AI adoption has moved faster than most governance frameworks
Employees, executives, advisers and family members can now access powerful AI services within minutes. That creates opportunity, but it can also create unmanaged information, privacy, cybersecurity, legal and operational risk.
For a Family Office, the information at stake can include family and principal information, investments, trusts and entities, board papers, legal documents, financial records, property and asset information, security arrangements, travel information, adviser communications and confidential information relating to operating businesses.
Secure AI Governance establishes how AI may be used, which platforms are approved, what information can be processed, who is accountable and how risk is monitored over time.
What Secure AI Governance means
Secure AI Governance is the practical framework used to make AI adoption safe, controlled and accountable. It brings together technology governance, cybersecurity, privacy, data protection, identity, vendor management, policy, employee education, executive oversight and ongoing monitoring.
A useful governance model should answer five questions clearly: What AI are we using? Who is using it? What information can it access? What decisions or work is it supporting? Who is accountable for the risk?
DSC approaches AI governance at both the organisation level and the individual use-case level. The same AI platform may present very different risks depending on whether it is drafting a public marketing post, summarising a confidential board paper or analysing personal information.
Understand and control Shadow AI
Shadow AI is the use of AI applications, accounts, browser extensions, meeting assistants or embedded AI functions that have not been formally approved or governed by the organisation.
Typical examples include using a personal ChatGPT account to summarise a confidential document, uploading financial information to an unapproved service, installing an AI meeting assistant, connecting an AI application to Microsoft 365, or using a browser extension that can read organisational information.
Simply banning AI rarely solves the underlying problem. A stronger approach is to discover current use, establish approved alternatives, define data-handling boundaries and give people a safe path to use AI productively.
Approved versus unapproved AI
One of the foundations of Secure AI Governance is establishing an approved AI register. An organisation should be able to identify which services are approved, which accounts or subscription tiers must be used, who may use them, what information they may process and which higher-risk uses require additional approval.
Approval should consider the particular product, subscription or service tier, configuration, identity controls, contractual arrangements, data handling and intended use. A well-known brand name alone is not sufficient.
Approved Platforms
Document permitted AI platforms, approved service tiers, account requirements and authorised integrations.
Approved Use Cases
Define which activities are acceptable, which require human review and which require risk or executive approval.
Prohibited Uses
Clearly identify information and activities that must not be submitted to unapproved or publicly available AI services.
ChatGPT, Microsoft Copilot, Claude and other AI platforms
There is no single AI platform that is automatically appropriate for every organisation or every use case. ChatGPT, Microsoft Copilot, Claude, Gemini and specialised AI applications have different capabilities, integrations, administration models, contractual terms and data-handling arrangements. Consumer, business and enterprise offerings from the same provider may also operate differently.
DSC assesses AI at the platform and use-case level. Relevant questions include: where information is processed; how long prompts, files and outputs are retained; whether organisational data may be used for model improvement or training; whether single sign-on and multi-factor authentication are available; whether administrators can manage users centrally; what audit information is available; what permissions integrations receive; and what happens to information when a user leaves.
Sensitive-data handling
Good AI governance begins with good data governance. The question is not simply “Can we use AI?” It is also “What information are we prepared to allow this AI service to process?”
DSC helps clients establish practical information categories and handling rules for AI. Particular care is required with personal and sensitive information, privileged material, credentials, security information, confidential agreements, investment information, unpublished transactions and information belonging to third parties.
The Office of the Australian Information Commissioner recommends due diligence before adopting commercially available AI products and, as a matter of best practice, advises organisations not to enter personal information — particularly sensitive information — into publicly available generative AI tools because of the privacy risks involved. Read the OAIC guidance.
Identity and access
AI governance is also an identity and access problem. An organisation should understand who is using an AI service, under which identity, with what permissions and with access to which organisational information.
Where appropriate, DSC can help implement organisational accounts, single sign-on, multi-factor authentication, role-based access, controlled administrator privileges, user lifecycle management, approved application integrations, Microsoft 365 permission review and monitoring. AI should not become a separate technology environment operating outside normal cybersecurity controls.
Retention, training-data and data-use risk
Organisations should understand what happens to information after it is submitted to an AI platform. This includes prompts, uploaded files, generated responses, conversation history, logs and information shared through integrations.
Governance should establish whether information is retained, for how long, whether retention can be configured, whether it can be deleted, who can access it, whether it can be used to improve or train models, what third parties are involved and whether business or enterprise subscriptions provide different protections.
AI vendor assessment
AI services should be subject to proportionate vendor due diligence rather than adopted simply because they are popular or convenient. DSC can assess security, privacy, data processing, data location, retention, contractual terms, model-training practices, identity controls, integration permissions, incident notification, subcontractors, audit capability, business continuity and exit arrangements.
The assessment should reflect the sensitivity of the information being processed and the importance of the use case. A low-risk writing assistant is not governed in the same way as a system making or materially influencing decisions about people, investments or confidential organisational matters.
A practical AI policy
An effective AI policy should make safe behaviour easier to understand. Employees and advisers should know which tools they may use, which accounts are required, what information may be submitted, what is prohibited, which activities require approval, when human review is required, how AI-generated material should be checked and how an AI-related incident should be reported.
Policy should be supported by an approved AI register, clear ownership, employee education and a process for assessing new AI products and use cases. It should also be reviewed as platforms, risks and organisational use change.
Employee, family member and adviser use
Family Offices often operate beyond a conventional corporate boundary. AI may be used by employees, executives, family members, consultants, accountants, lawyers, investment advisers, property advisers, executive assistants and other trusted parties.
That extended ecosystem matters. A technically secure corporate AI environment cannot eliminate risk if sensitive information is copied into an unapproved service elsewhere in the advisory network. Secure AI Governance therefore needs to consider people, behaviour and third-party access as well as platforms.
