AI Governance
AI governance for Australian organisations: board oversight, model risk, accountability, and the frameworks that keep AI use defensible.
233 articles
Articles about AI Governance
Nothing Enters HR Until It Clears the Gate
Artificial intelligence is arriving inside human resources systems bought years ago, through release notes and vendor defaults, so the decision point has moved from procurement to renewal. Australian privacy law puts the obligation on the deploying employer, and a vendor's obligations do not discharge it. The answer is a standing register, one row per live feature.
Read article
Death Benefits Under Section 17: AI Can Structure the Reasoning, Not Weigh the Loss
When a work injury results in death, section 17 of the SRC Act fixes a lump sum for the dependants and leaves the division to a decision maker. Under section 17(8) the shares turn on the losses each dependant suffered when the employee's earnings stopped. AI can structure that analysis. The determination stays with the delegate.
Read article
Twelve Percent. Your Suppliers Are in That Number.
The ABS puts AI use at 12 percent of employing businesses for 2024-25, but the distribution behind that average is the part a third-party risk function can act on. Weight the supplier register by employment size band, re-rank by industry division, and send the next due diligence addendum to the segment most likely to have adopted quietly.
Read article
Rebuild the Chemical Register Against Its Own Five-Year Clock
A hazardous chemicals register fails quietly through the age of the safety data sheet behind each line. The date is a required field, so the test is arithmetic. An assistant grounded in the SDS folder and the register export builds a dated exception list, and a competent person decides every line on it.
Read article
Answer the Claim From the File You Already Have
A general protections dismissal application gives the employer seven days to respond and a statutory presumption to displace. Section 361 of the Fair Work Act presumes the applicant is right about the reason until the employer proves otherwise. Here is the de-identified assembly task, run on the file you already hold.
Read article
Your Account Type Decides What the Model Learns
Four assistants, four published positions on training and retention, and not one of them turns on the wording of the prompt. As at 24 September 2026, the default is set by the account tier that was signed in. Here is what each page states, what it does not state, and the register that records it.
Read article
Robodebt's Managers Were Told. Then It Kept Running.
The Royal Commission into the Robodebt Scheme found that concerns raised inside the agency were ignored or dismissed, and that the automated phase carried no meaningful human intervention. For any manager running an automated or AI-assisted process, the transferable control is a written path a doubt travels, designed before the doubt exists.
Read article
Comcare Resolves Disputes Slower Than the National Rate
On the most recent published national comparison, 2023-24, Comcare resolved 20.3 percent of disputes within three months against 47.7 percent nationally, and 45.8 percent within nine months against 85.4 percent. The figures are Safe Work Australia Jurisdictional Comparison data, published 8 December 2025. Here is how to rebuild internal reporting into the same four bands.
Read article
The Model Failed. Whose Bonus Moves?
CPS 511 already requires an APRA-regulated entity to set criteria that adjust variable remuneration downwards for a significant failure of risk management or significant adverse outcomes for customers. It never mentions artificial intelligence, and it does not need to. The gap sits in the entity file: an AI use case with no accountable person the remuneration committee can name.
Read article
Mental Health Claims Take Thirty-Five Weeks Off Work
Mental health conditions were 12.0 percent of serious workers compensation claims in 2023-24 preliminary data, and the 2022-23 median time lost for that category was 35.7 working weeks. An AI work system can introduce or contribute to the same named hazards, so the shape of the category matters more than the headline when a deployment is assessed.
Read article
Your Facial Recognition Was Lawful. Your File Was Not.
On 29 July 2026 the OAIC updated the facial recognition guidance it first published in 2024, incorporating a Tribunal decision that reversed the finding on collection and left the governance findings standing. The compliance rule that falls out of that split applies well beyond retail.
Read article
A Model Wrote the Payroll Rule. The Offence Asks What You Intended.
Since 1 January 2025, intentionally underpaying wages has been a criminal offence. The award interpretation sits in the part of the offence that carries no fault element at all. When a model produced that interpretation and somebody encoded it as a payroll rule, the configuration record is what says whether the shortfall was intended.
Read article
Your AI Output Depends on Other People's Requests
Same prompt, same model, temperature set to zero, and you can still get a different answer, because the result depends on how many unrelated requests were batched alongside yours. That breaks the most common verification habit in the industry.
Read article
Draft First, Then AI. Who Writes First Decides Ownership
A pre-registered experiment ran the same writing task three ways. Taking AI output directly reduced ownership, self-efficacy and meaning. Drafting first and then refining with AI came out level with using no AI at all on those three. What changed was who produced the first draft.
Read article
Your Contract Generator Scales the Clause. So Does the Penalty.
A model that drafts contracts reproduces the same term across all of them, and section 27 presumes a contract is standard form once that is alleged. Section 23 of the Australian Consumer Law treats every unfair term proposed as a separate contravention, and the fixed maximum for a body corporate doubled to $100,000,000 in March 2026. Here is the test, the onus, the arithmetic and the audit.
Read article
Suitable Employment Refusals and the Suspension of Compensation: AI Builds the Timeline, the Delegate Makes the Finding
A refusal to undergo a rehabilitation examination or undertake a rehabilitation program can suspend compensation under the SRC Act, but only where the refusal is without reasonable excuse and only after the employee has been warned in writing and given a chance to reply. Refusing an offer of suitable employment is a different pathway again, section 19(4). AI can build the compliance timeline that shows what was offered, what was refused and when. The findings and the suspension determination stay with the delegate.
Read article
Directors, AI and the Business Judgment Rule
Section 180 attaches to a person, not to a governance framework. The safe harbour in section 180(2) protects a business judgment, and its third limb asks whether the director informed themselves to the extent they reasonably believe appropriate. When the recommendation came from a model, that limb is where the argument happens.
Read article
Publish Your Candidate AI Rules Before You Judge Anyone On Them
Most employers have decided what they will do with AI in hiring. Almost none have told candidates what they expect in return. The Australian Public Service has published both halves, and the candidate half is the one worth copying.
Read article
APRA Listed Who You Cannot Negotiate With. AI Is Not On It.
Industry asked APRA to exempt cloud and IT from the CPS 230 contract requirements. APRA published a closed list of seven categories instead, and said it expects exemptions to narrow rather than expand.
Read article
Section 7 Deemed Diseases: AI Can Build the Timeline, Never Concede the Liability
Section 7 of the SRC Act reverses the usual evidentiary burden for a listed disease and a listed kind of employment, and fixes the date of injury by a mechanical rule that ignores when the disease began. Both are records problems before they are medical ones, which is exactly where AI helps and exactly where it must not decide.
Read article
Your Resilience Documents Pass. Your Exercise Might Not.
APRA and ASIC have released the notes from their June superannuation CEO roundtables. The line worth acting on is that participants said crisis exercises often reveal governance, delegation and communication issues that documentation alone may not surface. Here is how to design one for an operation that now contains agents.
Read article
AI Framed the Employee Proposal for the People Deciding
In a decision published on 10 August 2026, the Fair Work Commission records that a manager's summary of an employee's alternative restructure proposal, sent to the executive making the decision, was produced with the assistance of AI. It did not simply condense the proposal. It set it beside the employer's own option and recommended between them. Consultation was found to have been fulfilled, which is exactly why the document is worth studying.
Read article
APRA's New Plan Asks Two AI Questions. Your Register Answers One.
APRA published its 2026-27 Corporate Plan on 20 August 2026. Under a single supervision priority it puts AI in two places, under two separate headings, meaning two different things. Most AI risk registers are built to answer only the first of them, and the second arrives with a dated cryptography deadline attached.
Read article
The Commission Now Reads Your Agreement by Machine First
The Fair Work Commission Rules 2024 were amended on 31 July 2026 to require a machine-readable copy of an enterprise agreement with every approval application, so an AI support tool can run pre-approval checks before the file reaches a Member. The obligation is live now. The tool is still being built. Both facts change how a bargaining team should prepare a lodgement.
Read article
A Gate Your Customer Can Retry Is Not a Control
On 13 August 2026 ASIC published surveillance findings against nine named online brokers, including onboarding questionnaires that allowed repeated or unlimited attempts to pass. The same defect drew a $10 million penalty in March 2026. The design question generalises to every automated eligibility gate an organisation operates, and it gets sharper when the customer has an agent.
Read article
Your AI Drew the Control Map. Now Prove It Is Complete.
