Services

AI Governance & Assurance in Adelaide

Governance, guardrails and assurance for every kind of AI: machine learning, generative AI, LLMs, agents and automated decisioning, aligned to Australian guidance and international standards.

Discuss your project Book a consultation or learning sessions

AI Governance & Assurance for South Australian organisations

AI is no longer one technology. Most organisations now run a mix: statistical and machine learning models that score or predict, rules engines and automated decisioning, generative AI and large language models, retrieval-augmented assistants and AI agents that call tools and take actions. Each behaves differently, fails differently and needs different controls. A policy written for chatbots does not govern a credit or eligibility model, and a model validation process built for scorecards does not govern an agent that can send email or change records.

Expectations are rising at the same time. Australia's Guidance for AI Adoption sets six essential practices, building on the Voluntary AI Safety Standard and its ten guardrails. Federal agencies work to the Policy for the responsible use of AI in government. South Australian agencies work to the SA Government AI guidance and ethics policy, and regulated entities are expected to manage AI inside existing prudential standards such as CPS 230 and CPS 234. From 10 December 2026, organisations covered by the Privacy Act must also be transparent about automated decisions that significantly affect people. Buyers increasingly ask suppliers how their AI is governed before they ask what it can do.

EITSAA makes AI governance a core capability, not an add-on. We work in Adelaide with agencies, councils, regulated entities and growing businesses to build governance that is proportionate to risk: light for low-risk assistants, rigorous for models and agents that affect people, money or critical operations. We help you design and evidence your controls against the standards you choose. We are vendor neutral, and we build the technical guardrails as well as the policy, so governance is enforced in the platform and not left in a document.

AI governance is how an organisation decides where AI may be used, proves that it behaves, and acts quickly when it does not. We design the operating model, the technical guardrails and the evidence, so your leaders, auditors and customers can rely on every AI system you run.

What's included

AI inventory, use-case register and risk tiering across machine learning, generative AI, LLMs, AI agents and automated decisioning
AI policy, accountability (RACI), approval board and proportionate review by risk tier
Guardrail design: input and output filtering, prompt-injection defence, PII redaction, grounding, tool permissions, rate and cost limits and human-in-the-loop checkpoints
Failure-mode analysis: hallucination, bias and drift, data leakage, prompt injection, tool misuse, over-reliance, model deprecation, vendor outage and silent degradation, each with a mitigation and an owner
Evaluation and red-teaming: golden sets, adversarial test suites, release gates and regression tracking
Model risk management for scoring, prediction and decisioning models: validation, explainability, fairness testing, champion and challenger, monitoring and retraining
Data governance and privacy: classification, consent, lineage, retention, privacy impact assessments and automated decision-making transparency
Supply chain and vendor assessment for AI providers, plus incident response and exit planning
Audit evidence packs and alignment to the Voluntary AI Safety Standard and Guidance for AI Adoption, ISO/IEC 42001, NIST AI RMF, OWASP Top 10 for LLM Applications, the Essential Eight and APRA CPS 230 and CPS 234

Every type of AI

Governance that fits the system, not just the chatbot

Different kinds of AI fail in different ways, so they need different controls. We govern the whole estate with one operating model and apply the controls that match each system's type and risk tier.

Type of AI	Typical uses	Main risks	Core controls
Machine learning and scoring models	Credit, risk, eligibility, churn, demand and fraud scores	Bias, drift, unexplainable results, stale training data	Independent validation, fairness testing, champion and challenger, drift monitoring, retraining controls
Automated decisioning (rules and models)	Approvals, triage, pricing, case prioritisation	Unfair or unreviewable outcomes, no route to challenge	Explanations, human review, appeals, decision logs, privacy policy disclosure
Generative AI and LLMs	Drafting, summarising, coding, customer replies	Hallucination, data leakage, prompt injection, over-reliance	Input and output filters, PII redaction, grounding, evaluation sets, usage policy
Retrieval-augmented generation (RAG)	Staff and citizen knowledge assistants	Oversharing, poisoned or stale sources, ungrounded answers	Document-level access control, source citation, retrieval evaluation, index hygiene
AI agents and multi-agent systems	Workflow actions, case handling, IT and finance operations	Tool misuse, excessive agency, runaway spend, cascading errors	Least-privilege tools, sandboxing, approval gates, spend limits, kill switch, full tracing
Computer vision and speech	Inspection, document capture, safety monitoring, transcription	Unequal accuracy across groups, privacy intrusion, drift in conditions	Representative test sets, consent and retention rules, accuracy thresholds, human verification
AI embedded in SaaS and supplier products	Copilots, CRM and HR features, supplier analytics	Opaque models, sub-processors, silent feature changes	Vendor assessment, contract terms, configuration baselines, change monitoring

Read the full comparison in types of AI and their different risks.

