All perspectives, by theme.
Essays and briefings on privacy, data, AI regulation, board governance, incident response, and regulated-business risk.
Board & Executive Governance
How boards should see privacy, data, cyber and AI exposure before it becomes an incident, a penalty, or a public failure.
- Why Boards Need to Rehearse AI Governance Decisions Board papers can show that AI governance exists. Rehearsal shows whether management can make, challenge and evidence an AI decision before the organisation is already committed.August 2026
- APRA Didn't Write to Your Board. Read the Letter Anyway. APRA's April 2026 letter on AI is addressed to banks, insurers and super funds. It is also the clearest account any Australian regulator has given of what a board must do about AI, and a director's duty of care does not stop at the regulatory perimeter.July 2026
- Anatomy of a Board-Level Privacy Failure Boards miss privacy risk when reporting preserves internal boundaries. Stronger governance gives directors one usable picture while the response can still be shaped.May 2026
AI Governance
Making AI governance actually operate: ownership, the capability it needs, and where it clashes with other controls.
- Fraud AI Creates Governance Clashes That Do Not Resolve Cleanly Fraud AI creates real clashes between control uplift, AML expectations, privacy limits and legal constraints. Governance has to draw the boundary.July 2026
- AI Governance Is the Stress Test for Your Operating Model AI governance tests whether privacy, data, vendor and risk controls can reach weak AI pathways before the business starts depending on them.June 2026
- AI Governance Is Not a One-Person Job AI governance cannot be solved by hiring one specialist role. It needs existing privacy, data, risk and technology capability to work together.May 2026
Privacy & Data Strategy
Privacy, data, and the operating models that turn adopted frameworks into decisions the business actually makes.
- Privacy Training Does Not Work If the Right People Are Not in the Room Privacy training can improve knowledge without building the judgement people need to shape a consequential decision together.July 2026
- Scrutiny Is Not Accountability Independent challenge matters, but it cannot make the business own a privacy, data or AI decision it was never required to make properly.July 2026
- Compliance Automation Is Not a Starting Point Compliance automation only works when the data, evidence and ownership foundations are mature enough to support the assurance it produces.July 2026
- PII Is Not Personal Data PII is an IT security concept; personal data and personal information are legal concepts. Confusing them weakens privacy, data and AI governance.June 2026
- A Framework Is Not an Operating Model Boards can mistake framework adoption for changed behaviour. The harder test is whether the business now makes different risk decisions.June 2026
- Why Siloed Privacy, Data, and AI Programs No Longer Work Privacy, data and AI governance are still managed as separate programs long after the risk stopped behaving that way.April 2026
Regulatory Change & Reform
Privacy Act reform, AI regulation and the operational choices regulated businesses have to make now.
- Fraud Detection Is Where AI Meets the Limits of Privacy Law Fraud detection is a strong AI use case, but broader monitoring and inference quickly test purpose, proportionality and privacy-law limits.July 2026
- No AI Regulation Is a Window, Not a Strategy Australia's lighter AI regulatory position is a window to build governance capability, not a reason to delay accountability until reform arrives.June 2026
- The 2026 Automated Decision-Making Rules Will Expose Governance Gaps The 2026 automated decision-making rules will test whether organisations know where consequential decisions are made and who controls them.May 2026