On 18 August 2026 APRA imposed licence conditions on Bendigo and Adelaide Bank after an independent root cause analysis found the bank did not have a clear, complete and reliable view of its regulatory obligations, material risks and key controls. Completeness is now inside an enforcement outcome, and it is the one property an AI-generated map cannot supply for itself.
Read article
Consultation Does Not Open the Algorithm
Australia's first minimum standards order commenced on 17 August 2026. It names algorithms twice, and both times to exclude them from disclosure, while leaving the consultation obligation intact. For HR teams consulting on an AI rollout, that is the clearest official illustration yet of where the confidentiality carve-out falls, and why it is no reason to run a thinner consultation.
Read article
AI Made the Record. Can You Produce It in Seven Years?
Rostering agents, award interpretation tools and AI-assisted pay runs are now generating the artefacts that sit behind employee records. Section 535 of the Fair Work Act requires those records to be made and kept for seven years, and section 557C reverses the burden of proof when they are not. The gap between a model's output and a kept record is where that bites.
Read article
Section 30 Is the Determination Nobody Asks You to Make
Section 30 obliges the authority to redeem low weekly incapacity payments without any application from the employee, so qualifying files are found by screening or not at all. AI can run the screen and assemble the stability evidence. The satisfaction, the figure and the determination stay with the delegate.
Read article
The Weakness Was Found in 2020. Exploited in 2023.
On 11 August 2026 APRA announced that Bendigo and Adelaide Bank had admitted breaching its accountability obligations over a 2023 cyber incident, with an agreed $8 million penalty. The detail that generalises to AI controls is not the attack. It is that the weaknesses had been identified in penetration testing in 2020 and were still open when they were exploited.
Read article
Your AI Vendor Is Now an Identity Provider
Sign in with ChatGPT began rolling out across partner products on 29 July 2026, and OpenAI's own documentation says it is enabled by default for any organisation that has not set an explicit policy. The list of parties who can issue a credential into your systems just grew, and most access reviews do not have a column for it.
Read article
Your Menu Outgrew Your Team. AI Buys Coverage, Not Capability.
On 19 August 2026 APRA said it will consult in September on reforms across eight areas of investment management, including ensuring a trustee's investment management capability is commensurate to the complexity of its investment menu. AI answers the coverage half of that sentence and leaves the capability half exactly where it was.
Read article
Set the Evaluation Window Before the Pilot Starts
A longitudinal study of three agile teams over roughly thirteen months found a sharp rise in performance and perceived efficiency alongside flat developer activity. Most AI pilots run for weeks and judge themselves on activity, which is the one dimension that did not move. The fix is a decision leaders make before the pilot, not after it.
Read article
Customer Abuse Is a WHS Signal, Not Just a Conduct Problem.
Customer abuse data belongs in the WHS risk picture, but a model must not become a customer blacklist or an employee surveillance system. Use AI to surface channel-level exposure patterns, have people verify them, then redesign work, service and recovery controls.
Read article
Early Support Before Liability: Track the Process, Not the Person
Early support should move without waiting for liability, but its data must not become a shadow claim assessment. A two-lane AI board can track voluntary support and human action while keeping evidence, consent, privacy and every liability judgement under separate human control.
Read article
Data Residency Does Not Settle APP 8 for Your AI Prompts.
An Australian hosting region answers one field on a form. APP 8 turns on the overseas recipient, what it can access and for what purpose, and whether your organisation released the information's subsequent handling from its effective control. Map each access path before approving personal information in an AI workflow.
Read article
An AI-Written WHS Record Is Not Audit Evidence Until You Prove the Work Happened.
AI can turn scattered notes into an immaculate WHS record. That record still needs a source, confirmation from an accountable person and an operational trace before you rely on it as proof that the claimed safety work occurred.
Read article
Provider Invoice Anomalies Are Queries, Not Allegations
An invoice exception can tell you that two controlled records do not align. It cannot tell you why, prove misconduct or decide what section 16 requires. The safe workflow builds a source-anchored query packet and leaves every payment and conduct decision with an authorised human.
Read article
Your AI Credit Score Is Not a Responsible Lending File.
A model can rank credit risk, reconcile application data and flag exceptions. It still cannot prove the inquiries, verification and customer-specific suitability assessment behind a lending decision. Build a customer-outcome file that preserves the evidence and the authorised human judgement.
Read article
Your AI Rules Stop at Payroll. Your Risk Does Not.
Contractors, labour-hire workers and outsourced teams can touch the same customer work through different legal and technical boundaries. Give each boundary six equivalent operating controls before access starts, then test the handshake instead of trusting induction or contract language alone.
Read article
Certificate Review Dates Are Workflow Triggers, Not Capacity Decisions
A passed review date tells you that the certificate record needs human attention. It does not prove that capacity, entitlement or work arrangements changed. A three-state AI queue can expose the gap without converting a document date into a claim outcome.
Read article
A Reconsideration Request Needs an Issue Map, Not an Outcome Prediction
A section 62 request is stronger when each challenged term is tied to the original reason, evidence, alleged omission and requested change. AI can build that traceable map. It must not invent grounds, assess credibility or forecast what the reconsideration officer will decide.
Read article
The Board Signed the Risk Declaration. Can It Trace the AI Evidence?
AI can reconcile hundreds of attestations, tests and actions before a prudential risk declaration. It cannot make the declaration true. Give every claim a traceable source, every exception a visible route and every required signatory the evidence needed for genuine enquiry.
Read article
If Your Safety Chatbot Can Answer Freely, It Can Answer Wrongly.
A safety chatbot should not be a fluent substitute for a WHS practitioner. Give it explicit answer authority, approved sources, fixed refusal routes and a human owner, then test whether it stays inside those boundaries when workers ask difficult questions.
Read article
Plain-English Determinations Need a Reader Test, Not New Reasons
Plain language is not permission to improve a delegate's logic after sign-off. Freeze the human decision, test whether a recipient can find four essential answers, then permit only presentation edits that survive a semantic checksum and human approval.
Read article
ASIC Asked for the File. Your AI Summary Is Not the Production.
An AI summary can help organise an ASIC request. It cannot replace responsive source records, settle the notice's scope or make a privilege claim. Build a request-to-source ledger that lets legal reviewers trace every request item to native material, exclusions, gaps and the human production decision.
Read article
Do Not Grade Your Experts on Prompt Speed
Prompt fluency is useful, but it is not a proxy for professional value. Pair tool-fluent colleagues with context experts, then assess the boundary cases, evidence traps, escalation points and quality criteria they solve together. That is how experience becomes an adoption asset.
Read article
One AI Rollout Is Change. Ten Overlapping Updates Are an Exposure Pattern.
A rollout-by-rollout view misses what workers actually carry. Map concurrent implementations, supplier-pushed updates, transition work, retraining, role ambiguity and recovery capacity by work group. The point is not a new risk score. It is a human decision about collisions before the calendar becomes the control.
Read article
Your AI Fallback Is Not a Recovery Plan.
Your recovery playbook fails if the tool meant to execute it disappears with the crisis. Test every AI-assisted action after removing the model, data pipeline, credentials and provider support. A fallback is credible only when people can still start, run and evidence the action.
Read article
Section 39 Requests Need a Branching Evidence Map, Not One Checklist
An aid can be medical treatment, rehabilitation support or something outside both routes. AI can expose the branches and assemble the evidence, but a human must select the statutory path, decide entitlement and preserve the reasons for that choice.
Read article
Your AI Vendor Count Is Hiding One Foundation Model.
Three contracted AI vendors can still fail as one service when they share a foundation model, cloud control plane or identity layer. Map every service to its common technical roots, then test whether your nominated substitute survives the same failure.
Read article
Your AI Update Needs an Evidence Grade
An executive AI update should expose how each claim is known, not simply make progress sound certain. Grade every claim Measured, Observed, Estimated or Asserted, then attach its denominator, period, source, unresolved control, accountable human owner and the decision required.
Read article
TOOCS Coding Is Data Quality, Not a Liability Finding
A TOOCS code can improve national data and still prove nothing about liability. Use AI after human entry to test version, evidence traceability and cross-field consistency. Keep every correction with a human coder and every statutory finding with the delegate.
Read article
Your WHS Committee Pack Should Ask for Decisions, Not Bury Them in Updates.
A committee pack earns its pages only when it helps workers and management confront a risk. Use a one-page, role-coded packet that carries worker views, source evidence, control choices, the decision required, an owner and a review trigger into the room.
Read article
AI Can Draft the APRA Warning Comment. It Cannot Sign Off the Return.