Guardrails, failure modes and evidence

Built into the platform and proven with evidence

Guardrails

Input and output filtering and content policy
Prompt-injection defence and untrusted-content handling
PII detection and redaction
Grounding and citation checks
Tool permissions, sandboxes and approval gates
Rate, token and spend limits, plus a kill switch
Human-in-the-loop for consequential actions

LLM guardrails architecture →

Failure modes we design for

Hallucination and ungrounded answers
Bias, drift and silent degradation
Data leakage and oversharing
Prompt injection and tool misuse
Over-reliance and automation bias
Model deprecation and vendor outage
Runaway cost and unbounded consumption

AI failure modes guide →

Assurance and evidence

AI register with owners, tiers and review dates
Model cards, evaluation results and release gates
Red-team reports and remediation tracking
Monitoring dashboards and incident runbooks
Decision logs, explanations and appeal records
Board and regulator reporting packs

Governance operating model →

Aligned to the frameworks your buyers and regulators name

Australian guidance. The Guidance for AI Adoption (six essential practices), the Voluntary AI Safety Standard (ten guardrails) and the AI Ethics Principles.
Government. The Policy for the responsible use of AI in government and SA Government AI guidance for agencies.
International. ISO/IEC 42001, the NIST AI Risk Management Framework and its Generative AI Profile, the OWASP Top 10 for LLM Applications and MITRE ATLAS.
Security and resilience. The ACSC Essential Eight, APRA CPS 230 and CPS 234, and SA ISMF.
Privacy. The Privacy Act and Australian Privacy Principles, including automated decision-making transparency from 10 December 2026.

What you get

We help you design and evidence your controls against the frameworks you choose. Deliverables are practical: a register, a policy and RACI, guardrail configurations, evaluation suites, monitoring and an evidence pack organised by framework, so one body of work answers many questionnaires.

This is general guidance and not legal advice. Certification, such as ISO/IEC 42001, is carried out by an accredited body. We prepare you for it.

How we can help

AI inventory and risk tiering

Find every AI use, including shadow AI and AI embedded in SaaS, register it with an accountable owner and assign a risk tier that sets how much review it needs.

Policy, accountability and approvals

An AI policy people can follow, a RACI, an approval board with clear criteria and a fast path for low-risk uses, aligned to the Guidance for AI Adoption and ISO/IEC 42001.

Guardrails for LLM applications and agents

Input and output filtering, prompt-injection defence, PII redaction, grounding checks, least-privilege tool permissions, spend limits, approval gates and a kill switch, enforced at a gateway.

Failure-mode analysis and red-teaming

Structured analysis of how each system can fail, adversarial testing against the OWASP Top 10 for LLM Applications and MITRE ATLAS techniques, and release gates that stop regressions.

Model risk management for ML and decisioning

Independent validation, explainability, fairness testing, champion and challenger comparison, drift monitoring and retraining controls for scoring, prediction and automated decision models.

Assurance, audit evidence and incident response

Evidence packs per system, quality and safety monitoring, AI incident runbooks and board-ready reporting that stands up to an auditor, regulator or tender evaluator.

Our delivery process

Discover
We clarify goals, users, constraints and success measures, and review your current systems and data.
Design
We agree the architecture, security controls and user experience before the build begins.
Deliver
Fortnightly sprints with demos, automated testing and continuous deployment.
Operate and improve
Monitoring, support and a backlog of improvements based on real usage.

Technology we use

Policy and registers (SharePoint, ServiceNow, Jira), model and prompt registries (MLflow, SageMaker Model Registry, Azure ML, Vertex AI), guardrails (Amazon Bedrock Guardrails, Azure AI Content Safety, NeMo Guardrails, Llama Guard), evaluation (promptfoo, Inspect, Ragas, Azure AI Evaluation, Bedrock Evaluations), observability (OpenTelemetry, Langfuse, Azure Monitor, CloudWatch), Microsoft Purview, AWS and Azure Australian regions, GitHub Actions.

Why choose an Adelaide partner?

Working with a local team means face-to-face workshops, an understanding of South Australian regulatory and procurement requirements, and support in your time zone. Engaging EITSAA also keeps investment and jobs in South Australia, which counts under the SA Industry Participation Policy in government tenders.

See our government capability statement or read how we work.

Outcomes you can expect

Every AI Governance & Assurance engagement starts with outcomes we agree on, not just a list of features. Before we begin, we set measures such as hours saved, faster turnaround, higher customer satisfaction, lower operating cost or reduced risk. We report against them throughout delivery. You get a fortnightly demonstration of working software, a transparent backlog, and a named Adelaide-based lead who is accountable for progress.

When the work is done, you keep the capability. Documentation, source code, infrastructure definitions and runbooks are handed over in full, and knowledge-transfer sessions give your team the confidence to run and extend what we have built.

Security, privacy and compliance

Security and privacy are designed in from the first workshop. Our AI Governance & Assurance solutions follow the principle of least privilege, encrypt data in transit and at rest, and can be hosted in Australian cloud regions to meet data sovereignty requirements. We align with the ACSC Essential Eight, the Australian Privacy Principles and, for public sector clients, the SA Government Information Security Management Framework.

