Guides
Practical AI governance guides.
Each guide takes one piece of AI governance work, answers its question in the opening paragraph and points to the sources behind it. They are written to be useful whether or not you use Aicura.
How to build an AI system register
How to build an AI system register. The fields to capture for each system, how to find the AI nobody registered and how to keep the record true over time.
Read the guide→How to write an automated decision-making (ADM) transparency statement
How to write the automated decision-making disclosure APP 1.7 to 1.9 require in your privacy policy, with worked examples of adequate and inadequate wording.
Read the guide→AI risk register template: fields, examples and upkeep
An AI risk register template with the fields to record, worked example rows for a customer chatbot and a CV screening tool, and how to keep it current.
Read the guide→How to derive and manage AI controls from frameworks and assessments
What an AI governance control is, where controls come from, and how to derive them from your frameworks and assessments, assign owners and keep them current.
Read the guide→How to stand up AI governance policies from templates
Which AI governance policies a programme needs, how to build each from a template instead of a blank page, and how to keep the set current as AI use changes.
Read the guide→Governing AI agents: what changes when a system acts, not just advises
Governing an AI agent means bounding what it may do before it acts, recording its reach and owner, and keeping a person able to stop it. What changes and why.
Read the guide→How to assess and oversee an AI agent
Assess an AI agent as you would any consequential system, then extend the work to cover its reach and autonomy. Map harms, weigh them and set real oversight.
Read the guide→How to keep AI governance records that stand up to scrutiny
Which AI governance records to keep, how long they matter and how to keep them current, under ISO/IEC 42001, the NIST AI RMF and EU AI Act logging rules.
Read the guide→How to prepare for an AI governance audit
How to prepare for an AI governance audit, from scoping your AI systems to the evidence an auditor will accept, anchored to ISO/IEC 42001 and ISO 19011.
Read the guide→How to respond to an AI governance due-diligence questionnaire
How to answer an AI governance or AI security questionnaire from a customer, from records rather than assurances, mapped to ISO/IEC 42001 or the NIST AI RMF.
Read the guide→How to respond to an AI incident
Respond to an AI incident in a set order. Triage, contain, investigate, remediate, notify where required and close, keeping a record that holds up afterwards.
Read the guide→How to run a framework assessment of your AI governance
How to assess your AI governance against a framework such as ISO/IEC 42001 or the NIST AI RMF. Choose the reference, map your practice and read the findings.
Read the guide→How to run an AI impact assessment
How to run a defensible AI impact assessment anchored to ISO/IEC 42005. Describe the system, identify who it affects, weigh the harm and decide the controls.
Read the guide→What is AI assurance
What AI assurance means, how it differs from AI governance, its three levels from self-assessment to ISO/IEC 42001 certification, and the evidence behind it.
Read the guide→Privacy compliance kits: what they do, what they miss and when software is the better buy
Privacy compliance kits vs a living AI register. What a kit covers, where it goes stale under the new automated decision rules and when software wins.
Read the guide→AI governance under APRA's expectations
APRA's April 2026 letter sets out its expectations of regulated entities on AI risk. What each one means in practice and how to do the work it describes.
Read the guide→How to run an AI risk assessment
A practical method for assessing an AI system's risks. Scope from the register, work the harm dimensions, rate what remains, derive controls and record it.
Read the guide→Who should build your AI governance: in-house, a consultant or software
In-house, a consultant or software? What each route to AI governance is good at, where each one strains and the difference that shows two quarters later.
Read the guide→How to evaluate an AI governance platform
Vendors in this category all use the same words. The questions that show what a product does on discovery, enforcement, agents, frameworks, evidence and cost.
Read the guide→How to find shadow AI in your organisation
Shadow AI leaves traces in systems you already run. Where to look, how to correlate the signals and how to bring each finding into governance without blame.
Read the guide→How to monitor AI systems for drift
Monitor AI for drift by watching inputs, outputs, usage and vendor model changes, with thresholds that name an owner and an action, and feed findings back.
Read the guide→How to write and enforce AI guardrails
A guardrail is a governance decision made executable. How to get from policy intent to rules enforced on AI traffic, and why the enforcement record matters.
Read the guide→What belongs in an agent decision log
An agent decision log records what an AI agent did, beside the register record of what it may do. What to capture so anyone can see why it acted.
Read the guide→What is an AI governance platform?
Three kinds of product share the AI governance platform label and do different jobs. What the category covers, how products cluster and what none can do.
