AI Governance Navigator

Step 1 — context

Tell us about your AI initiative

We'll map it to relevant Australian and international frameworks and surface your governance obligations.

What type of organisation are you in?

Health provider / hospital

Public or private health system, hospital network, aged care provider

HealthTech / MedTech company

Building AI-powered health products, SaMD, or clinical decision support tools

Digital health / health insurance

Digital platforms, PHI management, primary care, telehealth

Financial services / APRA-regulated entity

Bank, insurer, superannuation fund, or other APRA-regulated institution — CPS 230 and AI governance obligations likely apply

General enterprise / other industry

Retail, legal, education, logistics, professional services — Privacy Act ADM and general AI governance obligations apply

Government / public sector

Federal or state agencies, regulators, policy bodies — AI in Government Policy obligations apply

Briefly describe what you are building or deploying

Step 2 — risk assessment

Assess the risk profile

Six questions that determine your regulatory obligations and governance requirements.

1. Does this AI directly influence decisions about individuals — clinical, financial, or otherwise?

Yes — directly informs diagnosis, credit decisions, benefit eligibility, triage or similar

Output influences a consequential decision about a person

Partially — supports decisions but a human always reviews

AI is a factor but not the sole determinant

No — admin, scheduling, documentation or back-office only

2. Does it process personal information — health, financial, or other sensitive data?

Yes — ingests or outputs identifiable personal data (health records, financial data, biometrics)

Partially — de-identified or aggregated data only

No — no personal data involved

3. What does this AI output — and who acts on it?

Clinical diagnosis, treatment recommendation, or triage decision

e.g. flagging a condition, recommending a medication, triaging urgency

Health information, guidance, or responses to health questions

e.g. symptom checkers, AI chat answering health questions — even if not branded as clinical

Financial recommendation, credit assessment, or risk scoring

e.g. loan decisioning, fraud detection, investment recommendations, insurance pricing

Operational or administrative output — regulatory status not yet assessed

e.g. scheduling, coding, documentation — confirm whether sector-specific obligations apply

Purely administrative or workflow — no consequential recommendations

e.g. rostering, supply chain, HR admin — no output that informs a decision about an individual

4. Will it operate autonomously without human review of each output?

Yes — outputs are acted on automatically

Sometimes — human-in-the-loop for high-stakes outputs only

No — a human reviews every output before action is taken

5. Does your organisation operate in or sell into international markets?

Yes — Europe or US (EU AI Act and/or FDA obligations apply)

In consideration — international expansion is planned

No — Australia only

6. Does this AI make or substantially influence decisions that directly affect individuals?

This question relates to the Privacy Act 1988 automated decision-making (ADM) transparency obligations effective 10 December 2026 — affecting all Australian organisations.

Yes — AI makes or substantially influences decisions about individuals

e.g. approving/rejecting applications, determining eligibility, pricing, triage, content moderation affecting individuals

Possibly — AI informs decisions but we haven't assessed ADM applicability

Disclosure obligations may apply — assessment recommended before December 2026

No — AI does not make or influence decisions about specific individuals

Step 3 — risk profile

Risk profile

Lower complexityHigher complexity

—

Risk tier

—

Frameworks

—

Gaps found

Applicable frameworks

Step 4 — governance gaps

Gaps to address

Prioritised by risk level. High-priority items should be resolved before deployment.

Step 5 — outputs

Governance documents

Ready-to-use starting documents for your team, board, or regulatory submissions. Download the full PDF report for your matter file — includes assessment record, risk profile, gap analysis, board brief, action plan, and technology checklist.

What next?

Use these outputs to brief your team and board. For a licensed or white-label version of this tool with matter management, audit trail, and versioned assessments, contact rebecca@aigovnav.com.au

Six questions. Your AIgovernance obligations mapped.

Six questions. Your AI
governance obligations mapped.