APRA Connect may accept an explanatory comment after a validation warning. That does not make the explanation true. Build every AI-drafted sentence from the return cell, source query, data owner, validation rule and named reviewer who accepts responsibility for submission.
Read article
Your AI Advantage Cannot Belong to One Team
Giving every team the same AI licence does not create equal capability. Audit five conditions instead: safe access, protected practice time, suitable work, review burden and recognition. Then repair the opportunity gaps your rollout metrics cannot see.
Read article
The First Manager Message After an Incident Can Help or Harm. Govern the Draft.
After a robbery, threat or distressing customer interaction, the first manager message becomes part of the support system. AI can structure it, but only a trained person can verify facts, protect choice, control disclosure and decide what happens next.
Read article
A Complaint Is Not a Reconsideration: AI Can Route the Issue, Not Close It
A complaint can seek better service, challenge a determination and raise a licence concern in the same paragraph. AI can expose those parallel pathways, but a human must classify the message, protect every clock and approve every response.
Read article
AI Can Sort the Breach Queue. It Cannot Stop the 30-Day Clock.
AI can assemble evidence, connect similar incidents and challenge a preliminary assessment. It cannot decide when your licensee knew enough, whether a breach is significant or whether a report is due. Build the breach workflow around the statutory clock, not the model.
Read article
Run the AI Retro Before the Error Becomes the Process
A correction is not organisational learning. Use a focused AI retro to convert incidents, near misses and repeated repairs into one owned control change, then keep the action open until a human-reviewed retest proves the changed workflow behaves as intended.
Read article
A Defensible Claims Audit Sample Starts With the Population, Not an AI Risk Score
An AI-selected list of unusual claims may be useful for investigation, but it cannot represent a claims management system. Start with the frozen population and Comcare's published sample bands, preserve a representative core, and keep every targeted file, substitution and finding under auditor control.
Read article
Your TMD Needs Customers Who Do Not Exist.
Synthetic personas can expose a target market that is too broad, a distribution condition that fails at the edge and a review trigger that never fires. Use counterfactual pairs as adversarial tests, and never mistake generated cases for evidence of real customer outcomes.
Read article
A Risk Register Is Not Current Because AI Reworded It.
A fluent rewrite can leave every material control assumption untouched. Make the register route change signals to accountable people, evidence and consultation. AI can help find and organise those signals, but a human must decide whether the control remains effective and what happens next.
Read article
A Sanctions Alert Is Not Cleared Because the Model Says So.
AI can assemble aliases, identifiers, ownership clues and transaction context. It cannot turn a similarity score into legal clearance. Preserve the list version, evidence, unresolved questions, non-match reasoning and a named human approval for every material alert.
Read article
Silence Is Not Human Oversight
Human oversight fails when staff can see a suspect AI-assisted output but cannot safely stop it. Build a challenge route with a clear pause state, a leader-owned response, visible protection for good-faith escalation and a retest before work resumes.
Read article
An HSR Asked How the AI Tool Changes Work. A Vendor Slide Is Not an Answer.
A deployed AI tool is still a live WHS issue. Your HSR can ask for the risk picture, the control evidence and the changes since launch. Give them a useful answer without confusing representation rights with unrestricted system access.
Read article
Section 54 Intake: AI Can Find Gaps, Not Move the Clock
An intake model that merges receipt, claim compliance and clock status can hide delay behind a neat dashboard. Keep those states separate. AI can reconcile dates and expose missing evidence, but a human must decide section 54 compliance and every lawful exclusion.
Read article
The Contractor Used AI to Write the Safety Pack. Your WHS Duty Did Not Move.
AI involvement does not make a contractor safety pack useless, and contractor expertise does not make it sufficient. Section 14 says a WHS duty cannot be transferred. Test the document against the work, expose every shared-duty interface and verify that the controls operate.
Read article
Backdated Incapacity Needs Three Ledgers, Not One Payroll Fix
A retrospective incapacity determination can affect claim payments, payroll transactions and leave records at once, and those records do not carry the same legal meaning. AI should reconcile three ledgers and expose variances, while authorised claims and payroll professionals approve and post every correction.
Read article
Statement Summaries Need Source IDs, Not a Neat Story
A polished narrative can hide who said what, where it appears and what remains contested. A source-level assertion ledger keeps each proposition attached to the original statement, so AI assists evidence navigation while the authorised decision-maker retains every factual and credibility judgement.
Read article
Let AI Maintain the Obligations Register. Make a Human Own Every Change.
AI can compare approved source versions and propose candidate regulatory changes. It cannot decide what binds your organisation. Make it propose source-linked deltas, then require a named human to accept the legal state, effective date and register change, with two clocks keeping the history honest.
Read article
The AI Enthusiast and the AI Refuser Need the Same Test
The employee who uses AI for everything and the employee who avoids it can create the same management problem: you do not know whether their method fits the task. Test both with matched AI-required, AI-optional and AI-prohibited work, scored against one visible rubric.
Read article
Your GenAI Approval Needs an Expiry Trigger.
A GenAI approval records what passed on one date. It does not prove the live system still deserves approval. Build a living validation passport with explicit failure modes, change triggers, expiry and a human-controlled stop-use rule, and keep the four regulatory layers behind it separate.
Read article
The AI Joined the Meeting. The Decision Record Still Belongs to You.
AI can prepare the agenda, capture discussion and draft the minutes. It cannot be the authority for what the group decided. Use a named human decision owner and a compact six-field record that preserves evidence, caveats, dissent and action.
Read article
Defensible AI Lineage Starts Before the Prompt.
A citation beside an AI answer is not data lineage. You need the source snapshot, transformations, retrieved context, prompt, available model configuration, raw output and human edits. Without that packet, assurance starts after the evidence trail has already broken.
Read article
Do Not Put a Whistleblower Disclosure Into Your General AI Tool
A whistleblower disclosure is not ordinary case data. Section 1317AAE of the Corporations Act protects the discloser's identity and anything likely to identify them. Keep the raw account inside the protected whistleblower environment, and let AI assist only with a deliberately reduced control record that an authorised human has cleared for use.
Read article
AI Made the New Starter Faster. You Still Owe Them an Apprenticeship.
AI can make a new starter productive before they are ready to carry the judgement behind the work. Treat speed as borrowed capability, then rebuild apprenticeship around explanation, exposure, review and accountable human decisions.
Read article
Who in Your Organisation Can Actually Stop the Model?
Most organisations have an AI governance framework and no one with the standing to halt a deployment. The stop authority is a leadership design decision, and it has to be made before the incident.
Read article
Your AI Risk Register Maps the Regulator. It Misses the Plaintiff.
Australia's statutory tort for serious invasions of privacy gives individuals a direct cause of action that runs on different rules to the Australian Privacy Principles. Most AI risk registers do not carry it.
Read article
Normal Weekly Earnings: AI Can Assemble the Evidence, Not Set the Figure
Most NWE mistakes start before the formula: a missing allowance rule, a distorted pay period, or overtime with no evidence of being required. AI can expose those gaps, but the relevant period and section 8 figure remain human determinations.
Read article
A Determination Evidence-Check Skill File Under Section 14
An advanced SRC Act skill file that audits a draft determination's evidence chain against sections 5A, 5B and 14, flags hedged language and gaps, and never touches the decision itself.
Read article
An Incident Triage Skill File That Never Decides Notifiability
The first hour after a serious incident is chaos, and chaos is where structure helps most. This skill file structures the incident record and lays the facts under each notifiable incident question, while the statutory judgement, and the immediate phone call, stay with a person.
Read article
Your AI Vendor's Breach Starts Your Clock
On 6 July 2026 the OAIC reported the highest number of data breach notifications since the scheme began. Meanwhile organisations have quietly handed personal information to a new class of provider. Under the Privacy Act you hold what your AI provider possesses if you control it, which means the assessment clock and the notification are yours, not theirs.
Read article
Skill Files Are Controlled Documents. Treat Them Like It
The moment a skill file shapes work a regulator cares about, it stops being a personal productivity hack and becomes a controlled document. Version numbers and change logs inside the file, a named owner and approver, retained test evidence, reviews triggered by obligation changes, and a register of approved skills. Here is the discipline, anchored by a board-reporting skill your risk team can adapt today.
Read article
A Union Official Will Ask to Inspect Your Algorithm
New South Wales has legislated a power for WHS entry permit holders to require a business to provide reasonable assistance to access and inspect a digital work system. It has not started yet, because SafeWork NSW must publish guidelines first. That gap is the only preparation window HR is going to get, and the work it calls for is documentation, not defence.
