AI Governance Framework for Australian SMBs

An AI governance framework is the set of roles, records and routines that decide how your business picks AI tools, what they may touch, who checks their output and what happens when something goes wrong. For a 10 to 200 person Australian business, it should fit on a handful of pages and be owned by one named person. It does not need a committee, a consultant on retainer or an ISO certificate, although for some businesses the certificate will come later.

TL;DR: Start with a named owner, an AI register and three risk tiers, then add approved tools, data rules, human review, vendor checks, incident handling and a six-monthly review. Map it to the National AI Centre’s six essential practices (the AI6), which in October 2025 condensed the ten guardrails of the Voluntary AI Safety Standard. Align with ISO/IEC 42001 rather than certify, unless you sell AI to enterprise or government buyers who ask for the certificate.

Policy, checklist, framework: what’s the difference?

These words get used interchangeably, which is part of why governance stalls. A policy tells staff the rules. Our free AI policy template covers that. A checklist tells you what the law requires and by when, which is the job of our AI compliance checklist for Australian SMBs. A framework is the machinery around both. It says who owns AI decisions, how a new use gets assessed, where the records live and when the whole thing is reviewed.

The Australian Government draws the same line. The National AI Centre’s Guidance for AI Adoption: foundations tells organisations to create an AI policy as a first step, then, as AI use grows, to “turn your AI policy into a governance framework”.

That guidance is the national reference point. The National AI Centre published it on 21 October 2025 as the first update of the 2024 Voluntary AI Safety Standard, and the implementation guidance document says that update “condensed 10 guardrails into 6 essential practices”. Those six practices, often called the AI6, are: decide who is accountable, understand impacts and plan accordingly, measure and manage risks, share essential information, test and monitor, and maintain human control. Foundations is written for organisations starting out or using AI in low-risk ways. The implementation guidance covers mature governance and high-risk uses, with a crosswalk showing where each old guardrail went.

The guidance is voluntary, for now. On 15 July 2026 the Prime Minister announced Australian Standards for AI, with legislation expected in early 2027 and no definition yet of who they will cover. Our AI regulation in Australia article tracks it. A business that governs AI sensibly now will not be starting from zero whatever the final law says.

A proportionate AI governance framework in nine parts

The framework we recommend has nine parts, scaled for a business without a risk team. Each maps to one or more of the AI6 practices.

Owner and roles. The foundations guidance asks you to “assign a senior leader as the overall AI governance owner”. In a 40-person business that is usually the managing director, the operations lead or a fractional CTO, not the most enthusiastic junior. Then give every AI system in the register its own accountable person, so a question about the chatbot or the CV screener always has someone to answer it.

The AI register. This is the backbone, and the part most businesses skip. List every AI tool, its use, owner, data and risk tier. Include the AI you did not choose: the summariser in your CRM, the notetaker someone connected to Teams, the screening feature in your recruitment platform. The National AI Centre publishes a free AI register template in Word and spreadsheet form. If you suspect staff are already using tools nobody approved, read our piece on shadow AI before you build the register, because the first version will be incomplete.

Risk tiers. Three is enough. Low covers internal drafting, summarising and research with no personal or confidential data. Medium covers anything customer-facing or anything touching personal or client data. High covers any use that makes or shapes decisions about people: hiring, credit, pricing, eligibility, health. The same tool carries different risk depending on the job: in the foundations guidance’s words, using AI to draft marketing emails “is different to using it to assess job applications”. Tier the use, not the product.

Approved tools and data rules. These belong in the policy; the framework keeps them current. Company accounts only, and no tax file numbers, health information or customer personal details in any tool not approved for that data. The OAIC’s guidance on commercially available AI products recommends against entering personal information, particularly sensitive information, into publicly available generative AI tools.

Human oversight. Scale it to the tier. Low-tier output gets the same review as any staff draft. High-tier uses get a named reviewer, a record of the review and a clear point where a person can override, pause or switch the system off, which the guidance calls “human override points”.

Vendor assessment. Most SMB AI risk sits with suppliers, so ask before you sign: where the data is stored, whether it trains their models, how long they keep it, what testing they have done. The foundations guidance says “ask for proof”. Our AI vendor data privacy checklist lists the questions.

Incidents, monitoring and review. Define an AI incident broadly: wrong data in the wrong tool, a harmful output sent to a customer, a biased result. Promise no blame for same-day reporting, and log each fix. Check medium and high-tier systems after go-live, because AI tools change behaviour when vendors update models. Review the whole framework every six months, and straight away when you add a high-tier use or a regulator publishes something new.

Where the Privacy Act fits

From 10 December 2026, new APPs 1.7 to 1.9 apply to any APP entity whose computer programs make, or do something substantially and directly related to making, decisions that could reasonably be expected to significantly affect someone’s rights or interests. Its privacy policy must describe the kinds of personal information used and the kinds of decisions involved. The OAIC published its guidance, fact sheet and flowchart on 30 September 2026. This is where the register earns its keep: you cannot disclose decisions you have not listed, and your high-tier entries are the shortlist for that disclosure. Businesses with turnover of $3 million or less are generally exempt, with exceptions such as health service providers. The detail is in our AI regulation post.

