This product has already been purchased.
A concerning number of Australian employees are using AI in ways that could breach company policy – and too often the board is the last to know, writes Isabella Villani GAICD.
I have lost count of the people who have told me, with some pride, they used their personal AI account to draft a customer reply or build a slide deck. Some had no idea they had put customer data into a tool their organisation never approved, which can be a data breach. Others knew and kept quiet, because in this economy, admitting you use AI feels like inviting your manager to ask whether your whole job could be automated.
This is where AI governance starts: with staff who are already ahead of the board. Research by KPMG and the University of Melbourne found that 44% of Australian employees have used AI in ways that breach their organisation’s policy, and 57% have relied on AI output without checking it. Too often, the board is the last to know.
I also see many boards in a hurry. Nobody wants to be the organisation that got left behind, so proposals get approved on a vendor demonstration and a one-page business case, with less scrutiny than we would give a new fleet of vehicles.
The consequences for boards are significant: privacy breaches, cyber incidents, decisions that are wrong or unfair, financial and reputational damage, angry customers, fearful staff and directors discovering too late what was approved in their name.
From 10 December 2026, the Privacy Act raises the stakes again: privacy policies must disclose where a computer program makes or shapes decisions that significantly affect people’s rights or interests using their personal information.
Here are the six questions I ask as a deputy chair and audit and risk chair before saying yes to AI.
1. Do you actually know where AI is being used?
For many boards, probably not. It creeps in through staff using unapproved tools, suppliers switching on AI features in products you already own, and customers. The keyboard warriors have arrived with their AI besties: long, confident complaints that quote legislation, sometimes wrongly. They take longer to resolve as AI-generated emails go back and forth. Ask management for one page on where AI is used, on what data, with what risk and who owns it. My view is that if management cannot produce that page within a fortnight, it should be the first item on your audit and risk committee agenda.
2. Who is accountable when it goes wrong?
The board can’t blame AI. Directors’ duties of care and diligence are personal and cannot simply be handed off to a supplier, a committee or an algorithm. The Federal Court’s judgment this year in the ASIC case against former Star Entertainment directors reinforces the same principle: technology can help directors, but it cannot replace their judgement. The case reinforces that directors must actively interrogate the information and systems they rely on, rather than treating technology as a substitute for their own scrutiny and judgement.
Name one executive who owns every use on the AI register and answers to the board for it. In my executive career, the organisations that got digital channels right had one owner. The ones that struggled had no owner; IT and operations never worked as partners. That executive does not need to be the AI expert, but does need the authority to switch a system off and the obligation to tell the board when one misbehaves.
3. What decisions should never be handed entirely to a machine?
If I am behind on my home loan because I have lost my job, I do not want to explain that to a chatbot. Every industry has its version: hardship and arrears, disconnection of an essential service, a loan or insurance decision. Write the list down, approve it at board level and make it a condition of every AI approval. “Computer says no” costs you even when the answer is right. It costs you far more when the answer is wrong, and nobody can explain why.
4. What would make you stop or switch it off?
Approve in stages: a pilot, one customer journey deep, with the exit criteria written down first. Then ask management, “What would make you recommend stopping?” If they cannot answer without looking at the floor, you have a problem. And check that the system can be switched off without taking the rest of the operation down with it.
5. Can management prove it is working as intended?
Demand evidence, not assurance. What was tested before it went live, what is monitored now and when does the board hear that performance has slipped? AI systems can go rogue or quietly get worse. The audit and risk committee should see test results, the thresholds that trigger escalation and the incident log, not a slide that says all is well. No board would accept “trust us” on a dam safety report or an audit opinion.
One organisation I worked with found a misconfigured automated channel had been affecting 27% of calls for four years. Nobody had picked it up. AI needs closer watching and attackers use it too, so keep a person in command of anything that moves money or touches operations.
6. Could you explain its use and consequences publicly?
My test is simple: could I answer “Who is checking the AI?” in one sentence, in public, without notes, to a customer, an employee, a shareholder or a regulator? If the answer involves a vendor’s name, start again.
None of this needs a technologist in the boardroom, just directors fluent enough to ask these questions and assess the answers. That fluency is a gap the board owns, like financial literacy. The questions I ask before a treatment plant is signed off are the questions I ask of an algorithm: who is accountable, what are we prepared to risk, and where is the proof?
A board that can answer all six can say yes to AI. Until it can, the honest answer is “not yet”.
Isabella Villani GAICD is Deputy Chair and Audit and Risk Management Committee Chair of GMB Water, a Non-Executive Director of DV Safe Phone, and Founder and Executive Chair of Exceed Global. She holds credentials in AI and cyber governance from the University of Sydney and has authored two books on customer experience.
Latest news
Already a member?
Login to view this content