Read article
Who Owns Your Team's Skill Library?
One person with skill files is a productivity story. A team with a shared library and no owner is a drift story. The advanced move is treating the library as a managed asset: one named owner per skill, a one-page index, a review cadence, and a team brief skill to anchor it.
Read article
The EU Delayed the Hardest Part of Its AI Act. Read It as a Caution, Not a Reprieve.
The world's most ambitious AI law just moved its own hardest deadline. High-risk obligations slip from August 2026 to December 2027, now written into Regulation (EU) 2026/1744. The delay is not a climbdown to celebrate. It is an admission the timeline was never workable, and a caution for anyone tempted to copy the EU model wholesale.
Read article
The Leader's Case for Slowing an Agent Down
Unattended AI agents can now run a whole workflow without stopping, and the human checkpoints that used to exist only because the work was slow have quietly disappeared. The rarer leadership skill is knowing when to add friction back on purpose. Here is how to decide, with two prompts, a Monday workflow and a checklist.
Read article
A Claim Chronology Skill File Built for De-Identification
A reusable six-part skill file that builds claim chronologies from de-identified material only, tags every entry to a source document, flags gaps and conflicts, and never states a view on liability.
Read article
The Safety Comms Skill File: Alerts Workers Actually Read
Safety alerts fail when they are generic, long and blame-flavoured. A safety comms skill file encodes the plain-language, site-specific standard once, so every alert, toolbox intro and bulletin meets it, and every draft still stops at the HSR and a competent person before release.
Read article
A Skill File for Regulatory Change: Impact Assessment On Demand
Every regulator release triggers the same scramble: read it, work out what it touches, brief the owners. The release changes every time. The method does not, and a stable method is exactly what a skill file is for. Here is a complete regulatory change impact assessment skill, the five prompts that build your team's own version, and how to install it in ChatGPT and Claude.
Read article
When a System Auto-Triggers a Performance Improvement Plan
SAP SuccessFactors now ships a business rule that can launch a performance improvement plan on its own when a rating drops. A machine that opens a PIP with no human decision is an adverse action and procedural fairness risk under the Fair Work Act. Here is the rule HR needs before enabling it: a system can flag, only a person can trigger.
Read article
Agents That Can Pay: Gate the Wallet First
The rails for agents that pay are being laid in public. Google's Agent Payments Protocol, built with more than sixty payment and technology firms, turns an agent's spending authority into a signed, limited, auditable instruction. Before any tool with a wallet reaches an Australian workplace, the practical question is the action gate: which payments an agent may start, at what limit, with whose approval, and what gets logged.
Read article
A Shared Team AI Identity Changes How You Lead
A private AI chat is invisible to the team. A shared AI in the channel is not. When one Claude drafts for everyone and its work is visible, credit, blame and how openly people speak all shift. Governing the access is settled elsewhere. Managing what a standing, visible AI does to a team is a leadership job.
Read article
Your Website AI Assistant Is Someone Else's Code
On 24 June 2026 the Privacy Commissioner published two determinations finding that health providers interfered with privacy by letting third-party tracking pixels collect sensitive information from their websites. The reasoning is not about pixels. It is about who owns third-party code running on a page you control, and the fastest growing category of that code is an AI assistant your customers type into.
Read article
When the AI Gets It Wrong, Who Carries It?
When an AI-assisted output fails, the blame lands on whoever was closest to the send button, usually the most junior person in the chain. Madeleine Clare Elish called that position the moral crumple zone. Accountability for AI-assisted work is either decided before the failure or decided by proximity afterwards, and deciding it is a leadership job no policy document can absorb.
Read article
A New AI Office Is Not a New AI Obligation
On 15 July 2026 the Commonwealth stood up an Office of AI inside the Department of the Prime Minister and Cabinet and announced a set of Australian Standards for AI. Commentary read it as Australia regulating AI. It is machinery, a standards process and a first target aimed at large data centres. Nothing announced binds how a regulated business uses AI today, and saying otherwise to a board is its own risk.
Read article
Your HRIS Now Lets Anyone Build an Agent
Workday's DevCon launch moved AI agent-building inside the HR system, and general-purpose workspaces like ChatGPT Enterprise and Claude Cowork put the same power in anyone's hands without the built-in guardrails. Here is the governance an HR team needs before it builds an agent that touches employee data: who may build, the go-live gate, and the Australian privacy and Fair Work rules that still apply.
Read article
Internal Audit's AI Say-Do Gap Now Has Numbers
Two 2026 surveys put hard numbers on something internal audit has felt for a year: adoption is racing ahead of capability. Gartner has 83 per cent of audit functions piloting or using AI, while only a small share feel able to embed it. The IIA and AuditBoard have 85 per cent alert to AI-enabled fraud and fewer than 40 per cent ready to detect it. For an Australian function, the gap is a benchmark to self-assess against, not a headline to read past.
Read article
Preventing Double Payment Under the SRC Act: AI Can Flag the Overlap, Not Calculate the Offset
The SRC Act guards against paying twice for the same injury: through third-party damages, an overlapping state workers compensation claim, or a state general compensation scheme. AI can flag a file for a possible overlap early and build the chronology of the parallel claim. Calculating the offset or recovery amount is a determination that stays with the case manager.
Read article
Canberra's AI Register Mandate Is a Preview
The Australian Government has made an AI use-case register mandatory for its own agencies. For private-sector GRC teams building registers under CPS 230, the government template is a working preview worth studying now.
Read article
Your Recruiter Is Now an Agent, Not a Search Box
LinkedIn's recruiting agent now reaches roughly $450 million in annualised revenue, and its AI screening interview is in testing, which means a growing share of Australian candidates are assessed by an audio or video agent before a human ever sees them. Here is the governance answer HR needs before enabling one: fairness, candidate notice and the record you must be able to produce.
Read article
The AI Delegation Charter Your Team Actually Needs
The honest conversation about AI and jobs fades the day after you have it. The follow-on that makes it real is a charter your team writes together, naming which tasks go to AI, which stay human, and when every line gets revisited. Here is how to build one, with two prompts, a Monday workflow and a checklist.
Read article
FAR Eased Up. Your AI Map Still Holds
ASIC and APRA are trimming FAR reporting from 16 June 2026. The accountability behind your AI use-case register has not moved. The practical change is what you actively maintain versus what you only produce on request.
Read article
Your AI Logs the Tokens. Not the Decision.
Your AI telemetry records what the call cost, not what the model was told or what it said. Every content attribute in the OpenTelemetry GenAI conventions ships opt-in, and the conventions warn the message content is likely to hold personal information. That is a privacy default, not an audit default, and the two pull in opposite directions. Here is the capture, redaction and retention decision nobody is being asked to make.
Read article
Super Trustees, AI and the Discretion You Cannot Delegate
APRA has put superannuation trustees inside its AI expectations and wants human involvement for high-risk decisions. The harder limit is statutory. A trustee's core discretions are owed personally to members under the SIS Act, and the money spent buying the AI has to clear the best financial interests duty. Here is how to tell a decision AI can support from one it must never make.
Read article
Reasonable Excuse Under the SRC Act: AI Can Structure the Analysis, Not Make the Finding
One test runs through five sections of the SRC Act: whether a claimant who failed to comply had a reasonable excuse. AI can structure that analysis on a de-identified file, sort the facts against the subjective and objective limbs and flag missing evidence. The reasonable-excuse finding, and any suspension or refusal that follows, stays with the human delegate.
Read article
AI in Reference and Background Checks: Verify Facts, Not Character
AI is arriving in the verification stage of hiring: tools that draft reference questions, summarise calls, scrape digital footprints and score candidates. The admin is worth automating; the judgement, the collection decisions and the fairness are not. Here is the line, a five-step process that holds it, and two ready prompts.
Read article
When the Other Side's AI Invents the Law
Self-represented workers are lodging Fair Work claims built on AI-invented cases and award clauses. Two 2026 Commission decisions show the range of outcomes, from a forgiven concession to a costs application. Here is how a respondent spots a fabricated authority and raises it without ambushing an unrepresented person.
Read article
Your AI Agent Can Remember Now. Govern What It Keeps.
In 2026 the major labs shipped persistent memory as a first-class agent feature, barely six weeks apart. An agent that remembers across sessions is a different thing to govern, and a new attack surface. Treat the memory store as a governed data asset with write rules, provenance, expiry and rollback, not invisible plumbing.
