AI Governance
Your board is accountable for what AI produces in your organisation. Is it equipped to govern it?
OCNUS provides AI governance advisory for boards and executive teams across Australia. The risk at the centre of that advisory is internal risk, the risk that arises from how an organisation's own people use AI, which runs across three distinct threads and four organisational levels.
External risk and bad actor risk are real and distinct categories. Internal risk is where most Australian organisations are most exposed, and where most boards have the least visibility.
Internal Risk
The risk is current, largely invisible, and already creating liability.
AI is already being used throughout most organisations, at every level, without adequate policy, training or oversight. The people accountable for what that use produces — legally, regulatorily and reputationally — are largely unaware of the extent of it.
The risk runs in three threads that compound each other. Active risk: harm arising from ungoverned AI use that is already happening — data exposure, output reliance, vendor liability, agentic systems acting without adequate oversight. Passive risk: capability and competitive position being lost through the failure to develop AI across the workforce. Skill and judgement erosion: the gradual degradation of human capability through consistent over-delegation to AI. The full framework is available in the OCNUS Research section.
There is a further dimension. APRA's April 2026 guidance and ASIC's published findings on the AI governance gap across Australian organisations reach the same conclusion: directors' duties under the Corporations Act apply regardless of awareness. A board that has not closed the gap between its AI adoption and its AI governance is carrying director liability it may not have examined. Awareness is the starting point. Prompt action follows.
The Regulatory Position
In April 2026, APRA wrote directly to the boards of regulated entities in Australia, sharpening its expectations on AI governance. Its conclusion was unambiguous: many boards have not yet developed the technical literacy required for effective AI oversight, and the gap between AI adoption and AI governance is now a board-level accountability. ASIC has reached a parallel conclusion. For regulated entities, this is not a future obligation. It is a current one.
The Risk Profile of AI Depends on the Kind of AI
Not all AI carries the same governance implications.
Generative AI use in the workplace can be described in three categories: Instrumental AI, Decisional AI and Agentic AI. OCNUS provides a taxonomy of these in Understanding AI.
The risks associated with an Instrumental AI tool used by operational staff differ categorically from those arising from a Decisional AI system used by executives, which differ again from those posed by an Agentic AI system acting autonomously on the organisation's behalf. Effective AI governance for boards requires the ability to distinguish between these risks and put in place the board AI oversight mechanisms each category demands.
What OCNUS Delivers
Governance that is fit for purpose and demonstrably so.
Exposure Understood
The board and executive team understand the organisation's current AI risk exposure across the three risk threads and four organisational levels. That understanding is the foundation of sound AI governance.
Framework in Place
An AI governance framework that is fit for purpose: policy, oversight mechanisms and the internal structures needed to manage AI use responsibly. Aligned to APRA and ASIC guidance and to directors' duties under the Corporations Act.
Accountability Secured
The ability to discharge directors' duties on AI with confidence across legal, regulatory, fiduciary and reputational dimensions, and to demonstrate that they have been discharged if asked by a regulator, a court or a shareholder.
Who It Is For
Boards that are ready to govern, and those that are not yet but need to be.
Boards and executives of Australian organisations where AI is already in use or where significant AI investment is planned. Organisations in regulated industries, including APRA-regulated entities, where the ability to demonstrate sound AI governance is consequential and where the AI governance gap carries real director liability. Leaders who understand that the regulatory trajectory is towards greater board accountability for AI, not less.
How It Works
Substantive advisory, not a generic audit.
This is serious AI governance advisory work grounded in a developed intellectual framework, not a compliance checklist or a generic risk assessment. The OCNUS governance framework — built on real cases, current APRA and ASIC guidance on AI risk management, and up-to-date research — is the foundation. The engagement is tailored to the organisation's specific situation, risk profile and existing governance structures.