Free template
AI governance for boards: a two-page board paper and the questions to ask
A two-page board paper you can table at your next meeting. It explains why AI is a board issue in Australia, what to decide, the ten questions directors should ask, and what management should report every quarter.
Or read the full text free, below.
Version 1.0 · Updated · Reflects Australian law and guidance as at 30 October 2026 · Not legal advice
In short
AI governance for boards means directors setting the business's appetite for AI risk, approving the AI policy, making sure someone is accountable, and getting regular reports on how AI is used. In Australia, ASIC has said directors' duty of care and diligence extends to the adoption, deployment and use of AI.
Why AI is a board issue in Australia
There is no AI Act in Australia, and directors don't need one to be on the hook. Their existing duty of care and diligence already covers AI. ASIC's Report 798 (October 2024) says these duties "extend to the adoption, deployment and use of AI". It expects directors to know how their company uses AI, how far they rely on AI-generated information, and what the reasonably foreseeable risks are.
Regulators keep saying it. In March 2026 Joe Longo, then ASIC Chair, told directors that every board needs to have a conversation about AI use and determine its risk appetite and policies. A month later, APRA's letter to industry on AI (30 April 2026) said many boards are still developing the technical literacy required to provide effective challenge.
And the AI is already there. 43% of Australian small and medium businesses reported using AI in December 2025 to February 2026 (National AI Centre). Policy or not, staff use it: 44% of Australian employees who use AI at work said they had used it in ways that go against policies or guidelines (KPMG and University of Melbourne, Trust, Attitudes and Use of AI: A Global Study 2025, Australia insights).
Two dates belong on the agenda. The fixed maximum penalty for companies under the Australian Consumer Law doubled to $100 million from 28 March 2026, which matters for anything your chatbots and marketing say. From 10 December 2026, privacy policies must describe significant automated decisions.
What the board should decide
A board does not need to manage AI. It needs to make five decisions and then hold management to them:
- Approve the AI use policy. The AI policy template is written for this.
- Set the risk appetite in a sentence or two: what the business will and will not use AI for.
- Name the accountable executive. One person who owns AI across the business.
- Confirm the privacy deadline is handled. The privacy policy guide explains what has to change by 10 December 2026.
- Agree what management reports, and how often. Quarterly suits most businesses.
How to use the board summary
- The AI owner fills in the "Where we stand" table from the AI register. Use text labels (Done, In progress, Not started), not colours alone.
- Delete the decisions you do not need, and add any specific to your business.
- Table it with the AI use policy, and minute the decisions and any training directors complete.
- Use the quarterly reporting list as the standing agenda item from then on.
How it relates to the AICD guide
The Australian Institute of Company Directors and the Human Technology Institute at UTS publish A Director's Guide to AI Governance (Version 2, June 2026), built around four elements: strategy, structure, practices and enablers. It comes with a checklist for SME and not-for-profit boards. It is the reference to read. This template is a different thing: a short, editable paper that a management team can fill in and table at the next meeting.
The full template
General information, not legal advice. Have a lawyer review your final versions. Read the disclaimer
This is the complete text of the Word file. Shaded [fields] are for you to fill in.
AI governance: board summary
[Business name] | For the [month year] meeting of the [board / owners] | Prepared by [AI owner, role]
How to use this template. Fill in the "Where we stand" table from your AI register, choose the decisions you need, and table this paper with the AI use policy. Keep it to two pages. Use text labels (Done, In progress, Not started), not colours alone. Delete this box before you send it.
Purpose
To agree how [Business name] governs its use of AI, and to approve the AI use policy.
Recommendations
That the [board / owners] make the decisions listed under "Decisions for the board" below.
Why this is on the agenda
- We already use AI. Our AI register lists [number] AI tools and uses, including [number] that touch personal information and [number] that help make decisions about people.
- Staff use AI whether or not there is a policy. In a 2025 study, 44% of Australian employees who use AI at work said they had used it in ways that go against policies or guidelines, and 57% had relied on AI output without checking its accuracy (KPMG and University of Melbourne, Trust, Attitudes and Use of AI: A Global Study 2025, Australia insights).
- Directors' duties cover AI. ASIC says directors' duty of care and diligence "extend[s] to the adoption, deployment and use of AI" (ASIC Report 798, October 2024). There is no AI Act in Australia: existing laws apply, and regulators are applying them.
- A privacy deadline is close. From 10 December 2026, our privacy policy must describe automated decisions that significantly affect people, if the Privacy Act covers us (APP 1.7 to 1.9).
- Penalties are higher. From 28 March 2026, the fixed maximum penalty for a company that makes false or misleading representations under the Australian Consumer Law doubled to $100 million. The other limbs did not change: three times the benefit or, if the benefit cannot be worked out, 30% of adjusted turnover. That includes what our chatbots and marketing say about AI.
