The evidence trail directors can stand behind.
Personal liability under section 180 of the Corporations Act applies to AI failures the same way it applies to any other governance failure. The Australian Institute of Company Directors has been clear: directors must be able to demonstrate informed oversight. That requires evidence, not assurance.
-
✓
Audit-grade trail Every control change, attestation and exception logged with timestamp, actor and rationale.
-
✓
Pre-formatted board packs Quarterly governance summary, exception register, and forward-looking risk view, ready for committee.
-
✓
Examination-ready exports APRA, OAIC and ISO auditor formats produced from the same evidence layer.
-
✓
Cross-mapped citations Every control mapped to the source instrument so reviewers can verify the basis on the page.
An anonymised extract from a real Guvn.AI board pack. Quarterly. Auto-generated. Director-grade.
Built on Australia's AI6 voluntary standard.
The AI6 is the short name for the six essential practices set out in Guidance for AI Adoption, published by Australia's National AI Centre in October 2025. It is the federal government's primary reference for how organisations should govern and adopt AI responsibly — covering accountability, impact assessment, risk management, transparency, testing and human control.
It is voluntary in the same way the ACSC Essential Eight is voluntary — increasingly the de facto standard of care that boards, regulators, auditors, large customers and investors expect to see. The National AI Plan (December 2025) confirms Australia will rely on existing laws plus the AI6 in the near term rather than introducing a standalone AI Act.
Guvn.AI is built on the AI6 as its operational control baseline. Every module — from the AI Tool Registry to the Compliance Hub to board reporting — maps directly to the six practices, with NAIC AI6 fully integrated alongside the Privacy Act and APRA as the core of the Australian control library. International frameworks including ISO 42001 and NIST AI RMF cross-map onto this Australian foundation, not the other way round.
Translation, not native fit
International platforms apply their EU AI Act control library and call the Privacy Act a sub-mapping. The framing is foreign. The enforcement context is foreign. The audit trail is shaped for someone else's regulator.
- Privacy Act obligations bolted onto an EU baseline
- No native APRA prudential framing
- NAIC AI6 absent or shoehorned in
- Board reporting written for a different liability regime
Australian first, by design
Australian instruments are the spine of the model. International frameworks cross-map onto the Australian baseline – not the other way round. The evidence layer was built for ASIC, APRA and OAIC enforcement contexts.
- Privacy Act and APRA at the centre of the control library
- NAIC AI6 fully integrated as the operational baseline
- Director liability framing throughout the evidence trail
- EU AI Act and NIST RMF as cross-mapped references
Every Australian organisation has at least three AI obligations active today. Most have five.
We can map them in an hour, deploy in days, and have your first board-ready evidence pack in your hands within the week.
Disclosures
Guvn.AI Pty Ltd is an Australian company based in Brisbane, Queensland. The disclosures below set out how we manage personal information, the terms on which our website may be used, and how we protect customer data. Updated 30 April 2026.
Privacy Policy How we manage personal information under the Privacy Act 1988 (Cth).
About this policy
Guvn.AI Pty Ltd ("Guvn.AI", "we", "us") is an Australian Privacy Principle (APP) entity bound by the Privacy Act 1988 (Cth). This policy explains how we manage personal information about visitors to our website, prospective customers, customers, and individuals whose data passes through the Guvn.AI platform.
Personal information we collect
- Identifying information — name, business email, organisation, role and phone number, where you provide it through demo requests, contact forms or direct correspondence.
- Customer account information — single sign-on (SSO) identifiers, role assignments and audit metadata for users of the Guvn.AI platform.
- Technical information — IP address, browser type, device identifiers, pages visited and timestamps, collected through standard server logs and cookies.
- Operational telemetry — within customer environments, the platform processes metadata about AI tool usage, identity events and policy attestations. This is governed by the customer's data processing agreement and is not used for our own marketing.
We do not knowingly collect sensitive information unless it is necessary for a specific purpose and we have your consent.
How we use your information
We use personal information to provide and improve the Guvn.AI platform, respond to enquiries and customer support matters, send service communications, meet our legal and contractual obligations, and conduct internal analytics and product development. You can opt out of marketing communications at any time.
When we disclose information
We disclose personal information only as permitted by the Privacy Act: to service providers under confidentiality obligations, to professional advisers, where required or authorised by Australian law, and in connection with a corporate transaction where the recipient agrees to comply with this policy. We do not sell personal information.
Our infrastructure is hosted in Australia. Where we engage overseas service providers, we take reasonable steps to ensure they handle personal information consistently with the APPs.