Read article
Freed Board Bandwidth Is for AI Oversight
APRA's draft CPS 510, released 16 June 2026, consolidates five governance standards and cuts duplicative fit-and-proper paperwork for around 6,000 people. Read with APRA's April AI letter, the freed board capacity has an obvious destination: AI oversight.
Read article
Governing AI Agents Before the Consumer Data Right Lets Them Act
The Consumer Data Right is gaining write access. Once actions are designated, an accredited provider, or an AI agent behind it, could initiate payments and switch products on a consumer's instruction. The controls for agent-initiated actions are far cheaper to build now, before any money can move.
Read article
What Your AI Workspace Actually Remembers, and What It Doesn't
Claude Cowork Projects give a workspace persistent memory, and most people have never read what that memory keeps, forgets or separates. Here is the memory model in plain terms, and the settings to decide before your team leans on it.
Read article
What 9,700 Real Users Actually Do With Claude
Most debate about AI and work runs on anecdote. Anthropic's June 2026 Economic Index, Cadences, offers something rarer: behavioural data on what roughly 9,700 real users do with AI, matched to how they feel about their careers. Almost every conversation produces real work, and the heaviest delegators are the most optimistic. Here is what a people leader should take from it.
Read article
Ground the Model, Do Not Trust Its Memory
A weak model with the right tool beat a strong model working from memory. Anthropic's biology-agent benchmark put numbers on it: accuracy ran as low as 16.9% from recall and cleared 99.7% once grounded in the authoritative source. The lesson holds for every regulated workflow that turns on a rule, rate or standard. Ground the model, do not trust its memory.
Read article
Canberra Just Measured What AI Is Doing to Jobs. It Found 2%.
The Australian Government has published its first systematic measurement of AI's effect on employment. DEWR's July 2026 report finds the most AI-exposed occupations grew 5.6 per cent since ChatGPT arrived, against 9.5 per cent for the least exposed, and models a 2 per cent shortfall against trend. The number is small, the caveats are real, and the implications for WHS, workers compensation, GRC, HR and leadership teams start now.
Read article
Your AI Passed the Pilot. Production Is a Different Test.
A pilot that passed proves the AI worked once, on that data, on that version of the model. Then the model changes underneath you, the data shifts and usage drifts, and the thing you signed off quietly stops being the thing running. The answer is a standing evaluation harness, not a launch-day test. Here is how to build one, and why regulated work needs it most.
Read article
Your AI Rollout Landed on Your Managers. Resource It.
The C-suite treats AI adoption as a software rollout and a headcount saving. New research shows the real cost lands somewhere else: on middle managers, who quietly absorb the validating, coaching and change management the rollout creates, with no extra time and no support. If you lead the leaders, that hidden invoice is yours to see and to fund.
Read article
Australia Will Not Pass an AI Act. You Are Still Regulated.
The National AI Plan settled the question every GRC team was waiting on. Australia will not pass a standalone AI Act. That is not a reprieve. It means AI is already regulated, spread across the laws and regulators you answer to now. Here is how to stop waiting for an AI law and map every AI use to the obligation it already touches.
Read article
AI Wrote the Ad. ASIC Still Holds You to It.
ASIC refreshed its advertising guide for the first time since 2012, and it now reaches AI-generated advertising and the capability claims firms make about their AI-enabled tools. The medium is no defence. Here is what AI-washing looks like, what RG 234 now expects, and the marketing controls to put in place before the next campaign ships.
Read article
More Agents Is Not More Intelligence. Govern the Coordination.
The plumbing for multi-agent AI just got standardised, so building systems where agents talk to each other is now easy. That is exactly why the useful question changed. Not can you wire agents together, but should you, and how do you govern the coordination when more agents is not more intelligence.
Read article
The Fair Work Commission's Three Rules for AI in a Case
The Fair Work Commission's draft guidance on generative AI sets three rules for anyone lodging a document: disclose the AI use, verify every fact and citation against an authoritative source, and never let AI write a witness statement. A June law change makes getting this right more urgent, not less. Here is the pre-filing discipline for HR and ER teams.
Read article
Structured Outputs: Get the Same Shape Every Time
Structured outputs give an AI response a stable, checkable shape: required fields, data types and allowed values. This guide shows how to design an output contract, test it and keep human review where it belongs.
Read article
Build a Golden Test Set Before You Trust an AI Workflow
One impressive answer proves almost nothing. Build a small golden test set of normal, difficult and boundary cases, score the output against observable criteria, and record every release decision.
Read article
Stop Counting Prompts. Measure the Work That Improved
Prompt counts measure tool activity, not productivity. This piece gives leaders a six-layer scorecard for measuring a defined workflow before and after AI: adoption, flow, quality, rework, risk and outcome, plus a one-page measurement contract with a decision rule set before the trial starts.
Read article
Use AI to Kill Work Before You Accelerate It
Before automating a task with AI, test whether the work should exist at all, be done less often, use fewer approvals or stop at a lower level of polish. A seven-step work-kill review maps the decision the work serves, removes the redundant steps, then applies AI to the constraint that remains.
Read article
Use AI to Build Practice Simulations, Not to Award the Pass
HR teams can use an approved AI assistant to build fictional role-plays, reveal information in stages, vary the difficulty and draft coaching questions. What AI must never do is decide whether an employee passed, is competent or faces an employment consequence. Here is the six-step workflow, the standards to write first, and the boundary that keeps assessment human.
Read article
AI Can Map a Flexible Work Request. It Cannot Decide Reasonableness
AI can structure a flexible work request: the deadline, the missing facts, the consultation agenda, the workable alternatives and a draft response built from verified inputs. It cannot decide eligibility under section 65 or reasonableness under section 65A of the Fair Work Act. Here is the case-map workflow that keeps the judgement human.
Read article
The 2026 AI Governance Talent Market: Assurance Skills Move to the Core
Australia's AI governance market is shifting from principle-setting towards assurance: control design, model testing, data lineage, third-party oversight and evidence a board or auditor can challenge. APRA has named the skills gap, no salary guide prices the role cleanly, and the scarce profile is the practitioner who can move from principle to proof.
Read article
Your Pricing Agent Is Still Your Competition Risk
An AI pricing agent does not sit outside Australian competition law. Businesses must still set prices independently, prevent unlawful competitor coordination and control the data, objectives and vendors shaping every recommendation. Here is the cartel-law map, the five questions GRC must ask and the evidence pack to build before go-live.
Read article
AI Can Stress-Test an Emergency Plan. It Cannot Run the Drill.
AI can challenge a de-identified emergency plan against scenarios, missing roles, communication failures and changed workplace conditions. It cannot test how people behave under pressure. Regulation 43 keeps the testing, the training and the drill itself human.
Read article
AI Can Draft WHS Training. It Cannot Verify Competence.
AI can draft WHS learning objectives, scenarios, quizzes and facilitator notes from verified source material. It cannot observe a worker performing the task or certify competence. This guide sets out where the two human gates sit and how to run the drafting workflow without letting a completion record impersonate a competent worker.
Read article
AI Can Map a Section 29 Household Services Claim. It Cannot Decide What Is Reasonable
AI can organise a de-identified section 29 household services claim by task, pre-injury contribution, post-injury capacity, household composition, family contribution, disruption and cost. It cannot apply the word reasonable. This guide gives you the evidence map, the prompt and the human decision line.
Read article
AI Can Organise a Section 36 Rehabilitation Assessment. It Cannot Choose the Program
AI can build a de-identified source register, chronology, evidence map and question list for a section 36 rehabilitation assessment under the SRC Act. It cannot conduct the statutory assessment, require an examination, select the assessor or choose the rehabilitation program. This guide maps where the machine stops and the people named by the Act take over.
Read article
AI's Next Constraint Is Power. Australia Has Started Writing the Rules
Australia is starting to treat AI infrastructure as an energy-system issue. Government expectations now ask new data centres to add clean supply, pay their grid costs and support flexible demand, while a draft AEMC rule would set technical connection standards for large loads.
Read article
Model Routing Cuts AI Bills. It Also Moves Your Data.
The enterprise AI story has shifted from which model is best to which one you can afford to keep using, and buyers are moving from tokenmaxxing to model routing. The instinct is right. But for Australian regulated work a cheaper model is usually a different provider in a different place, so every routing rule is also a Privacy Act and APRA data-flow decision.
Read article
Someone Poisoned the Tool Description. The Agent Did the Rest.
