/* scripts/transform.mjs RULE 12: with JavaScript off, show the content the runtime would otherwise keep collapsed. */ [data-nojs-reveal]{display:block !important}
Skip to content
Transformativ Book a discovery call
AI SERVICES

AI governance

Controls that let AI agents do real work in a regulated business.

AI governance is the set of controls, accountabilities and records that let an organisation use AI with confidence. Transformativ builds AI governance into the work itself for Australian banks, insurers, super funds and other regulated enterprises, so AI agents meet obligations as they work and the speed AI brings survives the approval process.

THE PROBLEM

Why governance becomes the bottleneck

Governance designed for projects can't keep pace with AI agents, for three reasons.

  1. Committees built for projects meet AI that changes weekly.

    Every change joins the same queue.

  2. The framework lives on paper.

    Policies exist, and nothing in the work enforces them.

  3. Nobody can show what the agent did.

    Without a record of every action and decision, risk teams can't approve live operation.

WHAT CHANGES

What changes

Governance built into the work lets AI agents run in a regulated business without waiting on a committee.

  1. Obligations are met as the work moves, with controls built into the process.

  2. Every AI agent and every decision has a named, accountable owner.

  3. Every agent action leaves a full record, ready for audit and regulators.

  4. Your people review outputs until the agents have earned more autonomy.

  5. Only genuinely new situations step out for a decision.

THE METHOD

The method behind it

One method sits behind how we govern AI.

Governance in the flow

Your obligations met as the work moves, with only the genuinely new stepping out for a decision. Controls held, waiting removed.

HOW IT RUNS

How it runs inside Catalyst+

AI governance runs through every stage of Catalyst+, our AI transformation product.

See how Catalyst+ works →
  1. 01 · DEFINESIX WEEKS

    Define

    Governance is designed alongside the target operating model, with your risk and compliance teams.

  2. 02 · ACTIVATETYPICALLY 8 TO 12 WEEKS

    Activate

    The controls go live with the first AI agents.

  3. 03 · SCALE

    Scale

    The same controls extend to every new agent and process, without starting again.

What happens in the six weeks

WEEK 1WEEK 6: AI DELIVERING VALUE
  1. WEEKS 1 TO 2ALIGN

    WEEKS 1 TO 2 | ALIGN

    Work with your risk and compliance teams from the first week. Map your obligations and the frameworks, committees and controls you already have.

    BY WEEK 2

    Your obligations and existing controls mapped, with risk and compliance at the table.

  2. WEEKS 3 TO 4DISCOVER

    WEEKS 3 TO 4 | DISCOVER

    Find where approval queues slow the work, and what each AI agent would need to record.

    BY WEEK 4

    You know where governance slows AI down and what every agent must record.

  3. WEEKS 5 TO 6DESIGN

    WEEKS 5 TO 6 | DESIGN

    Design governance alongside the target operating model: controls in the process, a named owner for every agent and decision type, and what steps out for a decision.

    BY WEEK 6

    Governance designed into the target operating model, ready to go live with the first AI agents.

QUESTIONS

Common questions about AI governance

AI governance is how an organisation decides which AI it uses, who is accountable for each system, what controls apply, and how it proves those controls work. In practice that means an inventory of AI systems and use cases, a named owner for each, risk ratings, approval rules, monitoring once systems are live, and records an auditor or regulator can check. In Australia the reference points are the National AI Centre's Guidance for AI Adoption and, for banks, insurers and super trustees, APRA's April 2026 letter on AI.

Agents need tighter controls than chat tools because they act. Each agent gets its own identity and limited permissions, logs every action and the data it used, has thresholds above which a person must approve, and is tested on historical cases before it goes live. Low-risk, repeatable actions are pre-approved; anything new or above threshold goes to a named person. Accuracy is monitored after go-live, which APRA found few institutions were doing continuously.

Yes. AI governance belongs inside the risk framework, committees and three lines of defence you already run, with AI-specific additions: an AI inventory, risk tiers for use cases, model monitoring and controls over third-party AI providers. We map what you have against APRA's expectations and the Guidance for AI Adoption, then add only what's missing.

The executive who owns the process the agent works in. We name that person for every agent, plus a technical owner responsible for how it performs. Where an agent makes decisions that could significantly affect individuals using their personal information, your privacy policy must describe those decisions from 10 December 2026 under the Privacy Act's automated decision-making rules.