For regulated or sensitive work, we can complete privacy impact assessments, provide security documentation for your risk team, and support independent penetration testing before go-live.

Frequently asked questions

What is AI governance, in plain terms?

AI governance is the set of decisions, controls and evidence that keep AI use safe, lawful and accountable. It covers who owns each AI system, how risky it is, which guardrails apply, how it is tested before release, how it is monitored in production and what happens when something goes wrong. It applies to machine learning models, generative AI, large language models, AI agents and automated decisioning alike.

We only use Microsoft Copilot or ChatGPT. Do we still need AI governance?

Yes, in a proportionate form. Even off-the-shelf assistants raise questions about what data staff may enter, who can see which files, how outputs are checked before use and where data is processed. A short policy, an inventory of approved tools, data permissions that suit AI and staff guidance usually cover low-risk use. Governance grows with risk, and we size it to fit.

Should we follow the Voluntary AI Safety Standard or the Guidance for AI Adoption?

Australia's National AI Centre published the Guidance for AI Adoption in October 2025, which condenses the ten guardrails of the Voluntary AI Safety Standard into six essential practices: decide who is accountable, understand impacts and plan, measure and manage risks, share essential information, test and monitor, and maintain human control. Both remain useful. We map your controls to the six practices and to the ten guardrails, so you can answer whichever one a buyer or regulator names.

Can EITSAA certify us to ISO/IEC 42001?

No. Certification to ISO/IEC 42001, the AI management system standard, is carried out by an accredited certification body. We help you design your AI management system, build the controls and assemble the evidence an auditor will ask for, so that you are ready for an independent assessment if you choose to pursue one.

Does AI governance apply to machine learning and automated decisions, or only to generative AI?

It applies to all of them. Scoring models, eligibility rules, fraud detection and other automated decisioning carry well-established risks such as bias, drift and lack of explainability, and they often affect people more directly than a chatbot does. From 10 December 2026, the Privacy Act requires covered organisations to describe in their privacy policy the kinds of decisions made or substantially assisted by computer programs that use personal information and significantly affect individuals. We help you find and document these uses.

What is the difference between guardrails and governance?

Governance is the organisational layer: policy, accountability, risk decisions and approvals. Guardrails are the technical controls that enforce those decisions at run time, such as content filters, PII redaction, grounding checks, tool permissions and spend limits. You need both. Governance without guardrails depends on people remembering the rules, and guardrails without governance leave nobody deciding what they should enforce.

How does AI governance connect with CPS 230, CPS 234 and the Essential Eight?

AI systems are information assets, they depend on service providers and they can sit inside critical operations, so existing prudential and security obligations apply to them. APRA has said regulated entities are expected to manage AI risk within the existing standards. We map AI controls to CPS 230 for operational resilience and provider management, CPS 234 for information security and the Essential Eight for baseline cyber hygiene, so you do not run a parallel compliance program.

What will South Australian agencies ask AI suppliers?

Expect questions about accountability and a named owner, the intended use and risk tier, data handling and residency, model and sub-processor transparency, testing and monitoring evidence, human oversight, how users are told they are dealing with AI, incident handling and exit arrangements. Our Insights guide on AI in government procurement walks through these in detail. This is general guidance and not legal advice.

Reference architectures for AI Governance & Assurance

Operating model · control framework
AI governance operating model and control framework: register, risk tiers, approvals, platform guardrails and assurance
How an organisation governs every kind of AI: leadership sets direction, an AI register and risk tiers decide how much review each system needs, an approval workflow gates release, platform guardrails enforce policy and assurance closes the loop with evidence.
LLM guardrails · policy engine
LLM guardrails architecture: input and output guard layers, policy engine, PII redaction, grounding checks and audit
A layered guardrail pattern around an LLM application: authenticate and screen the request, redact personal data, retrieve only what the user may see, call the model, then validate grounding and policy on the way out, with every step logged for audit.
AI agents · safety controls
AI agent safety architecture: tool permissions, sandboxing, approval gates, spend limits and a kill switch
How to let an AI agent act without letting it do harm: a permission broker issues narrow, short-lived tool access, risky code runs in a sandbox, high-impact actions wait for human approval, budgets cap spend and a kill switch stops everything.

Related services

Training & Team Consultations

Workshops, teaching sessions and expert consultations that lift your team's skills in AI, software engineering, cloud, data and security, tailored to your own tools and use cases.

Explore training →

Application Development

Custom web, mobile and cloud-native applications built for Adelaide businesses and government agencies.

Explore Application services →

AI Consulting & Strategy

Practical AI strategy, readiness assessments and responsible AI governance aligned to Australian guidance.

Explore AI services →

Talk to us about AI Governance & Assurance

Tell us what you need. We reply within one business day and the initial conversation is free of charge.

Discuss your project Book a consultation or learning sessions Call 0402 401 584