Where we stand
| Area | Status | Comment |
|---|---|---|
| Named AI owner | [Done / In progress / Not started] | [Name, role] |
| AI use policy approved and signed by staff | [Done / In progress / Not started] | [% of staff signed] |
| AI register complete | [Done / In progress / Not started] | [Number of tools; date last reviewed] |
| Privacy policy updated for automated decisions (by 10 December 2026) | [Done / In progress / Not started / Not applicable] | [Number of in-scope decisions] |
| High risk uses approved and documented | [Done / In progress / Not started] | [List them] |
| Staff trained | [Done / In progress / Not started] | [% complete] |
| AI incidents this period | [Number] | [Short description and action taken] |
Decisions for the [board / owners]
- Approve the AI use policy, version [1.0].
- Approve the AI risk appetite: [for example, "We use AI to save time on drafting, research and administration. We do not let AI make decisions about people without a person deciding. We do not put sensitive information into AI tools."]
- Confirm [name] as the AI owner, accountable for AI use across the business.
- Note the plan to update the privacy policy before 10 December 2026.
- Agree that management reports on AI every [quarter], using the measures below.
Questions directors should ask
- Where do we use AI today, including AI built into software we already pay for? Is the register complete?
- Which AI uses help make decisions about customers, applicants or staff? Who reviews those decisions, and could they explain one?
- What information goes into AI tools, and where is it stored? Do any providers train on our data?
- What do our chatbots and marketing say about us and our AI, and how do we know it is accurate?
- Are we covered by the Privacy Act, and is the privacy policy ready for 10 December 2026?
- Do we record meetings or calls with AI? How do we get consent?
- What would we do if a staff member put client information into the wrong AI tool tomorrow?
- Which AI vendors could we not do without? What is our plan if one fails or changes its terms?
- What does our insurance cover for AI errors, AI-generated advice and deepfake payment fraud?
- Are we using AI to prepare board papers? Who checks that content?
What management will report each quarter
- AI tools and uses added, changed or retired
- High risk uses and their review results
- Incidents, complaints and near misses, and what we did
- Staff policy sign-off and training completion
- Vendor changes to terms, models or prices that affect us
- Changes in law or regulator guidance that affect us
Key dates
| Date | What |
|---|---|
| 28 March 2026 | Australian Consumer Law: the fixed maximum penalty for companies doubled to $100 million |
| 10 December 2026 | Privacy policy must describe automated decisions (APP 1.7 to 1.9) |
| 1 July 2027 | New ban on unfair trading practices, including manipulative digital design, starts |
| [Date] | Next review of the AI use policy |
Australian AI Governance Kit template, version 1.0 (October 2026), by Osher Digital (osher.com.au/ai-governance-templates/). For a fuller guide, see the AICD and Human Technology Institute's A Director's Guide to AI Governance (Version 2, June 2026).
Use this template
Download the editable Word file, or the full kit with all five templates.
Questions
Frequently asked questions
More from the kit
The rest of the Australian AI Governance Kit
AI governance checklist for Australian businesses
Plain-English AI governance checklist for Australian businesses, mapped to the six practices in the Guidance for AI Adoption, with the law behind each.
Read it free
Word
AI policy template for Australian businesses
Free AI use policy template for Australian businesses, with staff rules, data limits, notetaker consent and privacy law built in. Read it, then download.
Read it free
Word
Automated decisions and your privacy policy: what to change by 10 December 2026
From 10 December 2026, privacy policies must explain significant automated decisions. Check if APP 1.7 applies to you and adapt our sample wording.
Read it free
Disclaimer
General information, not legal advice. These pages and templates are general information only. They are not legal advice and do not create a lawyer-client relationship. Osher Digital is an AI and automation consultancy, not a law firm.
Current as at 30 October 2026. They reflect Australian legislation and regulator guidance as at that date. Laws, guidance and vendor terms change, so check that the content is still current before you rely on it. Adapt the templates to your business, and have a qualified Australian lawyer review your final versions, especially if you work in a regulated industry or use AI or other software to make decisions about people.
Liability. To the extent permitted by law, Osher Digital is not liable for any loss or damage, including loss caused by negligence, arising from the use of or reliance on these pages or templates. Nothing in this disclaimer excludes, restricts or modifies any right or remedy you have under the Australian Consumer Law that cannot be excluded.
Sources and endorsement. The kit covers the six essential practices in the Australian Government's Guidance for AI Adoption (National AI Centre, October 2025). Links to government and other websites are for convenience; we do not control them. Osher Digital is not affiliated with or endorsed by the Australian Government, the National AI Centre or the Office of the Australian Information Commissioner.
Permitted use. You may copy, adapt and use the templates inside your own business or organisation. You may not sell them, or republish them as templates for others, without our written permission.
Want a second pair of eyes on your AI register?
Book a free 15-minute call. We look at your register, tell you which tools to fix first, and show you where AI can save your team time without adding risk.