Standing Up AI Governance for a University

An Australian university where staff and researchers were rapidly adopting generative AI tools across teaching, administration, and sensitive research, with no central governance.

GenAI use had spread organically across faculties, raising risks around research data, academic integrity, and privacy, with no policy, oversight, or visibility. The university needed to enable AI adoption responsibly rather than ban it, and to align with emerging AI management expectations.

• Inventoried where and how GenAI tools were already being used across the institution.
• Designed an AI governance framework and acceptable-use policy aligned to ISO 42001.
• Defined risk tiers and review gates for student, administrative, and research use.
• Ran enablement sessions so faculties could adopt AI within the guardrails.

• Sensitive research data was being pasted into public consumer AI tools.
• No risk-based distinction existed between low-risk and high-risk AI use.
• Staff wanted to use AI responsibly but had no guidance to follow.

The university adopted a single, practical AI governance framework that lets faculties use GenAI within clear guardrails, turning ungoverned shadow AI into responsible, ISO 42001-aligned adoption.