Which AI Governance Framework Should an Australian or New Zealand Business Actually Follow?

Search for an AI governance framework and you get a wall of acronyms: NIST, ISO, OECD, the EU AI Act, a dozen consultancies' own models. For an Australian or New Zealand business the useful answer is shorter. You need your own government's guidance as the baseline, a structure you can grow into if customers ask for proof, and a first step small enough to finish this month.

What "framework" actually means here

A framework is a set of practices for deciding which AI you use, what could go wrong with it, who is accountable, and how you check. Some are guidance you follow voluntarily. One, ISO/IEC 42001, is a standard you can be certified against. None of them replace the law that already applies to how you handle data and treat customers.

So the question is not "which framework is best". It is: what does my government expect, what will my customers ask for, and what is the least I can put in place now that will still hold up later?

Australia: the Guidance for AI Adoption

In October 2025 the federal government published the Guidance for AI Adoption, six essential practices for organisations using AI, often called the AI6. It replaced the earlier ten-guardrail Voluntary AI Safety Standard. It is voluntary.

The direction is firming. In July 2026 the Prime Minister announced an Office of AI within the Department of the Prime Minister and Cabinet to implement Australian Standards for AI, to be legislated from early 2027. Nothing in that announcement changes what a business must do today, but it is a clear signal that voluntary guidance is the floor, not the ceiling. A business that follows the six practices now will not be starting from scratch when the standards arrive.

For the detail of where Australia stands, see AI governance in Australia.

New Zealand: MBIE's guidance and the Privacy Act

New Zealand has taken a lighter path. MBIE's Responsible AI Guidance for Businesses is voluntary and sits alongside the government's AI Strategy, which is focused on adoption and investment rather than new rules.

The law that bites is the one already in force. The Privacy Act 2020 applies to personal information whether a person or an AI tool handles it, including its conditions on sending information overseas, which matters when a hosted AI tool processes data offshore. Sector codes add to it: the Biometric Processing Privacy Code has applied since 3 November 2025, and the Health Information Privacy Code covers health information. For a New Zealand business, AI governance is first a privacy question.

ISO/IEC 42001: the structure customers can check

Government guidance tells you what good looks like. ISO/IEC 42001 gives you a way to prove it. It is a management system standard, in the same family as ISO 27001, and an accredited certification body can audit you against it. That is why it is showing up in tenders and security questionnaires in both countries.

You do not have to certify to use it. Many businesses build their governance on 42001's structure (policy, inventory, risk and impact assessments, controls, internal audit, review) and decide later whether a certificate is worth it. If customers are already asking, ISO 42001 certification in Australia covers what it takes.

And the others

NIST AI Risk Management Framework. A free, well-regarded set of practices from the United States. Useful for its thinking on risk, but there is no certificate. We compare the two in ISO 42001 vs NIST AI RMF.

The EU AI Act. Law in the European Union, and relevant to an Australian or New Zealand business that sells AI systems into the EU or whose AI outputs are used there. If neither applies, it is background reading, not your framework.

A consultancy's own framework. Fine as a way of explaining things, but a customer cannot verify it. Map anything like this back to your government's guidance and to 42001.

What we recommend, in order

1. A one-page AI policy. What data may go into AI tools, which tools are approved, what needs a person to check it, and who to ask. Write it before the next tool is rolled out, not after. Our AI policy template is a starting point.

2. An inventory of the AI people actually use. Not the approved list: the real one. Personal accounts, browser extensions, AI features switched on in software you already pay for. Expect to find tools nobody approved: that is shadow AI, and you cannot govern what you have not found.

3. A named owner. One person accountable for the policy and the inventory, with the authority to approve or decline a new tool.

4. A simple approval and review routine. New AI tools go through a short check (what data, which plan, what the provider does with it) and the inventory is reviewed on a set cycle. Keep the records; they are the evidence you will need later.

5. Grow into ISO 42001 when there is a reason. A customer, a tender, a board. Everything in steps 1 to 4 becomes part of the management system, so none of it is wasted.

That is a framework a business of any size can run, and it lines up with both governments' guidance. The AI governance framework page sets it out as a working structure, AI governance covers how we help teams put it in place, and our free frameworks go further on putting AI to work once the guardrails are in place.

Governance done this way is not a brake on adoption. A team that knows which tools are approved and what data can go in them uses AI more, not less, because nobody has to guess.