AI RISK & GOVERNANCE CHECKLIST FOR AUSTRALIAN BUSINESSES
Shadow AI Is Already Inside Your Business.
Can You Prove You Have Control?
Spot your firm's AI risk and governance gaps in under 10 minutes before a regulator, insurer or client does.
✔ Aligned to ASIC guidance
✔ OAIC and Privacy Act 1988
✔ Aligned to Essential Eight
WHAT'S INSIDE
30 questions · 6 domains · Score 0-30 · Interpretation guide included
A 30-question self-assessment covering every AI governance blind spot, across six domains. Staff at Australian businesses are using AI tools every day, most of it without IT approval, compliance visibility, or any control over what data is being submitted. This checklist gives you a scored view of where the business stands right now.
Governance and Policy
Is AI use documented, owned, and reviewed, or does policy exist only on paper?
Data and Confidentiality
Do staff know what can and cannot be pasted into public AI tools, and does the business know where that data goes?
Visibility and Control
Can the business see which AI tools are being accessed on its devices and networks, and block the ones it hasn’t approved?
Training and Staff Behaviour
Do staff understand AI risk, including hallucinated outputs, and know the process for requesting a new tool?
Incident and Assurance Readiness
Is there a documented response plan, and can the business produce evidence of controls if a client, insurer, or regulator asks?
Regulatory and Compliance Alignment
Are current practices assessed against ASIC, OAIC, and other applicable Australian regulatory expectations?
Regulatory context
Australian regulators, including ASIC and the OAIC, along with industry-specific bodies, increasingly expect businesses to demonstrate active, enforceable controls over AI usage and data handling. Documented evidence of appropriate controls protects the board, the professional indemnity insurer, and the client relationship.
WHO THIS IS FOR
Built for the people who carry the risk when AI adoption outpaces governance.
CEO / Managing Director
Accountable for the business if an AI-related data incident becomes public. Needs assurance the business isn’t exposed without knowing it.
Trigger: A client or board member asks about the business’s AI usage; a competitor or peer business has an incident; insurance renewal raises AI-specific questions.
Operations Manager / COO
Needs a practical governance framework, not an abstract policy document. Suspects staff are already using AI tools without approval, with no easy way to confirm it.
Trigger: Staff mention ChatGPT or Gemini in passing; leadership asks ‘what is our position on AI?’; tasked with ‘looking into this’ with no clear brief.
IT / Risk Lead
Needs defensible, evidence-based controls for insurers, regulators, and clients, sized appropriately for the business rather than enterprise-grade overkill.
Trigger: Insurer raises premiums or questions controls; a client due-diligence questionnaire asks about AI governance; audit or compliance review flags technology risk.
Score your results
| Score | Rating | What it means |
| 25 – 30 | Controlled | Strong governance in place. Continue monitoring as tools and regulation evolve. |
| 17 – 24 | Basic Foundation | Awareness exists but targeted uplift is needed in key areas. |
| 9 – 16 | Partial Controls | Significant improvements needed before claiming controlled AI adoption. |
| 0 – 8 | High Risk | Urgent action needed across policy, visibility, controls, and staff awareness. |
Not sure where to start?
Book a 30-minute conversation with the KMTech team. No pitch, a structured look at where the business stands and what needs to happen next.
Prefer to see how it works first? Read more about Web Filtering & Shadow AI Governance
WHY KMTECH
Practical expertise for Australian Businesses navigating AI risk.
KMTech is a cyber-first managed services provider based in Melbourne. We help Australian businesses move from hidden AI risk to visible, controlled adoption, with solutions aligned to the regulatory expectations the business already faces.
Frequently Asked Questions
Our checklist and governance reviews are mapped directly against Victorian Legal Services Board and Commissioner cybersecurity expectations.
6
Governance domains covered in every review
30
Questions mapped to real business risk
10min
Average time to complete the self-assessment
0
Cost for a complimentary AI Governance Risk Review
Frequently Asked Questions
Does this checklist apply to my industry?
Yes. The checklist is built for any Australian business between roughly 20 and 1,000 seats. AI adoption and shadow AI risk cut across every sector, and the six governance domains apply regardless of industry.
What is shadow AI and why does it matter?
Shadow AI is the use of AI tools by staff without formal approval or visibility from the business. Staff pasting client information, financial data, or contracts into public tools like ChatGPT or Gemini leaves no audit trail and no way to demonstrate control if something goes wrong.
How quickly can AI governance controls be put in place?
KMTech’s Shadow AI Governance service typically provides real time visibility and deploys browser level controls within five to seven business days, with no software installation required on staff devices.
How is the checklist scored?
Each Yes answer scores one point across 30 questions, for a maximum score of 30. The last page of the checklist includes a full interpretation guide across four score bands.
NOT READY TO DOWNLOAD?
Join our free webinar: Shadow AI in Australian Businesses. How to Regain Control and Put Governance Around AI Before It Becomes a Risk.
A plain-English 60-minute session for business leaders. No technical background required.
TAKE 5 MINUTES
Find out where your business stands on AI governance today.
Download the free checklist, score the business across 30 questions, and get a clear picture of what needs attention before a regulator, insurer, or client asks first.