The mid-market governance challenge
Australian mid-market organisations — roughly 50 to 500 staff — occupy a difficult position in the AI governance landscape. They face the same Privacy Act obligations, sector regulatory requirements, Fair Work AI obligations, and consumer law exposure as large enterprises. But they do not have the dedicated GRC teams, legal resources, or governance infrastructure that large organisations can deploy.
The answer is not to attempt a scaled-down version of enterprise governance. It is to build governance that is proportionate to risk, integrated into existing processes, and scalable as AI use grows — rather than bolt-on and bureaucratic.
Starting with what you already have
Most mid-market organisations already have some of the components of AI governance in place — they just are not labelled as AI governance. The existing enterprise risk register can be extended to include AI systems. The existing privacy compliance function already manages Privacy Act obligations that extend to AI. The existing HR function already manages Fair Work Act consultation obligations that apply to AI deployments. The existing IT procurement process can be extended to include an AI-specific review gate.
AI6's six practices map directly onto these existing functions. Practice 1 (Accountability) maps to whoever runs risk and governance. Practice 2 (Impact Assessment) maps to existing risk assessment methodology. Practice 3 (Risk Management) maps to the enterprise risk register. Practice 4 (Transparency) maps to the privacy compliance function. Practice 5 (Testing and Monitoring) maps to existing IT and operational review processes. Practice 6 (Human Oversight) maps to existing approval and review authorities.
For a mid-market organisation, implementing AI6 at the Implementation Practices tier does not require building something new — it requires extending what exists.
The shadow AI problem
The most consistent governance gap in Australian mid-market organisations is shadow AI — business units adopting AI tools without IT, legal, or risk involvement. Consumer AI tools can be accessed on a credit card; enterprise AI subscriptions are sometimes purchased through software marketplaces that bypass procurement. The result is an organisation with AI tools in use that have not been assessed for privacy compliance, security risk, or alignment with governance policy.
The solution is a lightweight AI procurement review gate — not a lengthy approval process, but a structured minimum check before any AI tool is used with company data. The check should take a few hours, not weeks, and should cover: what data will the tool process; where does that data go; is there an appropriate business or enterprise account; and has the tool been communicated to relevant staff. The NAIC's AI screening tool provides a free structured framework for exactly this.
Customer and government due diligence
Mid-market organisations in professional services, technology, construction, healthcare, and government supply chains are increasingly finding that enterprise customers and government agencies include AI governance in supplier due diligence. A question like "how do you govern your use of AI in delivering services to us?" is now appearing in RFT responses and vendor questionnaires. Organisations that cannot give a coherent, documented answer are at a disadvantage relative to competitors who can — regardless of whether their AI governance is formally certified.
The AI6 framework, combined with free NAIC templates and a documented controls register, provides enough structure to answer these questions credibly. You do not need ISO 42001 certification — you need documentation that shows you have thought about this systematically.
