Australia’s Digital Duty of Care bill and AI chatbots: where it is up to, what it requires, and the risk assessment work to start now. Updated as it moves.
AI governance
Articles on ISO 42001, AI policy, AI agents and the Australian rules taking shape around AI. The focus is practical: how to govern the AI tools a business already uses, and what certification to ISO 42001 involves.
ISO 42001 Requirements: What the Standard Asks For and How to Implement It
What ISO/IEC 42001 requires, clause by clause, the 38 Annex A controls, and a step-by-step plan for organisations that use AI and those that build it.
Shadow AI in the Workplace: The Wild West of Ungoverned AI
Employees are using a patchwork of AI tools with no oversight. Here’s why ungoverned shadow AI is a serious data-loss risk, and how governance closes the gap.
Building Your ISO System with AI? Here’s Where It Goes Wrong
AI tools can draft ISO documentation in minutes, but they routinely miss the mark on context, risk and implementation. Here’s where AI-built ISO systems fail, and how to make yours actually pass certification.
AI in Cyber Security: AI Doubled the Bug Count. Your Patch Process Was Built for the Old One.
AI has roughly doubled the number of software flaws found in a year. What ASD says to do, where AI genuinely helps defenders (with examples), and what an auditor checks.
Which AI Tools Are ISO 42001 Certified, and How to Stop Them Training on Your Data
AI tools are now woven through everyday business: drafting emails, summarising documents, writing code. For anyone responsible for governance, two questions matter more than which model is “best”: is the provider certified to manage AI responsibly, and is your data being used to train their models? The answers vary a lot between tools, and between […]
Free AI Training for Small Business, and What It Means for Clause 7.2
Both OpenAI and Anthropic have now launched free AI training programs aimed squarely at small business, and if your people use AI on work that affects your management system, that training is not just useful. It is evidence you are required to hold. ISO clause 7.2 asks you to determine the competence your people need, […]
ISO/IEC 27090 Is Out: What It Adds If You Already Hold ISO 27001 or ISO 42001
ISO and IEC published ISO/IEC 27090:2026 on 14 October 2026. It is the ISO 27000 family’s standard on security threats to AI systems, from the same committee that looks after ISO 27001. If your business already holds ISO 27001 or ISO 42001, or is working towards either, it is worth knowing what it adds and […]
The Logins You Forgot to Turn Off
ASD and the AICD have told boards that AI agents need minimum access. Most access reviews only list people. What to check, and a free checklist.
ISO 42001 and ISO 27001: How They Fit Together
ISO 42001 (AI management) and ISO 27001 (information security) share the same structure and integrate cleanly. Here’s how they overlap and why a combined system is the smart move for AI-driven businesses.
