Our methodology
The Evidence-First Method.
Australian regulators judge AI governance by the records you can produce on request. The Evidence-First Method is built around that test: four phases, each ending in an artefact that APRA, ASIC or OAIC can read without a briefing.
Evidence accrues as the work runs. By Phase 4 the pack is maintained, with CPS 230, the APPs and the Voluntary AI Safety Standard guardrails each traced to a tested control.
Map
An AI register is the first thing APRA, ASIC or an auditor will ask to see.
We build the register of AI systems, data flows and automated decisions across the organisation, then classify each entry by the Australian obligations it triggers: the Privacy Act 1988 and the APPs, the ten guardrails of the Voluntary AI Safety Standard, APRA CPS 230 critical operations and material service providers for regulated entities, ASIC REP 798 expectations on licensees, and TGA or AHPRA rules where a system touches patient care. Systems with European exposure get an EU AI Act tier as well.
Output
A classified AI register with a named accountable owner per system, which anchors the rest of the engagement.
NIST Map 路 ISO 42001 Plan
Frame
Every control should name the obligation it exists to meet.
We design the governance structure the board and the regulator will see: the AI policy suite, committee and decision rights, accountable persons under FAR where it applies, risk appetite statements and escalation paths. Each control is mapped to a specific clause, guardrail or prudential requirement, which is what turns a policy into something an APRA supervisor or an internal auditor can test.
Output
A governance framework, policy suite, FAR-aware accountability map and a control-to-requirement matrix.
NIST Govern 路 ISO 42001 Plan
Control
A control that leaves no record will fail its first audit.
We wire the framework into operations: model validation and change approval, vendor onboarding that satisfies CPS 230 material service provider requirements, privacy impact assessments against the APPs, and incident handling that meets APRA and OAIC notification timelines. Every step writes evidence as it runs, so the pack builds itself between reviews.
Output
Operating controls, approval gates, vendor and model procedures, and an evidence trail that accrues daily.
NIST Measure + Manage 路 ISO 42001 Do
Assure
Sample-based annual assurance does not survive contact with a supervisor.
Ongoing, independent testing that the controls operate as designed, reported to the board and in a form APRA, ASIC or OAIC can work through. This is the continuous assurance layer: control test results, drift and incident metrics, and a refreshed evidence pack on a schedule the risk committee sets.
Output
Board assurance reporting and a supervisor-ready evidence pack, maintained rather than rebuilt each year.
NIST Manage 路 ISO 42001 Check + Act
Why Phase 4 never closes.
APRA has warned that most regulated entities rely on point-in-time, sample-based assurance that does not keep pace with the scale and speed of AI adoption. A model that stops at go-live leaves a gap a supervisor will find.
Phase 4 is built for that finding. Control testing runs on a schedule the risk committee sets, results go to the board, and the evidence pack is refreshed on the same cadence, so the version a supervisor reads matches the system in production. When the next obligation lands, the pack already has the structure to absorb it.
Where each service fits.
Engage the full method or start at the phase where the gap is. The services under each phase produce that phase's artefact for the evidence pack.
Browse the service directoryPhase 02
Frame
Phase 03
Control
Phase 04
Assure
The programme, phase by phase.
Each phase ends at a gate the accountable executive signs. The artefact from one phase is the input to the next, and each step below names the Australian instrument it answers to. Plan on 6 to 9 months from the start of Phase 1 to a position you can defend in front of a supervisor, then a quarterly Phase 4 cycle.
The eleven elements these phases build are set out in the PolyGovern AI Governance Framework. The maturity model describes what the evidence looks like at each level, and the AI Risk Calculator gives a baseline read before Phase 1 opens.
For APRA-regulated entities the roadmap runs inside the CPS 230 programme. The CPS 230 and AI guide covers the material service provider mapping, and the regulatory compliance page covers the APP and OAIC steps.
Phase 01
Map
4 to 6 weeks
APRA expectations (inventory, lifecycle ownership, supply-chain mapping) 路 DTA policy use case register 路 Guidance for AI Adoption practice 1 路 ISO 42001 clause 4
Workstreams
- /AI register covering built, bought and embedded systems, including the generative tools staff use without approval.
- /Classification by obligation: the APPs, CPS 230 critical operations and material service providers, REP 798 expectations for AFS and credit licensees, and TGA or AHPRA rules in health.
- /Supply-chain mapping to the fourth parties behind each vendor, which APRA expects regulated entities to hold.
- /An accountable owner per system, with the lifecycle ownership APRA also expects.
In hand at the end
A classified AI register with an owner against each entry, and a vendor and fourth-party map for the systems that carry the most risk.
Decision gate
The accountable executive confirms the register is complete. For a Commonwealth agency this is the internal use case register the DTA policy requires.
