AI policy your board can sign, and your teams will actually use.

Governance, policy, board sessions and ISO/IEC 42001 readiness for Australian companies. Sydney-based, built on fifteen years running the commercial functions this work has to fit.

Book a call Read The Frontier Brief

Roger Hanney presenting — Roger Hanney · Throughline Advisory, Sydney

01 — WHAT'S CHANGING

Three dates worth putting in front of your board.

All three are Australian, and two of them reach companies that have never thought of themselves as AI businesses.

This month National Cabinet Considers the mandatory AI standards framework, after the July reversal from voluntary standards. 10 Dec 2026 Automated decisions, disclosed Privacy policies must set out the personal information used in significant automated decisions. APP 1. Early 2027 Legislation Data-centre energy and water obligations flagged. No text-and-data-mining copyright exemption.

Tracked twice weekly, with sources, in The Frontier Brief.

02 — HOW AN ENGAGEMENT RUNS

Five steps, and it stops wherever it should.

First meeting

45 minutes. What you're using, what's exposed, and whether there's anything here worth doing.

Discovery

Where AI is genuinely in use, including the tools nobody registered, and which of it is regulated.

The session

A working session with the board, risk committee or exec team. Decisions get made in the room.

Deliverables

Policy for your category, with the register, decision trail and review cadence that hold it up.

Ongoing

Standing advisory as the rules move and your use of AI changes, at whatever cadence you need.

ISO/IEC 42001 readiness

The international standard for an AI management system, and it certifies. It shares its structure with ISO 27001, so if you already hold 27001 the risk, incident and audit machinery largely carries across. The policy, register and review cadence from steps 04 and 05 are the same evidence a readiness assessment asks for. If certification turns into a procurement requirement, you aren't starting again.

Where the work warrants it

Training modules built for the specific teams the policy constrains, using your scenarios rather than generic ones. And custom AI tooling built with your people, inside the guardrails you've just set.

03 — QUESTIONS THAT COME UP

What boards actually ask first.

We don't build AI. Does any of this apply to us?

If you use AI to make or materially inform decisions about people — hiring, credit, pricing, claims, rostering — then yes. From 10 December 2026, Australian privacy policies must set out the kinds of personal information used in substantially automated decisions that significantly affect a person's rights or interests. That obligation attaches to the decision, not to whether you consider yourself a technology company.

Who should own AI risk on the board?

In most companies it lands with audit and risk because nobody named an owner. That's a workable answer, but it should be a decision with a date against it rather than a gap. Naming the owner and setting the reporting cadence is usually the first thing a session settles.

Is ISO/IEC 42001 certification worth it yet?

It depends on whether you sell to anyone who will ask for it. Readiness is inexpensive and useful either way, because the policy, risk register and review cadence are the same evidence a readiness assessment wants. Certification itself is a real programme, usually nine to twelve months. If you already hold ISO 27001, much of the risk, incident and audit machinery carries across.

We already wrote an AI policy. Isn't that done?

Policies written in 2024 tend to restrict tools that have since shipped inside Microsoft 365, Google Workspace and the browser by default. A policy that bans what people already have open isn't governance, it's a document. The test is whether it survives contact with a commercial team at quarter-end.

04 — BACKGROUND

Roger Hanney.

$150M

HOKA ANZ omnichannel business, grown from $0

$1.6B

ASX-listed retail group, senior commercial role

15+

Years scaling global brands across ANZ and APAC

MBA

With Distinction, University of Wollongong

I've run pricing, distribution, marketing and supply, and I've built AI into all of them. That's the useful part: I know which clauses a commercial team will work around when the quarter gets tight, and I can write around that before anyone signs.

Worked with HOKA Accent Group Mount to Coast

“The passion, the commitment, the values, the professionalism you showed are extremely rare.” Jean-Luc Diard — Co-founder, HOKA

The full commercial record is on the background page.

05 — THE FRONTIER BRIEF

What moved in AI, and what it means from Sydney.

ISSUE 024 · 8 OCTOBER 2026

Big AI fronted the committee: an apology, a testing deal and a closed door.

Twice a week. Australia and APAC first, then the money, the regulation and the deployments — every figure checked against a dated source.

Read the latest issue RSS

Cover photograph, The Frontier Brief issue 024 — Photo: Dietmar Rabich · CC BY-SA 4.0 · Wikimedia Commons

06 — START

Start with the first meeting.

Forty-five minutes on what you're running and what's exposed. If there's nothing here for you, I'll say so.

Book a call

Mondays and Thursday mornings, AEST.

Board and committee sessions are scheduled around your meeting calendar. Mention it when you book.