Microsoft's incident-response team has documented the first real-world attack on the Model Context Protocol: poison a tool's description and you redirect the agent, without touching its code, its credentials or its prompt. The site's earlier MCP piece predicted this. Here is what "least agency, not just least privilege" means as an operational control, not a slogan.
Read article
AI in Complaints Handling: What RG 271 Reserves for a Person
Financial firms are putting AI into the exact process ASIC made enforceable in RG 271. AI can triage, summarise and draft a complaint response, but the 30 day clock, the reasons, the systemic issue call and the fairness of the outcome stay with a person. Here is the obligation map, a worked example and the prompts to build your own.
Read article
A Government Now Vets Who Gets the Model. File It as a Vendor Risk.
For the second time in a month, a US government put a frontier model behind a gate. This time it was an access list: roughly 20 vetted organisations get GPT-5.6, chosen name by name. The capability story is covered. The one that lands on your desk is procurement: government-imposed access conditions are now a vendor-risk category your due diligence has to name.
Read article
AI Can Build the Section 16 Picture, Not Make the Call
Section 16 of the SRC Act pays for medical treatment only where it was reasonable to obtain and the cost is appropriate. That is a judgement, not a fact. This guide gives you the prompts, the Monday workflow and the checklist so AI assembles the picture while a delegated officer makes the call.
Read article
Your Team's First Shared AI Identity Is a Decision, Not a Toggle
Claude Tag lets a whole Slack channel share one Claude with its own memory and admin-scoped access. That is a new kind of AI at work, and switching it on is a design decision, not a button. Here are the five decisions to make first, and a safe way to trial it.
Read article
AI Guardrails: The Safety Layer No Vendor Can Ship for You
A new default model does not make your AI system safe. Reliability and safety in production come from the guardrail layer you build around the model: input rails, grounding, output rails and action gates. Here is the architecture, a worked example that turns a written policy into running rails, and the prompts and checklist to build your first rail this week.
Read article
A Deadline Is Not a Decision: Greenlighting AI Before the Free Window Closes
OpenAI's free window for ChatGPT's workspace agents closes today, right as the workspace-setup season begins. A vendor's deadline is a fact about the vendor, not a reason for you to decide. Here is the criteria a leader should actually greenlight on: real team need, switching cost, and governance readiness.
Read article
You Are Now Buying Software for Agents, Not People
Gartner says $234 billion of enterprise SaaS spend is exposed to agentic arbitrage by 2030. Read as a vendor problem it is a headline. Read as a buyer it changes how you procure and govern the software you already run, so this piece turns the forecast into an API-parity test you can run this week, a five-clause contract checklist and a Monday workflow.
Read article
Claude Sonnet 5 Became the Default. That Is a Change Event.
Anthropic released Claude Sonnet 5 on 30 June and made it the default in Claude Code and on Claude.ai Free and Pro. Almost nobody chooses a model, so a frontier swap is a silent change to a system you may have already validated. Here is how to treat it as a change event: the prompts, the Monday workflow and the register entry.
Read article
Fable 5 Returns With a Jailbreak Severity Framework
Claude Fable 5 comes back globally on 1 July, three weeks after a US directive pulled it. The return matters less than what came with it: a safety patch that over-blocks routine coding, and a four-dimension jailbreak-severity framework the major labs are building together.
Read article
CPS 230's 1 July Deadline Just Caught Up With Your AI Vendors
From 1 July 2026, pre-existing contracts with material service providers must meet APRA's CPS 230, and a growing share of those arrangements are now AI. Here is the work to do before the deadline, plus a reusable contract-review prompt.
Read article
AI Can Read the Award. It Cannot Set the Pay.
Award rates rise on 1 July 2026 and almost anyone can now paste a clause into an AI tool and get a confident answer. AI can help you read the award. It can never set the pay, and the law holds a person accountable for the figure.
Read article
AI Cyber Defence Just Scaled Up. Mind Your Open-Source Dependencies.
OpenAI pointed its most capable cyber model at the open-source software the world runs on, and found hundreds of real flaws in days. The capability is dual-use. Here is what it means for Australian teams.
Read article
AI Agents Just Went From Minutes to Hours. The Control Point Is Where They Run.
OpenAI bought Ona and published research showing AI agents now run for hours, not seconds. The unit you have to govern moved from the prompt to the environment the agent runs in.
Read article
The Scams Prevention Framework Meets AI: What 'Reasonable Steps' Now Demands
Treasury's exposure-draft codes for the Scams Prevention Framework set a technology-neutral reasonable-steps duty on banks, telcos and digital platforms. The scams it targets are now AI-generated, which raises the bar and creates a second duty: govern the detection AI you deploy to meet the first.
Read article
AI and the Reasonable Administrative Action Exclusion: Map the Actions, Keep the Judgement
A practical guide to where AI genuinely helps with a section 5A reasonable administrative action determination, and exactly where the work stops being organisation and becomes human judgement.
Read article
Rolling Out AI Is a Workplace Change: Consult and Risk-Assess First
Switching on an AI tool that allocates, paces, measures, or monitors work is a change to the work under Australian WHS law. The duty to consult workers and risk-assess it sits with the business before go-live, and NSW has now written it into statute.
Read article
AI Note-Takers in HR Meetings: Consent Before the Transcript
AI meeting assistants now record HR's most sensitive conversations by default, and often nobody in the room agreed to it. Here is a consent-and-records protocol that keeps the time savings without manufacturing your next privacy breach.
Read article
AI Can Draft a SWMS in Seconds. The Site Walk and the Consultation Cannot Be Automated.
AI can produce a formatted safe work method statement in under a minute, but for high-risk construction work a SWMS is a regulated document. The site walk and the consultation that make it lawful are exactly the parts AI cannot do.
Read article
An AI Safety Control Is Still Just a Control. The Duty to Verify It Stays With You.
An AI safety camera or sensor is a control measure like any other, and usually the weakest kind. This guide sets out the WHS duty it touches, where it sits in the hierarchy, and how to deploy and verify one without fooling yourself.
Read article
GPT-5.6 Sol Lands. The Frontier Just Got Gated.
On 26 June OpenAI previewed GPT-5.6, a new three-model family it calls its strongest yet. The capability is real, but the news is the access: at the US government's request it launched to a handful of vetted partners, not to you. For the second time in a month a US lab's best model is gated by government. Frontier access is now a policy variable, and your AI plan needs to assume it.
Read article
The Review Tax: AI Adoption Is Done, Now Design the Checking
Your team has adopted AI. The new problem is that the time it saves is leaking straight back out as reviewing and correcting. BCG's June 2026 data makes the leadership job clear: design how AI output gets checked, or watch the gain disappear into ad-hoc double-checking.
Read article
AI Can Analyse Your Engagement Survey Without Surveilling Your People
AI can read every free-text comment in your engagement survey and turn a thousand of them into themes in minutes. Done well, it finally puts that feedback to use. Done badly, it turns a survey into surveillance. Here is the line, and a workflow that stays on the right side of it.
Read article
AUSTRAC Just Put AI Risk Into Your AML Program Documents
On 19 June 2026 AUSTRAC updated the program starter kit documents that reporting entities build their AML/CTF programs from, adding artificial intelligence to the risk information. If you built your program before that date, your risk assessment is now out of step with the regulator's.
Read article
Context Engineering: What the Model Is Allowed to See
The reliability of an AI system is decided less by how you word the prompt and more by what you let into the context window. Context engineering is the named discipline for that, and it is the highest-leverage AI skill for anyone doing real work, especially in regulated settings.
Read article
OpenAI Built Its Own Chip. The Real Story Is the Cost of Intelligence.
On 24 June, OpenAI and Broadcom unveiled Jalapeño, OpenAI's first custom chip, built to run its models more cheaply. The coverage is about a strike at Nvidia. The useful signal for a practitioner is the opposite of hardware: it is the falling cost of intelligence, and what that does to your AI decisions and your governance. Cost has quietly been holding AI back. That fence is coming down.
Read article
Your AI Assistant Just Became a Shared Teammate. Govern the Channel.
On 23 June, Anthropic launched Claude Tag, a single shared Claude that lives in a Slack workspace with its own memory and admin-scoped access to channels, tools and data. The unit of AI collaboration just moved from the private conversation to the team channel. The thing you now have to govern is no longer a prompt. It is a standing presence. Here is what changes, and the three decisions to make before it is live.
