GOV-08 · Govern

Executive artificial intelligence accountability

The board of directors or executive committee is accountable for ensuring that artificial intelligence is secure, controllable, human-supervised and used in an ethical and accountable manner.

Enterprise IT actions

• IT.GOV-08.1

  Establish and maintain executive accountability for the use, governance and risk management of artificial intelligence within the organisation.

  • Every phaseGovernance and culture
  ASD’s indicators

  Not effective

  • No named executive is accountable for the use, governance or risk management of artificial intelligence.
  • Artificial intelligence is used within the organisation with no approval, risk assessment or oversight.
  • Artificial intelligence related risks are not reflected in the organisation's risk register.
  • Artificial intelligence use and governance arrangements have not been reviewed within the schedule defined by the organisation.

  Partially effective

  • A named executive is accountable for artificial intelligence but the governance process is informal or undocumented.
  • Approval and risk assessment occur for some artificial intelligence use cases but coverage is inconsistent across internally developed, third-party and embedded artificial intelligence.
  • Some artificial intelligence related risks are recorded but the organisation's risk register does not capture all known artificial intelligence use cases.
  • Reviews occur within the schedule defined by the organisation, but do not consistently address changes in artificial intelligence capability, threat environment or organisational use.

  Fully effective

  • A named executive has accountability for artificial intelligence, supported by an approved governance process that has evidence of being followed.
  • The governance process addresses approval, risk assessment and oversight for internally developed, third-party and embedded artificial intelligence use cases.
  • Artificial intelligence related risks are reflected in the organisation's risk register and reported through standard governance channels.
  • Reviews of artificial intelligence use and governance arrangements are conducted on a schedule defined by the organisation and consistently address changes in artificial intelligence capability, threat environment or organisational use.
  Related frameworks

  ISM

  ISM-1998, ISM-2002, ISM-2074

  NIST CSF 2.0

  GV.OC-01, GV.RR-01, GV.RR-02, GV.RM-06

  NIST SP 800-171r3

  03.15.01, 03.11.01, 03.04.08

  AESCSF v2

  PROGRAM-2a, PROGRAM-2c, RISK-1c, RISK-2a

  Rate this action in the Navigator →

Operational technology actions

• Action 1

  Establish and maintain executive accountability for the use, governance and risk management of artificial intelligence within the organisation.

  • Every phaseGovernance and culture
  Rate this action in the Navigator →

Cloud actions

• Action 1

  Establish and maintain executive accountability for the use, governance and risk management of artificial intelligence within the organisation.

  • Every phaseGovernance and culture
  • ResponsibilityPaaS: Customer, SaaS: Customer
  Rate this action in the Navigator →
• Action 2

  Require executive or delegate approval before enabling material SaaS or PaaS AI functions, including review of accessible data, permissions, retention, logging, agents and connectors.

  • Every phaseGovernance and culture
  • ResponsibilityPaaS: Customer, SaaS: Customer
  Rate this action in the Navigator →

Open the Navigator →

More Govern principles

• GOV-01Executive cyber security accountability
• GOV-03Security risk management assurance
• GOV-04Cyber security resourcing
• GOV-07Continuous cyber security improvement
• GOV-09Security risk management responsibilities
• GOV-10System exposure minimisation
• GOV-11Supplier cyber security assurance
• GOV-14Legacy system management

Source: ASD Essentials for enterprise IT, version 2026.10.15; ASD Essentials for operational technology, version 2026.10.15; ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.