Boards & leadership teams · Regulated industries
We work with boards and senior leadership teams to build a working appreciation of what AI can do, hands-on, because until leaders have seen beyond the chatbot it is hard to see where the true impact can be made in their business. From there we find where AI can accelerate the business strategy, and equip the board to change it with conviction, grounded in a clear view of their responsibilities for a properly governed AI programme. Then we deliver the plan, from board paper to working prototype to production, building governable AI that meets the expectations APRA and ASIC have set, or finding solutions to buy that meet the same governance bar. Inside your governance, not around it.
The register of accountability
The APRA letter to industry and the ASIC open letter set the expectation directly.
Non-delegableBoards must maintain sufficient understanding to provide effective challenge. APRA named the gap itself, overreliance on vendor presentations and summaries. AI inventory, lifecycle accountability and human involvement in high-risk decisions are now baseline.
Boards must be able to evidence that controls work, on a defined reporting cadence. ASIC v RI Advice is the precedent pathway from licensee breach toward personal exposure for inadequate technology risk management.
Where AI supports a critical operation, the vendor falls within CPS 230's material service provider regime, and the transition period for pre-existing contracts has ended. For most boards, the practical question is no longer readiness. It is whether the vendor agreements already in place would stand the test.
From accountable to in control
In our advisory work on the APRA and ASIC letters, the question directors actually ask is this. In practice, what does this mean we have to do? Four moves, in the order we take boards through them.
The same expectations are now surfacing in New York, California and the EU. This is not only an Australian question.
One inventory of every place AI touches a decision, including inside your vendors' tools. Then remove the reason people use their own. A governed AI your staff are allowed to use. A policy is not a control.
Where AI supports a critical operation, the vendor falls within CPS 230's material service provider regime, and the transition period has ended. And ASIC's word was evidence. For any AI-assisted decision, what the system did, who reviewed it, who signed off.
These four are where the regulators are converging.
Not a policy the AI team drafts and the board signs off. A strategy grounded in the regulators' principles, owned by the board, with enough technical fluency at the table to challenge it. The piece that cannot be delegated.
This is the shape of the work we do with boards. A governance review grounded in what the regulators actually require, that turns "we know we're accountable" into a plan the board can stand behind and evidence.
A short, defined review for boards and executive committees of regulated firms to show your AI inventory, your shadow AI exposure and your vendor agreements against CPS 230, grounded in what the regulators have published, not in vendor demos.
The work concludes in a board paper. The gap map and a sequenced remediation plan the board can evidence in its minutes.
Every AI session a board has sat through is slideware. The Executive Build Day moves leaders beyond the chatbot. Each executive builds something real from scratch and sees it deployed, using the same tools our principals use every day. What they see changes the frame. Agentic AI making judgment calls previously thought impossible to automate, and working applications built without a development team.
What remains afterwards is evidenceable AI literacy, and working prototypes your leadership team built themselves.
We build to the plan the board has approved. Forward-deployed engineers inside your environment, building the system and the organisational capability to govern it, process by process. When your teams can extend it without us, our work is done.
The result is production AI operating a whole process, with the evidence trail built in. What the system did, who reviewed it, who signed off.
This is not a capability we describe. It is how we operate. Small teams working with AI agents, doing the work of twenty people with the tools already available. Any executive can learn it. They just need to be shown. Why the Build Day exists
We have been building AI since 2014, when it was still called machine learning. Building AI for a regulated business is not one decision. It is a chain of them. What the system should do, the first lines of code, the shape of a real operational workflow, the pilot, the cutover to production, and then the part most programmes never reach, adoption. Product champions, centres of excellence, governance that holds. Our principals have carried systems through that entire chain, more than once. That experience shapes what we recommend, what we decline to recommend, and how quickly our clients reach a system their people actually use.
Our principals have founded, ASX-listed and exited automation companies, and run global AI innovation labs for a tier-one technology vendor, with AI and ML programmes across top-tier European telcos and two TM Forum Excellence Awards.
Production AI claims automation built and deployed at one of the UK's largest motor insurers, taking processing times from days to minutes, inside the governance of a regulated business.
Currently building process-operating AI platforms for specialty insurance, architected for the scrutiny APRA and ASIC now describe, traceable, auditable, human-approved at every decision.
The starting point is a conversation about where your board stands or about the process you want built. From there, the governance review, a Build Day, or a build engagement, whichever the situation calls for.
Our principals accept a small number of board and advisory positions with regulated firms building AI capability. If your board needs AI fluency at the table rather than in front of it, talk to us.