Most teams are using AI tools the business hasn’t sanctioned. That’s not a technology problem. It’s a structure problem. And it’s fixable.
A few days after we ran an AI capability session for Golf Management Australia’s BMI leadership program, one moment from the room was still sitting with me.
It wasn’t the board report story, the senior manager who’d taken his drafting time from an hour to seven minutes. That was useful to hear, and the room responded to it.
It was the first question from the floor, before we’d even started presenting.
Data protection. What goes into these tools. What stays private. What the board can and can’t see.
| The question | What it covers | Why it matters |
|---|---|---|
| 1 |
What tools are approved? Which AI tools has the business sanctioned for work use and which haven't been reviewed. |
Without a clear list, staff default to whatever they have personally. The list doesn't need to be long. It just needs to exist. |
| 2 |
What information can and can't go in? What data applies member data, financial details, client information, board materials. |
This is where most risk sits. Staff usually don't intend to expose sensitive data. They just haven't been told what “sensitive” means in an AI context. |
| 3 |
Who checks outputs before they leave? Who reviews AI-assisted content before it goes to a client, member, board, or regulator. |
AI outputs can be confident, plausible, and wrong. Clear review ownership is the simplest governance control available and the most commonly skipped. |
What good looks like at the starting stage An approved tools list, even 2 or 3 tools to begin with. A 1-page data guidance note that answers ‘what can go in’ in plain language. A simple review checkpoint for AI-assisted content that leaves the building, client communications, board materials, member-facing output. That’s it. That’s the floor.
The Office of the Australian Information Commissioner has published practical AI governance guidance for organisations handling personal information, a useful reference point for the data boundary question, particularly for businesses holding member, client, or employee data. (oaic.gov.au)
The goal isn’t enterprise-grade governance on day one. That’s neither practical nor necessary for most service businesses.
| Stage | Governance focus and typical controls | Who owns it |
|---|---|---|
| Just starting | 3 questions answered, approved tools list, output review for high-risk content | GM or senior leader |
| Building fluency | Shared prompts, team guidelines, consistent output standards | Team lead or internal champion |
| Embedding AI | Role-based access, documented workflows, review checkpoints | Ops lead or designated AI owner |
| Scaling capability | Logging, policy documentation, board-level visibility | Executive and governance committee |
Most service businesses we work with are at stage 1 or moving into stage 2. That’s the right place to start. The mistake is skipping stage 1 because it feels too simple, and discovering eighteen months later that the organisation has been running without any structure at all.
This doesn’t need to be a project. It needs to be a decision.
Not sure where your governance gaps actually sit? The AI Impact Report gives you a structured read on where your business is operating without adequate oversight, and where simple interventions would make the biggest difference. 10 minutes. Specific, prioritised recommendations.
Shadow AI refers to AI use by staff that sits outside any policy, oversight, or record the organisation has put in place. Most is not intentional misuse, it’s staff using personally accessible tools like free AI chatbots to get work done faster. The risk is that sensitive data may be entering tools the business hasn’t reviewed or approved.
The main risks are data exposure, reputational risk, and loss of output oversight. Member data, client information, financial commentary, and board materials entered into unreviewed AI tools may be logged or used for model training. AI-assisted outputs sent without review can contain errors the business is accountable for.
The 3 questions are:
(1) What AI tools are approved for work use? (2) What information can and can’t go into AI tools, covering member data, client information, financial details, board materials? (3) Who reviews AI-assisted outputs before they leave the business? Answering these clearly and communicating them to staff addresses the most common Shadow AI risks.
No. For most Australian service businesses, governance starts with 3 practical questions, a short approved tools list, and a simple review checkpoint for high-risk outputs. This can be implemented in a 30-minute leadership conversation followed by a clear communication to staff. Governance scales with capability, the structure evolves as AI becomes more embedded.
Still feeling stuck? You’re not alone but you don’t have to figure it out solo.
Our DMA helps you cut through the noise and focus on what matters most.
