Governance first, tools second

A policy nobody’s read isn’t a policy. It’s a PDF. This is what we actually hold ourselves to.

Not aspirational. The minimum

These aren’t values we aspire to when it’s convenient. They’re the floor everything else is built on.

How we handle AI, specifically

AI augments human judgement in compliance work. It doesn’t replace it. Every AI-assisted output in our engagements is reviewed by a person before it reaches you.

We don’t feed your information into third-party AI systems to train their models.

How we handle your data

We take data privacy seriously, in line with the Australian Privacy Principles and the Privacy Act 1988, and we follow the Australian Cyber Security Centre’s Essential Eight as our engineering baseline. 

Full detail on what we collect, why, and how it’s stored is in our Privacy Policy.

This isn’t a chatbot, and it isn’t a mandate to use one AI tool for everything. It’s a framework for deciding, case by case, where AI genuinely helps and where a human needs to stay firmly in charge

Why this page exists

Shadow AI isn’t a mystery to solve after the fact. It’s the clearest signal you already have of where governance is thin. If your team is already experimenting with AI without a framework around it, that’s not a failure. It’s information. This is the standard we build that framework to.