Home · Practices · AI Governance & Assurance

Make AI risk visible, owned
and auditable.

The governance practice that turns AI policy into evidence. Board papers, accountability matrices, registers and reporting cadences — built to the 14-Dimension framework and mapped to APRA CPS 230, CPS 234, AS ISO/IEC 42001 and AICD director-duty guidance.

01 · Who this is for

Boards and risk leaders who need evidence, not slides.

If the question on the table is “can we show the regulator what we’re doing about AI?” — this is the practice.

FOR · 01

Board & Risk Committee Chairs

You need a defensible AI governance posture before the next external review. The artefacts that come out of this practice sit on a board table without further translation.

CHAIR · AUDIT COMMITTEE · RISK COMMITTEE
FOR · 02

CROs, CISOs, General Counsel

You own AI risk in practice. You need the working tools — registers, policies, RACI, escalation playbooks — that survive Internal Audit and APRA scrutiny.

CRO · CISO · GC · HEAD OF MODEL RISK
02 · What you get

Twenty artefacts. One Govern pillar.

The governance practice delivers the full Govern pillar of the Mycelium framework — five dimensions, four artefacts per dimension, populated to your context.

01
D01 Strategy & alignment
Strategy statement
Strategic map
Use case catalogue
Evidence pack
02
D02 Accountability & ownership
RACI matrix
Governance charter
Reporting cadence
Evidence pack
03
D03 Risk appetite & tolerance
Risk appetite statement
Risk tolerance schedule
Breach & escalation playbook
Evidence pack
04
D04 Model governance
Model policy + lifecycle
Model risk tiering
Model card template
Evidence pack
D05 VENDOR & THIRD-PARTY GOVERNANCE · POLICY · REGISTER · DDQ · EVIDENCE PACK
03 · Engagement models

Three ways in.

Pick the depth that matches the board cycle and the calendar.

04 · Why Mycelium

The practice is the framework.

01
Built to a single methodology. Every artefact is part of the Mycelium 14-Dimension framework. Nothing is stitched together at the end.
02
Mapped to your regulators. Every output explicitly maps to the clause it satisfies. Internal Audit can trace from regulator wording to evidence.
03
Populated, not templated. You leave with documents that are filled in with your context, not blank forms to complete.
CPS 230 · CPS 234 · AS ISO/IEC 42001 · ASD ISM · NIST AI RMF · AICD · Privacy Act 1988 (ADM 2026)

The first call is diagnostic.

Thirty minutes. No pitch. No proposal until it makes sense.

Book a diagnostic
30-MINUTE DIAGNOSTIC CALL · VIDEO OR MELBOURNE · BOOK DIRECTLY
Or open the full 14-Dimension framework ↗