Storage and security
We hold personal information in encrypted form and apply safeguards aligned to ISO/IEC 27001 expectations. Access is restricted to staff with a legitimate business need. We retain personal information only for as long as it is needed for the purposes outlined in this policy or as required by law.
Access, correction and complaints
You have a right to request access to the personal information we hold about you and to ask us to correct any information that is inaccurate. We respond to access and correction requests within 30 days.
If you believe we have breached the APPs, you may complain to us at hello@guvn.ai. If you are not satisfied with our response, you may refer the matter to the Office of the Australian Information Commissioner — oaic.gov.au · 1300 363 992.
Terms of Use Terms governing access to the Guvn.AI website. Queensland law applies.
Acceptance
These terms govern your access to and use of guvn.ai (the "Website"). By accessing the Website you agree to be bound by these terms. The Website is operated by Guvn.AI Pty Ltd, registered in Australia with its principal place of business in Brisbane, Queensland.
Permitted use
You may access and view the Website for lawful business and personal informational purposes. You must not use the Website in a way that breaches any law, interfere with its operation or security, attempt to gain unauthorised access, scrape or systematically extract content without our prior written consent, or use the Website to transmit malicious code or to harass, defame or impersonate any person.
Intellectual property
All content on the Website — including text, graphics, logos, the Guvn.AI name and mark, the platform interface and code — is owned by or licensed to Guvn.AI Pty Ltd and is protected by Australian and international intellectual property laws. You may view and print pages for personal or internal business reference. You may not reproduce, modify, distribute, publish or commercially exploit any content without our prior written permission, except as permitted by the Copyright Act 1968 (Cth).
Information accuracy
The Website is provided for general information only. It does not constitute legal, regulatory, financial or professional advice and should not be relied on as such. Regulatory references on the Website are summary in nature; the underlying instruments prevail.
Liability and Australian Consumer Law
To the maximum extent permitted by law, the Website and its content are provided "as is" and we exclude all warranties, representations and conditions, whether express or implied. Nothing in these terms excludes, restricts or modifies any consumer right, guarantee or remedy that cannot be excluded under the Australian Consumer Law or any other applicable law.
Where our liability for breach of a non-excludable consumer guarantee can be limited, our liability is limited, at our option, to the supply of the services again, or the payment of the cost of having the services supplied again. Subject to the above, we are not liable for any indirect, special, incidental or consequential loss arising out of your use of the Website.
Governing law
These terms are governed by the laws of Queensland, Australia. Any dispute arising out of or in connection with these terms is subject to the exclusive jurisdiction of the courts of Queensland and the federal courts sitting in Queensland.
Security How we protect customer data, aligned to ISO/IEC 27001, APRA CPS 234 and the ACSC Essential Eight.
Our approach
We design the platform around a core principle: process the minimum data necessary, retain it for the shortest period required, and surface it only to authorised parties. The platform observes metadata about AI usage; it does not store the prompts, outputs or document content that flow through customer AI tools.
Frameworks and alignment
- ISO/IEC 27001 — information security management system aligned to the 2022 standard. Annex A controls implemented across the organisation.
- APRA CPS 234 — designed to support APRA-regulated customers' obligations on third-party information security.
- ACSC Essential Eight — Maturity Level 2 across the eight mitigation strategies, with Maturity Level 3 in progress.
- SOC 2 Type II — Trust Services Criteria implementation in progress. Audit window opens Q3 FY26.
Data residency
All customer production data is hosted in Australia.
Access and infrastructure
- Single sign-on via SAML 2.0 or OpenID Connect, integrated with the customer's identity provider.
- Multi-factor authentication required for all administrative and operational access.
- Role-based access control with least-privilege defaults and quarterly access reviews.
- Audit logging of all access to customer data, retained for seven years and exportable on request.
- Data encrypted in transit (TLS 1.3) and at rest (AES-256), with keys managed in AWS KMS.
- Network segmentation between application tiers and customer-isolated data planes.
Assurance and incident response
We run continuous vulnerability scanning across application code, dependencies and infrastructure. Independent penetration tests are conducted at least annually. Security telemetry is centralised, monitored on a 24/7 basis, and tied to documented response runbooks.
We maintain a documented incident response plan. Customers are notified of any incident affecting their data within timeframes consistent with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 and any specific contractual notification obligations. For APRA-regulated customers, the platform supports notification timeframes contemplated by APRA CPS 234.
Responsible disclosure
If you believe you have identified a vulnerability in the Guvn.AI platform or website, please contact hello@guvn.ai before any public disclosure. We acknowledge reports within two business days and work with researchers in good faith.