Where ISO 42001 fits

ISO/IEC 42001:2023 is the international standard for an AI management system, published in December 2023. Standards Australia adopted it as AS ISO/IEC 42001:2023 in February 2024. A management system is the idea you may know from ISO 9001 or ISO 27001: policy, objectives, roles, risk assessment, internal audit and management review, run as a cycle rather than written once. The auditable requirements sit in clauses 4 to 10, and Annex A provides a reference set of 38 controls covering areas such as AI policy, impact assessment, data and supplier relationships.

The implementation guidance says its practices “draw on and are aligned with” AS ISO/IEC 42001:2023 and the US NIST AI Risk Management Framework. Build the nine parts above and you have done much of the groundwork for 42001 without its audit cycle.

Who needs ISO 42001 certification? Fewer businesses than the marketing suggests. It makes sense if you build or sell AI products or services to enterprise or government buyers, or if tenders and major customers have started asking for it. Microsoft is one concrete case: Drata’s summary of its supplier program lists ISO 42001 as mandatory for suppliers whose AI work for Microsoft is classed as sensitive use. If you use AI internally and sell something else, certification buys a certificate nobody has asked to see.

What certification involves. A gap analysis, then running the management system long enough to produce records, an internal audit and a management review, then a two-stage external audit. Stage 1 reviews your documentation; Stage 2 tests whether the system works. Certificates run for three years with annual surveillance audits. Use a certification body accredited for ISO 42001 by JAS-ANZ or another IAF-recognised accreditation body. Accredited capacity in this region is still thin: JAS-ANZ accredited Intertek in July 2025, and when it accredited A Good Certification Group in September 2026, the group was described as one of four certification bodies globally with that accreditation.

What it costs. Prices checked on 2 November 2026 against published Australian provider estimates. Aegentra’s 2026 cost guide puts readiness work at A$22,000 to A$45,000 and the Stage 1 and Stage 2 audit at A$10,000 to A$22,000 for a 10 to 50 person business that already runs ISO 27001, with surveillance audits from A$2,500 a year. Starting from scratch adds roughly 30 to 50 percent to readiness. These are planning estimates, not quotes, and exclude your own staff time. On timing, Aegentra suggests four to six months with ISO 27001 in place and six to nine without, and Cybernion gives four to nine months after a three to six week gap analysis.

Align or certify? Three levels

Most businesses should align with ISO 42001 and the AI6, not certify. Alignment means using the standard’s structure as a guide to what good looks like. Certification means paying an auditor to confirm it every year. The second only pays when a buyer will reward it.

Getting started

Download the free AI policy template and fill in its approved tools register first. That gives you a policy and the first draft of your AI register in an afternoon. Then name your owner.

The owner is where most SMBs get stuck. Governance needs someone who can judge a vendor’s answers and has the authority to say no. Our fractional CTO and fractional AI lead service can hold that role for a few days a month. If you’d rather have the register, risk tiers and vendor reviews set up as a one-off project, we can scope that as a Strategy & Advisory engagement. If you want to find where AI saves time before you govern it, the AI Quick-Win Audit is a fixed-price start.

An AI governance framework does not have to be large to work, but somebody has to own it and look at it again in six months. Start with the template and the register. If you want help deciding whether your business sits at Starter, Growing or Certifying, book a free 30-minute call.

Frequently Asked Questions

What is an AI governance framework?

An AI governance framework is the set of roles, records and processes a business uses to decide which AI it uses, what data that AI can access, who reviews its output and how problems are handled. For a small or medium business it usually includes a named owner, an AI register, risk tiers, an AI policy, vendor checks, incident handling and a regular review.

Is AI governance mandatory in Australia?

Not as a standalone law yet. The National AI Centre’s Guidance for AI Adoption is voluntary, and the Australian Standards for AI announced in July 2026 are not yet legislated. Existing laws still apply to AI use, and from 10 December 2026 businesses covered by the Privacy Act must disclose certain automated decisions in their privacy policies.

What replaced the Voluntary AI Safety Standard?

The Guidance for AI Adoption, published on 21 October 2025, is the first update of the Voluntary AI Safety Standard. It condensed the standard’s 10 guardrails into 6 essential practices and comes in two versions: foundations for organisations starting out, and implementation guidance for mature or high-risk use.

Does my business need ISO 42001 certification?

Probably not, unless you build or sell AI products or services to enterprise or government buyers who ask for it. Most SMBs get the benefit by aligning their framework with ISO/IEC 42001 and the AI6 practices without paying for a three-year audit cycle.

How much does ISO 42001 certification cost in Australia?

One Australian provider’s 2026 estimates put readiness at A$22,000 to A$45,000 and the certification audit at A$10,000 to A$22,000 for a small business that already holds ISO 27001, plus annual surveillance audits. Starting from scratch costs more. Allow four to nine months.