Read article
AI and Permanent Impairment: Organise the Evidence, Keep the Judgement
A permanent impairment claim under section 24 lives or dies on the medical evidence. AI can assemble, de-identify and structure that evidence against the approved Guide, and surface the gaps. It cannot assess the impairment or make the determination. Here is the workflow.
Read article
Decision Rights Are the Leadership Job AI Just Made Urgent
Sixty per cent of executives now use AI to support their decisions, yet most organisations have never been clear about who decides what. AI does not wait for that clarity. If you do not assign decision rights deliberately, the system will assume them. Here is the leadership move.
Read article
AI in Workplace Investigations: Organise the File, Not the Finding
AI can compress the administrative weight of a workplace investigation: planning, transcribing, organising evidence, drafting the framework. It cannot assess credibility, weigh the evidence or make the finding. Here is how to use it without compromising procedural fairness.
Read article
AML Tranche 2: What AI Can and Cannot Do for Your New Program
From 1 July 2026, tens of thousands of lawyers, accountants, real estate agents and dealers in precious metals become AML regulated for the first time. AI can help them stand up a program fast. It cannot own the risk-based judgement AUSTRAC will hold them to.
Read article
Model Context Protocol: The Standard Wiring AI Into Your Tools
In eighteen months the Model Context Protocol went from an Anthropic experiment to the way AI plugs into your tools and data. Understanding what it is matters less than governing the connectors, because each one is a new door into your systems. Here is the capability and the control work.
Read article
AI Hiring and Performance Tools Under Australia's Positive Duty: What HR Must Control
AI screening, ranking and performance tools sit squarely inside the positive duty under the Sex Discrimination Act, the Fair Work Act and the Privacy Act. Here is the control framework Australian HR teams need before they deploy.
Read article
AI Worker Monitoring in Australia: What HR Can and Cannot Do
A practitioner guide for Australian HR teams on the privacy, surveillance, Fair Work and WHS rules that govern AI monitoring of workers, including the new automated decision-making transparency duty from 10 December 2026.
Read article
AI Work Allocation and Psychosocial Risk: The WHS Duty NSW Teams Already Hold
AI work-allocation and monitoring tools create psychosocial hazards that NSW WHS law already requires PCBUs to identify, control and consult on. Here is the duty, the verified provisions, and a risk-assessment workflow.
Read article
ChatGPT Just Got Better at Health. Mind the Boundary.
On 18 June OpenAI announced a substantial step up in ChatGPT's health intelligence, free to the 230 million people who already ask it health questions every week. Better answers do not move the boundary between information and a clinical decision. Here is what that means for Australian professionals this week.
Read article
AI for Incident Analysis and Leading Indicators: A Human-in-the-Loop WHS Playbook
A practical, human-in-the-loop guide for Australian financial-services WHS teams. Use AI to surface leading indicators across de-identified incident data and to propose ICAM-style contributing factors, while keeping the notifiability decision firmly with a competent person.
Read article
AI-Assisted Psychosocial Risk Assessment: A WHS Governance Workflow That Keeps the Sign-Off Human
A practical WHS governance workflow for Australian financial-services teams: use AI to synthesise de-identified survey data and draft the written psychosocial risk assessment, while a nominated competent person assesses the risks and chooses the controls after consulting workers, then signs off.
Read article
Set the AI Norm: Your Team Copies How You Use It
The biggest lever on whether AI lands in your team is not the licence or the training budget. It is whether you, the manager, visibly use it, set the standard, and make it safe to try. The evidence is now clear, and so is the move.
Read article
Automated Decisions Now Belong in Your Privacy Policy
From 10 December 2026, APP entities that use personal information in automated decisions affecting people's rights must say so in their privacy policy. For Australian financial services, that is most of the AI already running in underwriting, fraud, collections and claims. Here is the readiness work, with a reusable AI project, prompt library and a worked insurer example.
Read article
Stop Trusting the Leaderboard: Evaluate AI on Your Own Work
A new frontier model lands most months, the public benchmarks they tout are methodologically shaky, and the demo always wins. The only evidence that should move your money is performance on your own work. Here is how to test it, using a private evaluation Project you build yourself.
Read article
Business Teams Can Now Build Their Own AI Agents
Databricks launched Genie One this week, an agentic coworker pitched at finance and marketing teams, not engineers. The real shift is who holds the build button, and where that moves the control point. Here is what to do this week, with a governance prompt you can run today.
Read article
The OWASP Agentic Top 10: A Defence Playbook for the Agents You Are Deploying
OWASP has published a Top 10 built specifically for AI agents. It reframes the agent as a privileged user that reads untrusted text and acts with your access. Here is the practical defence playbook.
Read article
AI Is Moving Into the Core Systems of Regulated Work
This week two of the world's largest IT services firms began wiring a frontier model into the core systems that banks, insurers and airlines run on, not the chat window. Here is what it means for regulated work, and what to do this week.
Read article
AI Week in Review, 8-14 June 2026: A Frontier Model Pulled by Government Order
The week a US directive forced Anthropic to suspend two new frontier models worldwide, plus six verified vendor moves and a repeatable method for turning AI news into Monday actions.
Read article
Claude Model Routing for Regulated Work: Which Model to Use for GRC, WC and HR Tasks
Choosing a Claude model is a governance decision, not a speed decision. Route by capability tier, score the task, and keep accountable review with named people, with worked examples for GRC, workers compensation and HR.
Read article
AI as a Red Team for Leaders: How to Challenge Thinking Without Surrendering Judgement
A practical method for using AI to stress-test leadership decisions across six challenge modes, while keeping evidence, judgement and accountability with the right people.
Read article
AI Decision Memos for Leaders: Sharpen the Thinking Without Outsourcing the Decision
A practical method for using AI to structure a leadership decision memo, grounded in named decision frameworks, while the leader keeps the judgement and the accountability.
Read article
Build the Knowledge Spine That Stops Generic AI Output
Generic AI output is a context problem, not a prompt problem. Learn how a governed knowledge spine grounds your models in real organisational knowledge, with worked examples for GRC, workers compensation and HR.
Read article
Gold Standard Claude Workspace Setup
A gold standard Claude workspace for Australian enterprise teams. The right surface for each job, the files that carry context, an interview method to build each one, and the data-governance gates that keep it safe.
Read article
Gold Standard ChatGPT and Codex Setup
Build ChatGPT and Codex into one AI operating system for Australian enterprise work: the right surface per job, an interview method to build each one, and the data gates that keep it safe.
Read article
Build an Offline GRC Controls Console Without Creating Shadow IT
A single-file controls console can sharpen evidence review without leaking data. Treat it as a governed end-user computing tool, not a free win.
Read article
Build a WC Evidence Chronology Tool Without Outsourcing Judgement
A practical pattern for using an LLM to build an offline, de-identified workers compensation evidence chronology tool that organises facts while the delegate keeps every SRC Act decision.
Read article
Turn a Teams Transcript Into a Controlled HR SOP
A staged, evidence-first method for converting a recorded HR meeting into a governed standard operating procedure with an owner, a version history and a review rhythm.
Read article
Gemini 3.5 Flash: Google Makes the Agent the Default
Google made an agentic model the worldwide default in the Gemini app and AI Mode in Search before the flagship even shipped. The benchmark and pricing evidence says Flash genuinely replaces last generation's Pro, and millions of workers got a more autonomous default model overnight.
Read article
Microsoft's Seven MAI Models: The In-House Bet Under Copilot
Microsoft launched seven home-grown MAI models at Build 2026 and started swapping them into Copilot and the Microsoft 365 stack. For practitioners the story is procurement, not benchmarks: data lineage claims, weight tuning, and a billing change in the same week.
Read article
The Right to Disconnect Changes How Teams Should Configure AI Workflow Tools
Practical guidance for HR and managers on configuring AI workflow tools to respect the Fair Work right to disconnect, including audit checklists and sample policies.
Read article
AI Work Allocation Needs Psychosocial Risk Controls
Effective AI work allocation requires assessing psychosocial risks like job demands, control, support and fairness before deployment.
Read article
AI in Performance Reviews: Draft the Words, Keep the Judgement
AI can synthesise a year of evidence notes into a solid first draft of review feedback. It cannot own the rating, the calibration case or the conversation. Here is the workflow that keeps the line clear.
Read article
Managers Need an AI Operating Rhythm, Not More Pilots
Managers must move beyond isolated AI pilots by establishing a clear operating rhythm that integrates AI into team workflows with regular review and improvement cycles.
