Last updated
What is AI governance and assurance?
AI governance and assurance is the work of showing, to boards, regulators, agency executives and customers, that your AI systems are used responsibly and that the controls around them hold. In Australia that increasingly means aligning to a specific set of government frameworks and producing evidence a reviewer will accept. Ironbark Cyber does that grounded in adversarial testing, so the assurance is honest rather than aspirational.
Which Australian frameworks do you align to?
- Australian Government AI Technical Standard. The Commonwealth's technical baseline for AI systems, security, testing, transparency and monitoring expectations.
- DTA Policy for responsible use of AI in government (v2.0). Accountable officials, transparency statements and mandatory AI Impact Assessments.
- National AI Centre, Guidance for AI Adoption. The voluntary good-practice guidance underpinning responsible AI in the private sector.
- NSW AI Assessment Framework. The assessment expectations for AI use across NSW government.
- Queensland FAIRA. The Foundational Artificial Intelligence Risk Assessment used across Queensland government.
- International anchors. NIST AI RMF, ISO/IEC 42001 and the EU AI Act, mapped in where they matter to your stakeholders.
What does an engagement produce?
- Alignment assessments. A clear read of where a given AI system sits against the AU AI Technical Standard and the relevant state framework, with gaps and actions.
- AI Impact Assessments. Assessments that document risks, affected people, mitigations and oversight to the standard the DTA policy expects.
- Transparency statements. Support producing the public-facing statements government AI use now requires.
- Evidence through testing. LLM penetration testing and red teaming to substantiate security and robustness claims.
- A governance roadmap that ties the above into your existing risk and security processes.
Who is this for?
Commonwealth and state agencies deploying AI; the prime contractors and SMEs who build AI systems for them and must meet the same expectations; and regulated private-sector organisations that want government-grade assurance. If you're a government buyer, our government page covers how to engage Ironbark Cyber directly as an Australian SME.
What does it cost?
Fixed-fee, indicatively from AU$15,000 per system, with programmes scoped individually, quoted within one business day of a scoping call.
FAQ
Frequently asked questions
How much does AI governance and assurance work cost?
Governance and assurance engagements are fixed-fee, quoted within one business day of a scoping call. Cost depends on the number of AI systems and which frameworks you need to satisfy. Indicative pricing is published on this page.
What is the Australian Government AI Technical Standard?
It is the Commonwealth's baseline of technical requirements for AI systems used in government, covering security, transparency, testing and monitoring expectations. Agencies and their suppliers are expected to align to it, and it sits alongside the DTA Policy for responsible use of AI in government, which mandates AI Impact Assessments and accountable officials.
What is an AI Impact Assessment?
An AI Impact Assessment is a structured evaluation of a proposed AI use, its risks, affected people, mitigations and oversight, required under the DTA policy for government AI use and increasingly expected in the private sector. Ironbark Cyber helps you produce assessments that stand up to scrutiny rather than tick a box.
Do you cover state government frameworks?
Yes. We align work to the NSW AI Assessment Framework and Queensland's FAIRA (Foundational Artificial Intelligence Risk Assessment) as well as Commonwealth expectations, so state agencies and their suppliers get assurance in the language their own governance asks for.
Is this the same as ISO 42001 readiness?
Related but distinct. ISO/IEC 42001 readiness targets a certifiable management system. AI governance and assurance is broader and often government-focused: aligning specific AI systems to the AU AI Technical Standard, producing AI Impact Assessments and transparency statements, and evidencing controls. We frequently do both, and map between them.
Do you provide the technical testing to back the assurance?
Yes. Assurance without testing is an opinion. Where a control or an impact assessment claims an AI system is secure, we can prove it with LLM penetration testing or red teaming delivered by the same team.
Contact
Talk to us
Tell us what you're trying to protect, secure or build. We'll come back with a plan.