AI governance checklist for Australian businesses

AI governance checklist for Australian businesses

A plain-English checklist for businesses that use AI tools, organised by the six essential practices in the Australian Government's Guidance for AI Adoption (National AI Centre, October 2025), with the Australian laws that sit behind each item. Version 1.0, 30 October 2026.

Start here. Tick what you already do. Most small and mid-sized businesses can complete the first two sections in a week. Items marked with a date have a legal deadline.

Before you start: know where you stand

Two questions decide how much of the rest applies to you.

• We know whether the Privacy Act covers us. Most businesses with turnover above $3 million are covered, and so are some smaller ones, including health service providers and businesses that trade in personal information (Privacy Act ss 6C to 6EA).
• We know which industry rules apply to our AI use (for example ASIC, APRA, TGA, AHPRA, court practice notes, government supplier contracts).

1. Decide who is accountable

• A senior leader is the named AI owner, with authority over all AI use. Good practice rather than a legal requirement. For companies, directors' duty of care and diligence extends to AI use (Corporations Act s 180; ASIC Report 798).
• We have an AI use policy, approved by the board or owners, that staff have read and signed.
• Every AI tool in use has a named owner who manages its settings, users and risks.
• The board or owners get a short AI report at least every quarter: new tools, high-risk uses, incidents and training.
• People who approve or oversee AI have been trained on its risks and limits.

2. Understand impacts and plan accordingly

• For each AI use that affects customers or staff, we have thought about who could be harmed and how (wrong answers, unfair outcomes, over-reliance).
• People can easily raise a concern about our AI, or ask for a person to review an AI-assisted decision.
• Once we decide to introduce AI that will significantly change people's jobs, we consult them and their representatives. Consultation terms in modern awards and enterprise agreements on major change, including technology (Fair Work Act 2009 s 205; model consultation term).
• We consult workers and health and safety representatives before introducing AI that allocates, paces, monitors or assesses work. WHS duty to consult (model WHS Act ss 47 to 49; in Victoria, OHS Act 2004 s 35) and the psychosocial hazard regulations.
• We never monitor staff with AI tools without written notice and a monitoring policy. Required in NSW (Workplace Surveillance Act 2005) and the ACT (Workplace Privacy Act 2011, which also requires good-faith consultation), with 14 days' notice; good practice elsewhere.

3. Measure and manage risks

• Every new AI tool or use is screened and given a risk tier (Low, Medium, High or Prohibited) before it starts.
• Staff know what information may go into which AI tool: no sensitive information, and no personal or confidential information in free or personal accounts. APP 6 (use and disclosure); OAIC guidance on commercially available AI products (October 2024).
• Provider training on our data is switched off in the contract or settings, and we know where each tool stores our data. APP 8 and s 16C (overseas disclosure).
• We check AI vendor contracts for data use, retention, location, security, IP protection and liability before we sign.
• We have a list of prohibited uses (for example deepfakes of real people, covert recording, facial recognition without approval).
• Our incident plan covers information put into the wrong AI tool, wrong AI output, AI-enabled scams and deepfakes. Notifiable Data Breaches scheme: assess a suspected breach within 30 days (Privacy Act s 26WH).
• If our turnover is above $3 million, we know a ransomware or cyber extortion payment must be reported to the Australian Signals Directorate within 72 hours. Cyber Security Act 2024, Part 3.

4. Share essential information

• We keep an AI register listing every AI tool and use, including AI features inside software we already pay for.
• Customers are told when they are dealing with AI (chatbots, voice agents), can reach a person, and have a way to get help that does not depend on AI.
• By 10 December 2026: our privacy policy describes the kinds of personal information used, and the kinds of decisions made, by computer programs that make or substantially help make decisions that significantly affect people. APP 1.7 to 1.9 (Privacy and Other Legislation Amendment Act 2024).
• Our public claims about AI ("AI-powered", "accurate", "unbiased") are true and backed by evidence. Australian Consumer Law ss 18 and 29. For s 29, the fixed maximum company penalty doubled to $100 million from 28 March 2026.
• We never publish AI-written reviews or testimonials as if they came from real customers, and we label synthetic people in advertising. Australian Consumer Law s 29(1)(e) and (f) (false testimonials) and s 18.

5. Test and monitor

• Customer-facing AI answers only from approved content, and is tested before launch, after each significant change and at least every quarter. Australian Consumer Law s 18. No Australian court has ruled on chatbots yet, but Treasury's 2025 review of AI and the Australian Consumer Law says a business can be liable for misleading conduct by AI it uses.
• A person checks AI output before it is sent, published or relied on for advice. Good practice; APP 10 (accuracy) applies where the output is personal information.
• AI used in decisions about people has been tested for unfair results across groups. Anti-discrimination laws apply to our decisions whether or not a tool helped make them.
• AI tools sit behind single sign-on and multi-factor authentication, and AI agents have limited access and keep logs.
• We review each AI tool when the vendor changes its model, terms or price, and at least once a year.

6. Maintain human control

• A person makes every decision about hiring, pay and discipline, and can explain it. Any decision a program makes on its own (for example refunds or payment terms) is approved as High risk, and people can ask a person to review it. Fair Work Act s 361. If an employee says adverse action was taken for a prohibited reason, the employer must prove it was not, so the decision-maker must be able to explain the real reasons.
• AI agents need a person's approval for payments, deletions, external emails and changes to important records.
• AI notetakers and call recording are used only with everyone's consent, and never join a meeting without their owner. State and territory surveillance and listening devices laws. In NSW, WA, SA, Tasmania and the ACT, even a person taking part usually needs everyone's consent to record, subject to exceptions. Everywhere, sharing a recording is restricted.
• We can pause or switch off any AI tool, and the work can continue without it.
• Payments and bank detail changes are verified by calling a known number, never on a voice, video or message request alone.

This checklist is general information only, not legal advice, and does not create a lawyer-client relationship. Osher Digital is an AI and automation consultancy, not a law firm. It reflects Australian law and guidance as at 30 October 2026; check that it is still current, and get advice from a qualified Australian lawyer for your circumstances. To the extent permitted by law, Osher Digital is not liable for any loss arising from reliance on it; nothing excludes rights under the Australian Consumer Law that cannot be excluded. Not affiliated with or endorsed by the Australian Government. Free to use inside your own business. Editable templates: osher.com.au/ai-governance-templates/