Big-company frameworks run to committees and quarterly audits. An owner-led business can start much smaller. The people using AI every day need to know the rules, and the directors need to know what's in use and whether it's working.
Why directors should own it
If you're a company director, you have a duty under section 180 of the Corporations Act to act with care and diligence. The National AI Centre says that duty includes making sure adequate governance systems exist to manage the risks your AI systems create. Your staff will use AI whether or not the board has said anything about it. Governance is how you make sure that use is safe and aimed at the work that matters.
The National AI Centre's Guidance for AI Adoption, which ai.gov.au now lists under the heading Essential AI practices, puts this first. Its opening practice is to decide who is accountable, and the first two actions are to name a senior leader as the overall AI governance owner and to create an AI policy. Later, it suggests turning that policy into a governance framework. That's the step this page covers.
If your business has a formal board, the Australian Institute of Company Directors' A Director's Guide to AI Governance (2026) is also worth reading. It comes with a two-page summary and checklist for small and medium business and not-for-profit boards.
The one-page framework
Each line maps to one or more of the six practices in the Guidance for AI Adoption, so you can start on the national guidance without having to read all of it first.
| Line on the page | What to write | Practice it covers |
|---|---|---|
| Owner | One named director or senior leader who owns AI decisions, and a deputy | Decide who is accountable |
| Policy | A link to your AI use policy, and the date it was last reviewed | Decide who is accountable |
| Approved tools | Each AI tool, the plan you're on, who has access, and the data settings you've checked | Share essential information |
| Approved uses | The jobs AI is cleared for, and the ones that need sign-off first | Measure and manage risks |
| Off limits | What never goes into an AI tool, and the decisions AI never makes alone | Maintain human control |
| Checks | Who checks AI-assisted work before it reaches a client, and how | Maintain human control; test and monitor |
| People affected | Who is affected by your AI use, how they'd raise a problem, and what you tell them | Understand impacts and plan accordingly; share essential information |
| Incidents | Who staff tell when something goes wrong, and how fast | Measure and manage risks |
| Review | When the board reviews this page, and what it looks at | Test and monitor |
Keep it to one page. If a line needs more detail, link out to a separate document and keep the summary here.
How to fill it in at one meeting
Set aside about 90 minutes with the directors and whoever runs operations. Work through it in this order.
Start with what's already in use. Ask the team before the meeting which AI tools they use, including free accounts and AI features inside software you already pay for. The National AI Centre's register guidance says to include AI features embedded in common software, so count the AI in your CRM or email too. The list is usually longer than directors expect.
Name the owner. One person, with enough authority to say yes or no to a new tool. In most owner-led businesses that's a director or the operations manager. Write down a deputy for when they're away.
Approve the tools. Pick one main AI tool on a business plan where you can, and check its data settings before anyone puts client work in it. Move people off personal accounts.
Sort uses into three groups. Some jobs are cleared for everyone, like drafting internal emails or summarising long documents. Some need sign-off first. And some are off limits. For the sign-off group, the National AI Centre's AI screening questions are a good test: seven questions to run before you spend money or build anything. If any answer is yes, the use may need stricter controls.
Decide the checks. For each approved use, who reviews the output before it leaves the business? Be specific. "The account manager reads every AI-assisted client report and checks the figures before it's sent" is a check. "Use judgement" isn't.
Set the review date. We'd suggest every quarter for the first year, because the tools change quickly, then twice a year once things settle.
What the board looks at each review
A review should take 15 minutes on the agenda. These five questions cover it:
- Has anyone started using a new AI tool or a new AI feature since last time? Is it on the page?
- Did anything go wrong, or nearly go wrong? What did we change?
- Are the checks happening? Pick one piece of AI-assisted client work and ask who reviewed it.
- Is anything on the "needs sign-off" list now routine enough to clear for everyone?
- Has anything changed in the law or in our industry's rules that affects the page?
The National AI Centre lists early warning signs worth asking about, including staff relying on outputs without checking them, customer complaints about accuracy or tone, and use of unapproved AI tools. If you hear any of those, that's the item to spend the time on.
On the fifth question, there's one date every director should know. From 10 December 2026, businesses covered by the Privacy Act must say in their privacy policy when they use computer programs that use personal information to make, or help make, decisions that could significantly affect people. If AI helps with hiring, pricing, credit or eligibility in your business, put that on the next agenda.
What you probably don't need yet
A separate AI committee. In a business of 20 or 50 people, the board or the leadership meeting is the committee. Add a standing item instead.
A certification. Formal AI management standards such as ISO 42001 exist and suit larger organisations or those selling AI products. Most owner-led businesses get more from a working one-page framework and a team that follows it.
A long risk register. Start with the handful of risks that apply to how you use AI. Our guide to AI risk management for small businesses covers the six we'd write a rule for first.
A dedicated AI hire. Someone needs to own it. In most owner-led businesses that's an existing director or operations lead with a few hours a month, plus outside help when you want it.
Getting the framework to change how people work
Behaviour changes when the team knows the rules and sees the directors following them too. Share the page with everyone, walk through the approved uses with real examples from their own work, and thank people who raise a problem early.
Then use the framework to steer AI toward the work that gives your team the most time back. With the checks in place, directors can approve new uses faster, because they know who's watching each one.
Common questions
It's the set of decisions, roles and checks that controls how a business uses AI. For a large organisation it can be a full management system. For an owner-led business, one page covering ownership, tools, uses, limits, checks, incidents and reviews is enough to start.
There's no AI-specific law requiring a governance framework for ordinary businesses as at November 2026. The Commonwealth says it intends to legislate Australian Standards for AI in early 2027, though that timing could move. What it has published so far focuses on large data centres and AI training, and the final detail isn't out yet. Directors' existing duties, privacy law and industry rules still apply to how your business uses AI, and a framework is a practical way to show how you're managing them.
There's no single framework you're required to adopt. The main national guidance is the National AI Centre's Guidance for AI Adoption, which sets out six practices, and the table above maps each line of the one-page framework to them.
The policy tells staff what they can and can't do. The framework is the directors' view: who owns AI, what's approved, how it's checked and when it's reviewed. The policy sits inside the framework. Our free AI use policy template is a good place to start.
Every quarter in the first year, then twice a year. Review sooner if something goes wrong, you add a tool, or the law changes.