Read article
AI in Internal Audit: What Still Counts as Evidence
Internal audit functions are adopting AI faster than they are writing the rules for their own use of it. The IIA's 2024 Standards never mention artificial intelligence, yet every evidence, documentation and objectivity requirement still applies to AI-assisted audit work.
Read article
AI Literacy Is a Management Skill, Not a Training Module
Managers must embed AI literacy through daily behaviours like prompting, verification, privacy hygiene, escalation and review to ensure responsible AI use.
Read article
Build an AI Use Case Register That Boards Can Actually Use
Practical guidance for GRC teams to create AI use case registers that deliver clear, decision-ready evidence for boards and risk committees.
Read article
AI Cyber Risk Is Now a Board Governance Issue
ASIC's May 2026 cyber uplift warning highlights that AI-driven cyber risk demands active board and risk committee oversight, not just IT fixes. This article outlines a practical governance operating model for GRC teams.
Read article
AI Agents Need Approval Gates Before They Need Autonomy
Autonomous AI agents are becoming practical, but organisations should design approval gates, permissions and evidence trails before granting action rights.
Read article
AI Upskilling Will Fail If HR Does Not Redesign the Work
Training people to use AI is useful, but HR also needs to redesign roles, capability frameworks and quality controls around changed work.
Read article
From Voluntary AI Guardrails to Audit Evidence
Australia's voluntary AI guardrails only become useful when GRC teams translate them into control objectives, artefacts and assurance tests.
Read article
Prompt Libraries Make WC AI Safer Only When Human Review Comes First
A practical SRC Act article on de-identification, placeholder prompt libraries, file-note drafting and human review controls for workers compensation communications.
Read article
Small Models, Edge AI and the Next Governance Blind Spot
As AI moves into devices, business apps and smaller specialised models, organisations need governance that looks beyond frontier models and public chatbots.
Read article
Workplace AI and Privacy: The Trust Test HR Cannot Outsource
AI productivity tools can reshape workplace data collection, monitoring and employee trust. HR needs a privacy-first governance model before adoption scales.
Read article
AI Incident Response Needs an Evidence Pack, Not Just a Playbook
Prompt injection, data leakage and agentic failures require GRC teams to rethink incident response evidence, escalation and assurance.
Read article
Leveraging AI to assist dissecting the SRC Act Review
A practitioner workflow for employers to dissect the December 2025 SRC Act Review with AI tooling. Project setup, four prompt patterns, submission scaffolding, and the two human review gates that keep the work defensible.
Read article
AI Can Organise Recovery-at-Work Information, but People Must Decide
A practical SRC Act article on using AI to support suitable duties and recovery-at-work planning without replacing evidence, consultation or human judgement.
Read article
The AI Pilot-to-Scale Gap Is an Operating Model Problem
Most organisations can run AI pilots. Far fewer can scale them safely, consistently and usefully across real work.
Read article
Board AI Literacy Is Now a Control Expectation, Not a Training Nice-to-Have
APRA's April 2026 AI letter signals that board AI literacy is becoming a governance control expectation, not a generic awareness exercise.
Read article
Predictive Analytics and Claims Triage: A Risk Analysis for Scheme Operators
Predictive triage models promise faster decisions and better outcomes. They also concentrate legal, ethical, and procedural fairness risk. Here is how to think about both.
Read article
Treating Practitioner Reports and AI: Where the Workflow Helps and Where It Hurts
AI is a strong summariser of treating practitioner reports and a poor judge of medical evidence. The line between the two is the difference between speed and risk.
Read article
The Incapacity Cross-Check Workflow: AI as a Calculation Auditor
Section 19 calculations are arithmetic-heavy and error-prone. AI shines as a second pair of eyes, not as the primary calculator. Here is the workflow.
Read article
ASIC's AI Supervisory Posture, Decoded
ASIC's posture on AI in financial services is now visible across REP 798, the 2026 Key Issues Outlook, and recent statements from the Chair. Five themes shape supervisory expectation, and three create immediate work for compliance teams.
Read article
AI Tools in Workers Compensation Claims: Where Value, Where Risk, Where Governance
AI is now operating across five workflows in workers compensation claims. The value is real. The governance baseline is non-negotiable. A practitioner's map of where each tool fits, what it actually does, and what to never do.
Read article
ART Review Rights Under the SRC Act: A Practitioner's Map
Review and appeal rights under the SRC Act 1988 changed in October 2024 when the AAT became the Administrative Review Tribunal. A practitioner's map of the three review tiers, the timeframes that apply, and the place AI evidence is taking in workers compensation matters before the ART.
Read article
CPS 234 and AI Vendors: A Due Diligence Framework
CPS 234 has been in force since 2019. AI vendors stretch the framework in specific ways: training data exposure, model update opacity, and inference infrastructure that crosses the standard's information asset boundaries. A practical due diligence framework.
Read article
FAR and AI: How Accountability Maps to Tooling Decisions
The Financial Accountability Regime makes specific senior executives answerable for the systems and decisions inside their portfolios. AI tooling decisions sit inside that accountability, whether they are formally documented in the accountability map or not.
Read article
Custom Projects vs Raw Chats: When to Graduate Your AI Workflow
Raw chat is fine for ideation. For any workflow you run more than twice, Custom Projects pay back fast. Here is the rule for when to graduate.
Read article
AML/CTF and Large Language Models: A Compliance View
Large language models are now embedded across AML/CTF programs, from suspicious matter triage to KYC document review. AUSTRAC's posture on these uses is shaping. Reporting entities need a clear governance position now, not later.
Read article
Privacy-Safe AI for Regulated Work: A Working Practitioner's Guide
Workers compensation, GRC, HR and clinical roles all sit on regulated data. Using AI well in those roles is not optional. Doing it safely is not optional either. This is the practitioner's guide.
Read article
DDO and AI-Driven Personalisation: Where the Boundary Sits
AI personalisation is moving fast inside Australian financial services. The Design and Distribution Obligations were not written with adaptive recommendation engines in mind. The boundary between targeting and personal advice is the line GRC teams need to govern.
Read article
RAG Explained for Non-Engineers: How AI Reads Your Documents
RAG is the architecture behind most enterprise AI tools you will meet in 2026. The acronym hides a simple idea. Here it is, explained in plain English with a working analogy.
Read article
APRA's Model Risk Thematic Review: What to Expect
APRA's AI supervisory work has moved from signal to substance. The April 2026 letter to industry reported a deep-dive on the largest banks, insurers and super trustees, and a forward plan of prudential reviews and thematic activities is being finalised. Where the pressure lands, and the work to do now.
Read article
Choosing Claude, ChatGPT, Gemini or Copilot for Your Job
The four main AI tools have meaningfully different strengths in 2026. The right choice depends on your job, not on the marketing. Here is a working professional's decision guide.
Read article
Reading the Reasoning Trail: A Case Note on AI Drafted Determinations
An illustrative case profile that mirrors live ART concerns: when an AI drafted determination cannot be unwound to its underlying reasoning, the determination itself is at risk.
Read article
CPS 230 and AI: A Practical Operational Resilience Playbook
CPS 230 has been live since 1 July 2025, and APRA's amended standard commenced on 1 July 2026. The question for boards and operational risk teams is no longer whether AI tools fall inside the standard. It is how to evidence it.
Read article
How to Read an AI Tool Safety Card and Spot the Red Flags
Every frontier AI vendor publishes a safety card or model card. Most are 30 pages of mixed marketing and substance. Here is how to read one in 20 minutes and walk away knowing what matters.
Read article
On-Device AI at Work: Apple Intelligence and Pixel Gemini Nano
On-device AI is enterprise-ready in narrow ways and not in the ways the demos suggest. Apple Intelligence and Pixel Gemini Nano in April 2026: what works, what does not, and the real privacy story.
Read article
SRC Act and AI Assisted Determinations: A Practitioner Framework
AI can draft a determination in minutes, but the SRC Act still demands a qualified human decision maker. Here is the practitioner framework that keeps both true.
Read article
Australian AI Safety Standard: 18-Month Review
Eighteen months in, Australia's voluntary AI Safety Standard has shifted from optional reading to procurement table stakes. Three things worked. Two did not. The next phase is moving towards mandatory.
Read article
Reasoning Budgets in Production: How Teams Are Spending Them
Anthropic shipped reasoning budgets in late March. Six weeks of production data shows the feature pays for itself when teams set the right ceilings. It does not when they leave it on default.
Read article