Q2 2026 · AI Governance posture
Acme Pty Ltd · 84 staff · Accounting · TPB-registered
Prepared by Evisent · Signed off by senior engineer 30 Jun 2026 · For board distribution
Section 1 · Executive Summary
Overall posture — current with one item requiring attention.
Acme's AI footprint is governed, inventoried, and policy-aligned across the four pillars Evisent tracks for every Bundle client. Three pillars are at current status; one (Controls) requires attention due to two Microsoft 365 Copilot licences provisioned since the last quarter that have not yet been wrapped under the Acme AUP. Remediation owner and target date are noted in Section 5.
Inventory 14 tools tracked · current
Policy AUP v3.1 · adopted 4 Apr 2026
Controls 2 items requiring attention
Reporting Quarterly cadence · current
Section 2 · AI Inventory
14 AI tools tracked · 12 governed, 2 require attention.
Inventory is refreshed via Microsoft Purview Insider Risk telemetry, M365 audit log analysis, and quarterly manager attestation. New tools detected since the previous quarter are flagged and triaged within ten business days.
| Tool | Department | Usage | Status |
|---|---|---|---|
| Anthropic Claude | Leadership · Marketing · Operations | Drafting, summarisation, research | GOVERNED |
| Microsoft 365 Copilot | Finance · Operations | Excel variance analysis · Outlook drafting | ATTENTION |
| Copilot Studio | IT | Internal helpdesk agent (pilot) | GOVERNED |
| GitHub Copilot | IT | Code completion · 4 seats | GOVERNED |
| Canva AI | Marketing | Image generation, copy refinement | GOVERNED |
| Apollo AI | Sales · BD | Prospect research, signal scoring | GOVERNED |
| ChatGPT (consumer) | Sales | Outbound drafting (shadow — see §3) | ATTENTION |
| 7 further tools omitted from sample · full inventory in real Bundle report |
Section 3 · Controls posture
Eleven controls in scope. Nine current, two require remediation.
Microsoft Purview, Defender, and Intune controls aligned to Essential Eight ML1 plus the ten guardrails in the Voluntary AI Safety Standard. ISO 42001 mapping cross-references each control to the corresponding clause.
- ✓ AUP enforced via Purview sensitivity-label restrictions on AI tool inputs CURRENT
- ✓ DLP on AI tools PII / financial-data egress blocked at the proxy CURRENT
- ✓ Audit logging all Copilot / Claude / Canva interactions retained 12 months CURRENT
- ↑ Vendor guardrails on M365 Copilot two new licences not yet wrapped under AUP ATTENTION
- ↑ Shadow-AI containment one Sales team ChatGPT consumer use case still open ATTENTION
- ✓ Quarterly attestation managers signed-off inventory at 28 Jun 2026 CURRENT
Section 4 · Framework alignment
ISO 42001 + Voluntary AI Safety Standard · cross-referenced.
Every control above maps to one or more clauses in ISO/IEC 42001:2023 (Information technology — Artificial intelligence — Management system) and the Voluntary AI Safety Standard 2024 (DISR, Commonwealth of Australia). Mapping table omitted from sample — included in full Bundle report. This section is the document a Tier-1 auditor opens first.
Section 5 · Recommended next quarter
Three items · all owned · target date 30 Sep 2026.
- Wrap the two new M365 Copilot licences under the AUP. Configuration change in Purview; ~30 minutes. Owner: Evisent. Target: 31 Jul 2026.
- Resolve the Sales-team shadow ChatGPT use case. Migrate to governed Claude API access via the existing Bundle entitlement. Owner: Evisent + Acme Sales Director. Target: 31 Aug 2026.
- Refresh the AUP for the new ASIC AI guidance (May 2026). Light revision — three paragraphs in §4.2. Owner: Evisent. Board-readable diff supplied. Target: 30 Sep 2026.
Sign-off
Prepared by: Evisent senior engineer · Reviewed by: Evisent principal · Distribution: Acme board (quarterly), Acme COO (operational actions), Evisent client file.