Home · About
The practice

An AI governance practice built for Australian boards.

Mycelium assesses AI governance against evidence, classifies what it finds, and produces a record a board can table and an auditor can follow. It is independent by construction: it licences no platforms, builds no systems, holds no interest in anything it recommends, and does not place an organisation it has assessed onto its own platform within twelve months.
01 · Approach

Three principles. One discipline.

  • 01

    Diagnostic-led

    Every engagement begins with a diagnostic, and none proceeds without one. If the diagnostic does not support further work, we say so before a proposal is written.

  • 02

    Evidence-graded

    Findings map to a control, a standard and a piece of evidence, and carry a state rather than a colour. A board is told what exists, not how to feel about it.

  • 03

    Built to defend

    The output is designed to hold up in front of the people who matter most: your board, your auditor, your regulator.

02 · Independence

The finding is the product.

Most firms in this market offer the remedy alongside the diagnosis. Mycelium cannot, by construction. Four constraints make that boundary real rather than stated, and the fourth one governs us rather than anybody else. Three further tests turn on the engagement rather than the business model, so they are declared each time.
01No platform licences

We hold no interest in any tool we might recommend.

02No systems integration

We do not build the AI, and we do not build the agents. So we never assess our own work.

03No referral arrangements

No recommendation of ours creates a downstream interest for us, from anyone, at any point.

04No assessment into a subscription we own

The rule runs both ways. An organisation we assess does not go onto the Evidence Platform for twelve months, and an organisation on the platform is not assessed by us until twelve months after it comes off.

Declared on every engagement

05Relationships

Any personal relationship between a Mycelium assessor and a person at the organisation is declared before scope is agreed.

06Perception

A conflict a reasonable third party could perceive is handled as a conflict, whether or not one exists.

07Our own prior work

Where a record includes work Mycelium designed or delivered, the entry says so.

Where Mycelium designs an AI governance operating model, it does not also assess that model independently within the same twelve months. The record is yours. Every register, assessment and evidence pack is delivered in a form you can keep current without Mycelium and without the platform.

03 · Sectors

Where we work.

The fourteen dimensions are sector-neutral, so an engagement is not limited by sector. What changes by sector is the regulator mapping, the evidence a board in that industry will accept, and the language findings are written in.

Two sectors have a published edition carrying all three of those layers: Banking & Finance and Energy & Utilities. Everywhere else runs on the master edition.

See the sector editions ↗

CPS 230 · CPS 234 · AS ISO/IEC 42001 · ASD ISM · NIST AI RMF 1.0 · AICD · Guidance for AI Adoption · Privacy Act 1988 (Cth) · APP 1.7 · EU AI Act
04 · Start here

The first call is diagnostic.

Thirty minutes. No pitch. No proposal until it makes sense.

Book a diagnostic Run the Boardroom Diagnostic
30-MINUTE INITIAL DIAGNOSTIC & SCOPING CALL · BOOK DIRECTLY