Read the guide→What makes AI governance evidence independently verifiable
What independent verifiability requires of AI governance evidence, why an immutable audit trail is not the same thing, and the one question to ask any vendor.
Read the guide→How to assess your AI governance maturity
A method for measuring how mature your AI governance is. The seven areas to measure, the five levels each can sit at, how to score practice and what to fix.
Read the guide→AI agent identity: registering, scoping, suspending and logging AI agents
How to give AI agents their own identities. Register each agent, issue its own credentials, scope permissions, log decisions, and suspend or revoke as needed.
Read the guide→AI governance board reporting
What boards ask about AI, what a quarterly AI governance report should contain, how to build it from the governance record and how much detail to give.
Read the guide→AI governance for smaller organisations: what a lean team does first
A practical order of work for AI governance in a small or mid-sized organisation. What to do in the first month, what can wait, and how to keep it light.
Read the guide→AI governance framework crosswalk: ISO/IEC 42001, NIST AI RMF, EU AI Act, AI6 and NSW AIAF
How ISO/IEC 42001, the NIST AI RMF, the EU AI Act, AI6 and the NSW AIAF overlap, discipline by discipline, so you can do governance work once and reuse it.
Read the guide→AI incidents and the Notifiable Data Breaches scheme
Australian guide to when an AI incident becomes a notifiable data breach. The three-part test, the 30-day assessment, notification and AI-specific triggers.
Read the guide→AI inventory template: fields, example entries and how to keep it current
An AI inventory template. The fields to record for every AI system and agent, three worked example entries, and how to keep the whole inventory current.
Read the guide→AI literacy and staff training
How to run AI literacy and staff training by role, what Article 4 of the EU AI Act now requires after the Digital Omnibus and how to evidence the training.
Read the guide→AI red teaming: how to security test AI systems
What AI red teaming is, how to test AI systems for prompt injection, jailbreaks and data leakage, what the EU AI Act expects and how often to run the tests.
Read the guide→EU AI Act deployer obligations: Articles 26, 27, 4 and 50
What the EU AI Act asks of organisations using AI. Article 26 high-risk duties, Article 27 rights assessments, Article 4 AI literacy and Article 50 disclosure.
Read the guide→EU AI Act high-risk classification: Annex III, Annex I and the new dates
How to tell if an AI system is high-risk under the EU AI Act. The Annex I and Annex III routes, the Article 6(3) exception and the Digital Omnibus dates.
Read the guide→How to build an AI governance framework
How to build an AI governance framework that works, with accountable roles, a chartered committee, a RACI, an operating rhythm and the records behind it.
Read the guide→How to complete a NSW AI Assessment Framework self-assessment
Australian guide for NSW agencies. How to register an AI use case on the AIAF Platform, complete the assessment, refer high-risk systems and keep it current.
Read the guide→How to manage vendor and third-party AI risk
How to manage third-party AI risk through procurement, due-diligence questions, contract terms, model changes and review, including AI in existing software.
Read the guide→How to run AI use case intake and approval
How to set up an intake and approval workflow for new AI requests. What the form asks, how requests are triaged and routed, and what a decision record holds.
Read the guide→How to run an AI bias assessment: fairness testing, metrics and documentation
A practical method for assessing AI bias. Define the harm and the groups, choose fairness metrics that fit the decision, test the system and document it.
Read the guide→How to write an AI acceptable use policy
What an AI acceptable use policy must cover, a section-by-section template structure, example clauses to adapt and how to keep the policy enforced day to day.
Read the guide→Human oversight of AI: in the loop, on the loop, and oversight that works
What human in the loop and human on the loop mean, how to choose between them, and how to design AI oversight that is meaningful rather than a rubber stamp.
Read the guide→What is AI governance?
AI governance is how an organisation decides which AI it uses, who answers for it and how it keeps that AI within bounds. Who does it, what it covers, how.
Read the guide→What is an AI gateway?
An AI gateway sits between your apps and AI models and enforces rules on every request. How allow, redact, block, budgets and logging work, and what to buy.
Read the guide→Questions
Do I need to use Aicura to use these AI governance guides?
No. Each guide takes one piece of AI governance work, answers its question in the opening paragraph and points to the sources behind it. They are written to be useful whether or not you use Aicura.
Where should I start if I am new to AI governance?
Start with the guide to what AI governance is, then the guide to building an AI system register. A register of the AI you use is the record every other piece of governance work builds on.
Start with what you're running.
Connect your sources, see what Aicura finds, and take each system from the register to enforcement at your own pace.