A Director's Guide to AI Governance

Strategic Center Evaluation

Adjacent Publisher Context

No adjacent AICD or HTI publications are reported. The guide cites companion AICD and HTI resources (such as the Cyber Security Governance Principles and Data Governance Foundations for Boards), but their links could not be verified for this assessment and they are not included in the /25 coverage score.

Narrative Strengths & Gaps

Internal Pressures & Capabilities. This is the guide’s centre of gravity. HTI’s Operating Model gives boards four elements to oversee: Strategy (alignment, risk appetite, resourcing and data quality), Structure (accountability, escalation and board reporting), Practices (risk controls, cyber and data governance, vendors and AI policy) and Enablers (infrastructure, literacy and culture). Each element ends with four questions for directors and four red flags, which makes the guidance easy to use in a board meeting. A table of common risk controls covers agentic AI with scoped permissions and audit trails, and the SME and NFP checklist scales the same model down for smaller boards. A four-level use-case spectrum, from tactical tools to organisational transformation, and the call for a data and AI inventory help a board see where it stands (Map: Partly met). The experimentation, integration and scaling progression gives initiatives a sequence, without an organisation-wide roadmap (Course: Partly met).

Global & Geopolitical Dynamics. The guide compares regulatory approaches in the EU, UK, US, Canada and China and notes that the EU AI Act can apply to Australian organisations. It places board oversight within Australia’s National AI Plan, AI Safety Institute and data centre expectations, and the ministerial foreword addresses sovereign capability. Its vendor oversight steps ask boards to understand a provider’s location and ownership. National AI competition and export controls are mentioned only in passing.

Societal & Regulatory Pressures. Regulation is built into the governance method. Australia has no standalone AI law, so the guide maps directors’ duties and existing obligations, including privacy, consumer law, work health and safety, Fair Work consultation, discrimination, copyright and cyber security, then puts compliance into the Practices element as a board question and red flags. It flags specific upcoming changes, such as privacy-policy disclosure of automated decisions from 10 December 2026. Beyond compliance, it addresses “broad and deep mistrust of the technology in the Australian community” and the risk of disproportionate harm to vulnerable groups.

Industry & Competitive Pressures. The guide treats AI capability as a competitive matter: organisations that move decisively may gain an edge, and those that delay risk falling behind on cost, innovation, service and talent. Its four-step vendor oversight sequence covers testing, location and ownership, the provider’s cyber and data posture, and contract terms, and it warns of concentration risk where model providers and hyperscale cloud companies are commercially linked. Detailed competitor and market analysis lie outside its scope.

Human Needs & Aspirations. External stakeholders are part of board oversight. Directors are asked whether the organisation understands AI’s impact on external stakeholders and has consulted where needed, and the checklist asks boards to engage clients and stakeholders. Canteen’s consultation with young people living with cancer, and Commonwealth Bank’s public report on its approach to AI, show this in practice. Citizens’ wider aspirations for AI are touched on rather than analysed.

What this framework does not give you. A full map of where the organisation stands; its use-case spectrum and questions prompt a self-check rather than a structured diagnostic. Without a clear picture of where it stands, an enterprise cannot tell which moves matter most. A route for the organisation as a whole; its progression applies to initiatives. Without a route, even a well-chosen destination stays an aspiration. A full way to choose your own destination; it asks boards to agree the AI strategy and measures of success, but supports confident, responsible deployment as the end state. An enterprise that has not stated its own ambition cannot check whether this destination is the right one for it.

Synthesis. The guide suits directors, board chairs and company secretaries of Australian organisations of any size, including SMEs and not-for-profits, and the executives who report to them on AI. Its distinctive contributions are board-ready questions and red flags for each element of the Operating Model, a clear account of how existing Australian law applies to AI, and practical vendor oversight that reaches fourth-party cloud providers. Used alongside a strategy framework, it gives the board’s governance of AI a clear structure. The Five Forces lens adds a structured map and route for the strategy as a whole, a declared time horizon, and how falling execution costs change the value of ideas.

Sources

Tier 1 (scored), recency-gate pass unless noted:

1. A Director’s Guide to AI Governance, Version 2 (PDF) – June 2026; 55 pages; the landing page shows member-only content, so the link was verified manually (the Sapience team supplied the downloaded PDF, 1 November 2026) and the text read from that copy
2. A Director’s Guide to AI Governance: SME NFP Board Summary and Checklist (PDF) – June 2026; 2 pages; no text could be extracted automatically, so the link was verified manually (the Sapience team supplied the downloaded PDF, 1 November 2026)
3. A Director’s Guide to AI Governance Version 2 (AICD landing page) – 29 June 2026; canonical anchor; live when checked on 1 November 2026

Tier 2 (reported in Section 2.75, not scored): none.

Tier 3 (third-party corroboration, not scored): none used.

Excluded on recency or quality (not scored): none.