Existing law already applies
The National AI Plan (December 2025) chose existing laws over new AI-specific rules. Consumer, privacy, discrimination and directors' duties apply to AI decisions today.
AI safety & governance audit
Know your AI is safe, accountable and defensible.
An independent, scored audit of how your business governs, tests, monitors and controls its AI, benchmarked to the world's leading standards and right-sized for the mid-market.
Why boards are asking now.
AI is already inside most businesses, through staff tools, vendor features and new agents. Few can show who owns it, how it's tested, or how they'd stop it.
Automated decisions go public
Privacy policies must disclose when personal information is used in substantially automated decisions that significantly affect people.
AI is now a diligence line item
PE sponsors, acquirers and insurers expect evidence of AI controls. A governance gap found at exit costs more than one closed today.
Benchmarked to world best practice.
One audit, mapped to the frameworks your board, regulators, customers and buyers already recognise, so the work counts everywhere it needs to.
ISO/IEC 42001
The certifiable AI management system standard, the AI equivalent of ISO 27001.
Annex A controlsISO/IEC 42005ISO/IEC 23894
NIST AI RMF
The most widely used AI risk framework, organised around four functions.
GovernMapMeasureManage
Guidance for AI Adoption
The National AI Centre's six essential practices (AI6), released October 2025.
AccountabilityHuman control+4
EU AI Act
Risk-tiered law for anyone selling into the EU. High-risk obligations are being phased in from late 2027.
Risk tiersTransparencyOversight
Eight domains. One score each.
Every domain is scored on evidence, not policy documents, and mapped to the standards above.
Tap a framework to see where it's covered.
1
Accountability & governance
A named owner for every AI system, an AI policy people follow, board reporting and clear decision rights.
AI6 · 1NIST GovernISO A.2–A.3
2
AI inventory & transparency
A complete register, including shadow AI and vendor features, and honest disclosure to customers and staff.
AI6 · 4ISO A.8EU transparency
3
Impact & risk assessment
Who each system could affect, risk rated per use case, controls scaled to the risk and a way for people to challenge outcomes.
AI6 · 2–3NIST MapISO 42005
4
Data & privacy
Data provenance and quality, consent and purpose, what goes into third-party models, and automated-decision disclosure.
ISO A.7Privacy Act
5
Testing & evaluation
Pre-deployment testing for accuracy, bias, security and prompt injection, with acceptance criteria agreed before go-live.
AI6 · 5NIST MeasureISO A.6
6
Monitoring & incidents
Observability and alerting for drift, regressions, retry loops, cost and latency, plus an incident playbook that's been used.
AI6 · 5NIST ManageISO A.6
7
Human oversight & control
People who can review, override, pause or shut down each system, the training to do it, and a fallback when they do.
AI6 · 6ISO A.9EU oversight
8
Third parties & vendors
Due diligence on AI vendors and models, contract terms on data use and liability, and verification of what vendors claim.
AI6 · 5ISO A.10
A maturity score you can track.
Each domain lands on a five-level scale, so the board sees where you are, where you need to be and how fast you're moving. Tap the level that sounds like you today.
Level 1
Ad hoc
AI used without owners, records or rules.
Level 2
Aware
Policy drafted, inventory started, controls inconsistent.
Level 3
Defined
Owners, risk ratings and testing in place for key systems.
Level 4
Managed
Monitoring, alerting and oversight run as business as usual.
Level 5
Assured
Evidence ready for certification, diligence or regulators.
Three to four weeks. Fixed scope.
We test what actually happens, not just what the policy says.
- Week 1
Discover
Build the AI register with your teams, including vendor features and staff tools. Agree scope and risk tiers.
- Week 2
Evidence
Interview owners and review policies, assessments, contracts, test results and logs.
- Week 3
Test the controls
Sample real outputs and traces, try an override, check an alert fires and trace an incident end to end.
- Week 4
Score & roadmap
Scored readout by domain, gaps mapped to each standard and a prioritised 90-day plan.
What you keep
- A complete AI system register
- Scorecard across eight domains
- Gap map to ISO 42001, NIST, AI6 and the EU AI Act
- Prioritised 90-day remediation plan
- Board-ready summary of risk and progress
- Right-sized monitoring and alert thresholds
Built for the businesses in between.
Too big to ignore AI risk. Too lean for a dedicated AI governance team.
Sponsors & portfolio companies
AI risk in diligence, a baseline in the first 100 days and evidence that holds up at exit.
Boards & CEOs
Assurance that AI in customer service, pricing, hiring or operations is owned, tested and under control.
Teams deploying agents
A go-live gate and an oversight loop before agents act on customers, money or data.
An OptiProduct audit is an independent assessment, not legal advice or ISO certification. It prepares you for both: findings are mapped so your lawyers, auditors or a certification body can pick them up directly.
Questions
What is an AI governance audit?
An independent review of how a business owns, assesses, tests, monitors and controls its AI systems, including staff tools, vendor features and agents. OptiProduct scores eight domains on a five-level scale and maps every gap to recognised standards.
How long does the audit take and what does it cost?
It takes three to four weeks with a fixed scope. The price is fixed up front after a 30-minute scoping call, based on how many AI systems are in scope.
Is this ISO/IEC 42001 certification?
No. Certification is issued by an accredited certification body. The audit maps findings to ISO/IEC 42001 so a business can prepare for certification, or for diligence and regulators, without starting again.
Does an Australian business need to comply with the EU AI Act?
Usually only if it places AI systems on the EU market or the AI's outputs are used in the EU. Australian businesses are governed by existing Australian laws, with the Guidance for AI Adoption (AI6) as the national best-practice benchmark.
What are Australia's AI6 practices?
The six essential practices in the Guidance for AI Adoption (October 2025): decide who is accountable, understand impacts, measure and manage risks, share essential information, test and monitor, and maintain human control.
Find the gaps before someone else does.
A 30-minute scoping call covers your AI footprint, the frameworks that matter to you and a fixed price.