AU Artificial Intelligence Program - Medium Business

01 — WHAT

What is it?

The AI Governance Program — AU Medium Business is a comprehensive, ready-to-implement AI governance framework for Australian businesses with 16 to 100 staff. It gives owners, directors, and managers the policies, controls, reporting tools, and training needed to govern AI use confidently across multiple teams and functions.

It builds on the Small Business program with stronger oversight structures, manager accountability controls, approval workflows, advanced vendor due diligence, and management reporting — designed for businesses where AI governance needs to operate across departments, not just at owner level.

───────────────────────────────────────────────────────────────────

02 — WHO

Who is it for?

• Medium businesses with 16–100 staff using AI tools across teams
• Operations, compliance, or HR managers responsible for AI governance
• Business owners who need governance that scales beyond owner-level management
• Australian businesses with multiple departments using different AI platforms
• Firms that need management reporting and approval workflows for AI use
• Businesses preparing for client, partner, or regulatory scrutiny of their AI practices

───────────────────────────────────────────────────────────────────

03 — WHY

Why does it matter?

As businesses grow, AI governance becomes more complex. More staff using more tools across more functions means more risk — more potential for privacy breaches, discriminatory outputs, unapproved tools in use, and accountability gaps when something goes wrong.

Australian medium businesses face the same legal obligations as small businesses — Privacy Act 1988 (Cth), Australian Privacy Principles, and anti-discrimination legislation — but with significantly more surface area for things to go wrong.

Relevant legislation includes:

• Privacy Act 1988 (Cth) — Australian Privacy Principles (APPs)
• Notifiable Data Breaches scheme — OAIC reporting obligations
• Age Discrimination Act 2004
• Disability Discrimination Act 1992
• Racial Discrimination Act 1975
• Sex Discrimination Act 1984
• ISO/IEC 42001:2023 — international AI management standard

Without a scaled AI governance program, medium businesses risk:

• AI tools adopted by departments without assessment or approval
• No visibility over what AI tools staff are using or what data they are processing
• Inconsistent oversight across teams — some rigorous, some none
• Privacy breaches affecting large numbers of customers or staff
• Management unable to demonstrate governance to clients, auditors, or regulators

───────────────────────────────────────────────────────────────────

04 — WHEN

When do you need it?

• When your Small Business program no longer covers the scale of your AI use
• When multiple managers or departments are responsible for AI tools
• When you need formal approval workflows before new AI tools can be adopted
• When clients, partners, or auditors are asking about your AI governance practices
• When your business is scaling and AI governance needs to scale with it
• Now — if staff across your business are using AI tools without a unified framework

───────────────────────────────────────────────────────────────────

05 — WHERE

Where does it apply?

• AI tools used across multiple departments and teams
• Management and executive reporting on AI risk and governance
• Vendor due diligence and procurement approval processes
• Department-level oversight and accountability structures
• Multi-site or hybrid workforce AI tool use
• Client-facing AI applications and customer communication tools

───────────────────────────────────────────────────────────────────

06 — HOW

How does it work?

• Establish governance structure — AI Compliance Officer, System Owners, and manager accountability at department level
• Register and risk-assess every AI tool across the organisation
• Apply formal approval workflows before any new tool is adopted
• Implement department-level oversight with escalation pathways
• Train all staff and managers — different training for different responsibilities
• Report AI risk and governance status to the Business Owner at each review
• Conduct enhanced vendor due diligence before any personal data is processed
• Monitor high-risk systems monthly, others quarterly or six-monthly
• Conduct full annual governance review with management sign-off

───────────────────────────────────────────────────────────────────

07 — INCLUDED

What is included?

Everything in the AU Small Business program, plus:

1.0 AI Product Document Index

1.1 AI Welcome Pack

1.2 AI Quick Start Guide

1.3 AI 30-Day Implementation Roadmap

1.4 AI Programme Navigation Guide

2.1 AI Executive Summary

2.2 I Board & Management Report Template

3.1 AI Governance Policy

3.2 AI Acceptable Use Policy

3.3 AI Privacy & Data Handling Policy

3.4 AI Risk Management Policy

3.5 AI Human Oversight Policy

3.6 AI Document Review & Update Policy

3.7 AI Escalation & Approval Policy

4.1 AI Incident Response Procedure

4.2 AI Vendor Selection Procedure

4.3 AI Tool Approval Workflow

5.1 AI Staff Acknowledgement Form

5.2 AI Legislative Update Log

5.3 AI Manager Accountability Sign-off Form

6.1 AI System Register

6.2 AI Risk Register

6.3 AI Action Plan Register

6.4 AI Incident Register

6.5 AI Training Register

6.6 AI Version Control Register

6.7 AI Department Oversight Register

7.1 AI Content Approval Checklist

7.2 AI Manager AI Briefing Guide

7.3 AI Vendor Assessment Checklist — Advanced

7.4 AI Monthly Review Checklist

7.5 AI Quarterly Review Checklist

7.6 AI Annual Review Guide

8.1 AI Staff Training Guide

8.2 AI Manager AI Briefing Guide

8.3 AI Department Lead Training Guide