Board and executive governance
AI is not solely an IT issue. Material AI use can create operational, privacy, cybersecurity, legal, reputational and strategic risk. Boards, principals and executives should understand where AI is being used, who owns AI risk, which use cases are material, which vendors are relied upon, what exceptions exist and how AI governance is being monitored.
For many Family Offices, governance can remain deliberately lightweight. Lightweight should not mean undocumented or uncontrolled. The Australian Government’s current Guidance for AI Adoption sets out six essential practices for responsible AI governance and emphasises that governance should operate at both organisation and individual AI-system/use-case level.
AI incident response
AI-related incidents can include sensitive information entered into an unapproved service, confidential documents uploaded to the wrong account, excessive Microsoft 365 permissions granted to an AI application, compromised AI accounts, unexpected retention, disclosure through an integration, incorrect AI-generated material being relied upon, or discovery of widespread Shadow AI.
DSC can help incorporate AI events into existing incident-response processes so responsibility, escalation, containment, evidence preservation, notification and remediation are understood before an incident occurs.
Monitoring and ongoing governance
AI governance should not stop when a policy is issued. Technology changes rapidly: new AI capabilities appear inside existing applications, employees discover new services, vendors change terms and integrations expand access to organisational information.
Ongoing governance may include AI application discovery, Shadow AI review, approved-platform review, vendor reassessment, identity and access review, policy review, employee education, incident review, new-use-case assessment and reporting to management or the board.
The Australian Signals Directorate’s AI data security guidance reinforces the importance of protecting the confidentiality, integrity and availability of data used throughout AI systems. Read the ASD/ACSC AI data security guidance.
Secure AI Governance readiness checklist
A practical starting point is to confirm that the organisation can answer the following questions:
- Do we know which AI platforms, accounts, browser extensions and integrations are currently being used?
- Have we defined which AI tools and service tiers are approved?
- Do employees, family members and advisers know what information may and may not be entered into AI systems?
- Are AI identities, permissions and integrations governed within our existing cybersecurity and Microsoft 365 security controls?
- Do we have an AI policy, approved-AI register and clear ownership for exceptions and new use cases?
- Have higher-risk AI vendors and integrations been assessed for privacy, security, retention and contractual risk?
- Can we identify and respond to Shadow AI or an AI-related information incident through our business continuity and incident-response processes?
- Is AI governance connected to our broader technology governance, data protection and managed IT environment?
For Family Offices, these controls should also account for principals, family members, private enterprises and external advisers. See DSC’s Family Office technology approach.
Secure AI Governance for Family Offices
Family Offices require a particularly considered approach because traditional corporate boundaries often do not apply. The environment may include a principal, multiple generations of a family, investment teams, operating businesses, residences, advisers and external service providers. The information being handled may also be unusually sensitive.
DSC combines long-term Family Office technology experience with managed IT, cybersecurity and Microsoft 365 security, data protection, business continuity and practical technology governance. This means AI is considered as part of the Family Office’s broader technology and risk environment rather than as an isolated application.
Learn more about DSC’s technology services for Family Offices and private enterprises.
Private enterprises and not-for-profits
The same principles apply to private enterprises and not-for-profit organisations, with implementation scaled to their particular information, stakeholders, regulatory environment, resources and risk tolerance. DSC focuses on governance that can actually be operated — clear enough for people to follow, proportionate enough to maintain and integrated with existing technology and cybersecurity controls.
Learn more about DSC’s work with not-for-profit and charity organisations.
Governance aligned with recognised guidance
DSC’s approach is informed by recognised Australian and international guidance, while remaining practical for private organisations. Relevant sources include the Australian Government’s Guidance for AI Adoption, OAIC privacy guidance, ASD/ACSC AI security guidance and the US National Institute of Standards and Technology AI Risk Management Framework.
NIST’s AI Risk Management Framework provides a widely used risk-management foundation for trustworthy AI. NIST has also confirmed that AI RMF 1.0 is being revised, so organisations should treat AI governance as an evolving discipline rather than a one-time compliance project. Read the NIST AI Risk Management Framework.
Frequently asked questions about Secure AI Governance
What is Secure AI Governance?
Secure AI Governance is the combination of policies, responsibilities, technical controls, data-handling rules, vendor assessment and monitoring used to help an organisation adopt AI while managing security, privacy, operational and information risk.
What is Shadow AI?
Shadow AI is the use of AI applications, accounts, integrations or services that have not been formally approved or governed by an organisation.
Should we ban ChatGPT and other AI services?
Usually the more sustainable objective is to establish approved tools and safe use cases, protect sensitive information and give users clear alternatives. The appropriate controls depend on the organisation and its risk profile.
Is Microsoft Copilot automatically safe because we already use Microsoft 365?
No technology should be considered automatically appropriate merely because the organisation already uses the vendor. Configuration, identity, permissions, information architecture, licensing and the intended use case still need to be assessed.
Can employees put confidential information into AI?
That should be determined by organisational policy, the sensitivity of the information, the particular AI service, its contractual and technical controls and the intended use case. Publicly available tools require particular caution.
Do we need an AI policy?
Most organisations adopting AI should establish clear rules covering approved platforms, permitted information, appropriate use, human review, accountability and incident reporting.
Who should be responsible for AI governance?
Responsibility varies between organisations but should be clearly assigned. Effective governance commonly involves executive leadership together with technology, cybersecurity, privacy, risk and relevant business stakeholders.
How does DSC start a Secure AI Governance engagement?
We normally begin by understanding what AI is already being used, what information the organisation needs to protect and what it wants AI to help achieve. From there we develop a practical governance, security and implementation roadmap.