A framework for assessing AI work before it starts
AI work needs the same rigour as security or delivery, not a judgement call made once and forgotten. Every AI use case a pod takes on is classified, scrutinised and signed off before it's built, and reassessed whenever something material about it changes.
Talk to us about an AI use caseEvery AI use case gets assessed before it's built.
Risk classification
Each use case is tiered low, medium or high risk before work starts, so the level of scrutiny matches the actual risk instead of a blanket process.
Data and model scrutiny
What data trains or feeds the model, where it's processed, and whether a vendor model is an appropriate fit for the sensitivity involved.
Human oversight and explainability
Where a person must stay in the loop, and how a decision can be explained to the people it affects, not just to an engineer.
Bias and fairness checks
Skewed outcomes are tested for before launch, not discovered afterward from a complaint.
Security and access control
The same controls we apply to any production system, extended to model endpoints and data pipelines: access, logging and monitoring.
Lifecycle reassessment
Reassessed on material change, a new data source, a new model version, a new use case, not treated as a one-off sign-off.
We don't invent our own definition of responsible AI.
Our assessment process is shaped by the same publicly recognised AI governance principles regulated organisations are already expected to align to.
- Australia's AI Ethics Principles
- National AI Centre's Guidance for AI Adoption
- DTA Policy for the Responsible Use of AI in Government
- OECD AI Principles
- NIST AI Risk Management Framework
- ISO/IEC 42001
Governance isn't a report at the end. It's how every AI use case starts.
Registered before built
No AI use case proceeds without being recorded and classified first.
Risk-tiered sign-off
Higher-risk use cases require senior and client sign-off before build begins.
Decisions on record
What was assessed, what was decided and why is documented, not left to memory.
Reviewed, not static
The framework itself is reviewed as practice, standards and risks evolve.
Talk to us about how we'd assess your AI use case.
Tell us what you're trying to build or automate. We'll give you a straight answer on the risk tier it sits in and what that means for how we'd deliver it.
Talk to us about an AI use case