review high-tier systems at least annually and whenever the model, data or use changes. Report to leadership on the register, incidents, exceptions and drift. Treat the framework itself as a product that is tuned as you learn.
See also: the ten guardrails explained and the operating model and control framework.
How EITSAA helps
We help you design and evidence AI governance that matches your risk, from the register and policy through to technical guardrails and audit-ready evidence. Explore AI Governance & Assurance, talk to our team or call 0402 401 584.
This is general guidance, not legal advice. Check current requirements with the relevant authority and take advice on your own position.