Who should build your AI governance: in-house, a consultant or software

An organisation that decides to govern its AI properly faces a build question before any framework question. Who actually does the work? The register of systems, the risk and impact assessments, the controls, the policies and the records a board or auditor will one day ask for all need an owner. There are three ways to get it done, your own people, a consultant or software. Aicura is the software option here, and the other two are treated on their merits because for some organisations they are the right answer.

Option one: in-house

Your risk analyst or governance lead builds the register in a spreadsheet, writes the assessments from a template and keeps a controls tab beside it.

Where it wins. Nobody knows your systems like your own people, the cost looks like zero and the work builds internal capability that outlasts any engagement. For an organisation with a handful of stable systems and a capable owner, in-house is fine.

Where it strains. The work is repetitive at exactly the points where attention matters, every assessment starts from a blank page carrying the quality of that analyst’s week, and the spreadsheet register decays quietly because updating it is nobody’s real job. The hidden cost is the analyst’s time, which is usually the scarcest senior attention in the risk function, spent on drafting and formatting rather than judgement. And when the organisation is asked to show its work, a folder of documents with inconsistent structure and no change history is what exists.

Option two: a consultant

A governance or risk consultancy scopes an engagement, interviews your people, builds the register, writes the assessments and hands over a framework with policies and templates.

Where it wins. Deep expertise on tap, an outside eye that finds what insiders normalise, credibility in front of a board and speed to a professional first version. For a novel or contested question, a bespoke review by people who have seen fifty organisations is worth its fee.

Where it strains. The engagement ends. What it leaves is a set of documents true as at handover, and the first system change after the consultants leave begins the drift. The maintenance either becomes a retainer, becomes the in-house option above or does not happen. The economics only close if the work stops moving, and an organisation’s AI does not stop moving.

Option three: software

The register lives in a system built for it, and the assessments are generated from the register data rather than written from scratch.

Where it wins. The structural difference is tense. A system’s register record keeps a new version as the system changes, the assessment re-runs when the record does, the controls carry owners and statuses, and the record accumulates as a by-product of the work rather than as a separate documentation effort. In Aicura, registering a system starts its risk assessment, a person reviews what it drafts, and the risks and suggested controls land in a published, versioned list of AI risks and controls where each control’s status is tracked. The analyst’s hours move from drafting to judgement, which is the part that was worth their salary all along. The pricing page has the current rates.

Where it strains. Software cannot know what only your people know, so the refinement step is real work, and a system nobody feeds is a register in name only. Aicura drafts, structures and keeps the record, and it does not certify, audit or make the call, so an organisation wanting someone external to own the judgement is buying the consultant, not the tool.

The structural question underneath

All three options can produce a good register and a good assessment this quarter. The question that separates them is what exists two quarters later, after a vendor model update, a new system and a staff change. In-house survives if the analyst’s discipline does. The consultant’s work survives until it is out of date, which is a fact about engagements, not about consultants. Software survives because staying current is the product.

The hybrid is common, with software as the standing record, your people doing the refinement and the judgement, and a consultant brought in for the bespoke question when one arrives. Those engagements get sharper and cheaper when the consultant walks into a live register instead of a discovery phase.

In Australia: who should do your automated decision-making disclosure work

Australian organisations face one specific version of this question. From 10 December 2026, Australian Privacy Principles 1.7 to 1.9 require the privacy policy to set out the kinds of personal information used in computer programs that make, or do something substantially and directly related to making, decisions that could reasonably be expected to significantly affect an individual’s rights or interests, and the kinds of decisions involved. Someone has to find the systems, decide which ones the rules capture, update the policy and keep it true afterwards. Here there is a fourth route alongside the three above, a privacy lawyer.

A privacy lawyer. Where a lawyer wins is legal judgement and privilege. Whether a specific decision significantly affects an individual is ultimately a legal question, and where your situation is contested, novel or high-stakes, a lawyer’s opinion is the thing nothing else on this page can be. If a regulator or a dispute is already in the picture, this is not a comparison, it is a referral. Where a lawyer strains is that an opinion describes your systems as at the date of the advice, and law firms price accordingly. The engagement answers the question you brought. It does not watch your systems afterwards, and few organisations can afford to ask again every time something changes. The common result is excellent advice about last year’s systems.

A privacy consultant. A good consultancy interviews widely, finds automation your own people forgot, writes a policy update that reads professionally and hands over a register of what they found. For an organisation with no idea where it stands, a scoped review buys clarity fast. But the deliverable is true at handover, and the standing obligation begins the day they leave. The rules do not ask whether your policy was accurate when the consultants finished. They ask whether it is accurate.

Your own people. Your people know where the automation is, or can find out, and walking systems against the rules builds understanding no external party leaves behind. For a small, stable set of systems this is workable. The first pass is a project, but the obligation is not. Somebody has to notice that the new tool scores applicants, that the vendor switched on an automated decision feature or that the policy no longer matches, and noticing is nobody’s job in most organisations.

Software. Aicura’s Privacy tier reviews your privacy policy against the automated decision-making (ADM) rules, surfaces the registered automated-decision systems the policy does not yet mention and drafts language you can use, and it runs again when systems change or the register grows. It is not a legal opinion and does not pretend to be. Where a borderline decision needs a lawyer, Aicura’s role is to put the question in front of you with the register facts attached, not to answer it for you.

If you are in a dispute or a contested judgement call, start with the lawyer. If you do not know what you are running, a scoped consultant review or a disciplined in-house project both work for the first pass. For everything after that, which is most of the obligation’s life, the work is repetitive, standing and register-shaped, and that is what software is for. The Privacy Act automated decision-making page sets out the scope test, and how to write an ADM transparency statement covers the drafting.

A note on this page

Written by Aicura, which sells one of the options above. The characterisations of the others are offered straight, and where your situation calls for bespoke professional judgement, buy it. For the Australian ADM rules, read APP 1.7 to 1.9 and the OAIC’s guidance directly. Nothing here is legal advice.