Insights
Product, design, AI, and engineering perspectives from our team.
AI Content Provenance and Disclosure Standards Explained
Content provenance standards like C2PA record how AI-generated content was made, but Australia has no mandatory disclosure law — only voluntary guidance and existing consumer protection obligations. Here's what that actually means for shipping teams.
AI Centre of Excellence: Three Models and How to Choose
There are three real operating models for an AI Centre of Excellence — centralised, federated, and hub-and-spoke — and the right one depends on how many AI initiatives you're running, how mature your business units are, and how much central governance you're willing to fund. This article breaks down each model's trade-offs and how to choose.
Choosing an Enterprise AI Platform: Bedrock vs Azure vs Vertex
Choosing an AI platform is a governance and architecture decision, not just a model choice. We compare AWS Bedrock, Azure AI Foundry, and Google Vertex AI on governance tooling, cost structure, and vendor lock-in — and are upfront about where public documentation runs thin.
CPS 230 and AI Vendor Dependency Mapping for Financial Services
APRA's CPS 230 standard, effective from July 2025, requires regulated entities to map dependencies on critical operations — and AI vendors are increasingly part of that picture. Here's how financial services firms can approach AI vendor and model dependency mapping as part of operational resilience planning.
ISO/IEC 42001 Certification: A Guide for Australian Firms
ISO/IEC 42001 is the first certifiable international standard for AI management systems. This guide explains what it requires, how it compares to Australia's Voluntary AI Safety Standard and the EU AI Act, and what to have in place before pursuing certification.
Shadow AI Usage Policies: A Guide for Tech Leaders
Unsanctioned AI tools are already inside your engineering and product teams, whether or not anyone has approved them. Here's how technology and business leaders can identify shadow AI use and build governance that reduces risk without killing productivity.
Cyber Insurance for AI Products: What's Covered, What's Not
Cyber policies generally cover AI-related security incidents but often exclude model performance failures like hallucinations or biased outputs. Here's how CTOs and business leaders should map that gap with their broker.
AI Vendor Risk: Contracts, SLAs & Liability for AI Features
Embedding third-party AI into your product introduces risks that standard SaaS contracts and SLAs were never designed to cover. Here's what technology and business leaders need to check before they sign.
AI Vendor Risk Management: Contracts, SLAs & Liability
Embedding a third-party AI model changes your risk exposure in ways standard SaaS contracts don't cover. Here's what actually needs to be in the agreement — from SLAs to indemnity to data handling.