Phase 02
Frame
6 to 8 weeks
Guidance for AI Adoption practices 1 to 3 路 APP 1.7 to 1.9 路 DTA accountable officials and transparency statements 路 ISO 42001 clauses 5 and 6
Workstreams
- /AI policy suite, using the six essential practices in the National AI Centre's Guidance for AI Adoption as the reference set.
- /Decision rights and committee structure, with FAR accountable persons named where the regime applies.
- /Risk appetite statement with escalation thresholds.
- /Automated decision-making disclosure drafted for the privacy policy ahead of the 10 December 2026 commencement of APP 1.7 to 1.9.
In hand at the end
A policy suite, a FAR-aware accountability map, a control-to-requirement matrix and a draft ADM disclosure.
Decision gate
The board adopts the policy suite and the risk appetite. Controls are not designed against an appetite the board has not seen.
Phase 03
Control
8 to 12 weeks
APRA supplier risk and change management expectations 路 CPS 230 路 Guidance practices 4 to 6 路 DTA impact assessment 路 ISO 42001 clause 8
Workstreams
- /Model validation and change approval gates.
- /Vendor onboarding and contracts with the transparency, audit rights, incident notification and tested exit options APRA expects, with CPS 230 covering all contracted providers since 1 July 2026.
- /Privacy impact assessments against the APPs, and the DTA AI Impact Assessment Tool for Commonwealth agencies.
- /Human control points with override paths and a channel to challenge an outcome, as practices 4 and 6 of the Guidance describe.
- /Evidence written as each step runs.
In hand at the end
Operating controls, vendor and model procedures, and an evidence trail that accrues without a separate documentation exercise.
Decision gate
Each control is tested once in operation and the result is filed. A control with no record does not pass.
Phase 04
Assure
Ongoing, on a quarterly rhythm
APRA governance maturity and assurance expectations 路 Guidance practice 5 (test and monitor) 路 ISO 42001 clauses 9 and 10
Workstreams
- /Control testing on the cycle the risk committee sets, replacing the point-in-time, sample-based approach APRA criticised.
- /Board reporting with drift, incident and complaint metrics.
- /Evidence pack refresh, so the file matches the system in production.
- /A watch on the moving dates: the DTA policy's remaining mandatory requirements land in December 2026, and APP 1.7 to 1.9 commence on 10 December 2026.
In hand at the end
Board assurance reporting and a supervisor-ready evidence pack that APRA, ASIC or OAIC can read on request.
Decision gate
There is no exit gate. The cycle repeats, and each new system enters at Phase 1.
Questions about running the roadmap in Australia.
Is any of this mandatory in Australia?
Parts of it are. The APPs already apply whenever personal information is used in AI, and from 10 December 2026 APP 1.7 to 1.9 require privacy policies to describe qualifying automated decision-making. The DTA policy for the responsible use of AI in government is mandatory for non-corporate Commonwealth entities, and its remaining requirements land in December 2026. Regulated entities answer to APRA and its expectations for AI. The National AI Plan did not proceed with AI-specific mandatory guardrails, so everything else sits in existing law and regulator expectation.
What happened to the Voluntary AI Safety Standard's ten guardrails?
The National AI Centre's Guidance for AI Adoption evolves the ten guardrails into six essential practices in two tiers. The guardrails remain in place. The roadmap uses the six practices as the current reference and keeps the mapping to the guardrails for organisations that built against them.
Does APP 1.7 give customers a right to challenge an automated decision?
No. The new provisions are a disclosure duty. The privacy policy must describe the kinds of personal information used and the kinds of decisions made, or substantially assisted, by automated means. The amendment contains no right to an explanation, a human review or a contest. The roadmap drafts the disclosure in Phase 2 so it is in place before the date.
We are APRA regulated. Does the roadmap replace a CPS 230 programme?
No. It sits inside one. CPS 230 governs critical operations and material service providers, and an AI system that supports a critical operation falls under it. Phase 1 maps which systems those are, Phase 3 builds the vendor and change controls to the standard, and Phase 4 provides the independent assurance APRA's letter expects. The CPS 230 and AI guide covers the mapping in detail.
Can we skip to Phase 3 because the policy already exists?
Only with a register and a control-to-requirement matrix in hand. ASIC reviewed 23 licensees and found governance arrangements lagging AI adoption, including policies that set principles without standards a control could be tested against. A short Phase 1 and Phase 2 confirms what the existing policy covers before any control is built.
What does the board see at each gate?
One artefact per phase: the classified register, the adopted policy suite and risk appetite, the control test results, and the assurance report. The maturity model page describes the evidence that marks each level. The AI Risk Calculator gives a baseline read before Phase 1.
Map first. The evidence pack follows.
The calculator gives a first read on your exposure. From there we scope the phase that matches where you are, name the artefact it produces and outline the work to get there.