From AI strategy to AI assurance - built to be defended.
Bouddi helps executives, technology leaders, procurement, risk functions and boards decide what AI to build, what to buy, in what order - and then prove it. Three practices, one discipline: every artefact we deliver is anchored to international standards and designed to survive board, regulator and external audit review.
AI compresses how work gets done - days to minutes, specialist knowledge to scale.
Organisations that get this right reduce cost, increase throughput and surface insights their people never had time to find. Without redesigning the enterprise from scratch.
AI doesn't just accelerate functions - it redefines what those functions exist to do.
Finance moves from reporting to anticipating. Risk from flagging to preventing. Procurement from administering to optimising. Every function asked to do more with the same headcount.
The hardest part of AI isn't the technology. It's the people.
New roles, new accountability structures, new expectations. AI adoption that ignores the human dimension doesn't fail in the model - it fails in the organisation.
Our approach
Built for the people who have to defend the work.
Most AI engagements are written for slides. Ours are written for boards, regulators, auditors, finance and the technology teams that have to make it real. Bouddi is a boutique advisory built around a single conviction: AI work should produce evidence, not artefacts.
One discipline, three offerings
We work upstream and downstream of the AI investment decision. Strategy, roadmap and procurement on the front end; governance, risk, audit and assurance on the back end.
Both practices share the same maturity domains, the same evidence discipline and the same standards anchor. Engagements can run independently or stitched together as one programme.
-
01
Standards-anchored, not framework-dressedEvery recommendation traces to a clause in ISO/IEC 42001:2023, ISO 31000:2018, or the relevant APRA CPS. No proprietary mystery. If you need to align to NIST AI RMF or the EU AI Act, we can do that too.
-
02
Evidence over artefactsProcess maps, control narratives, vendor evaluations, sampling logs - built to satisfy assurance, not to fill a SharePoint site.
-
03
Co-delivered with your business and technology teamsBusiness owners and technology delivery leads in the same room, accountable for the artefacts that come out. No drop-and-leave engagements.
-
04
Tied to your existing risk taxonomyAI risk slots into your enterprise risk framework - operational, conduct, model, third-party, technology - rather than living as an orphaned register.
-
05
Board-ready by defaultEvery engagement produces an executive committee or audit committee pack your sponsor can take into a meeting unedited.
-
06
Built on your work, not over itYour existing process maps, control libraries, audit frameworks, risk registers and policies are the starting point. We inherit, validate, extend and standards-anchor - we only build from scratch where nothing exists.
Services
Three practices. One evidence discipline.
Pick the practice where the heat is highest. Most clients enter at one - often the board education that surfaces the gap, then move into Strategy or Governance to close it.
AI Strategy, Roadmap & Procurement
For executives funding AI work and the technology teams delivering it. We discover how the business actually runs, define the AI investment thesis, sequence the roadmap, and procure the platforms and vendors that will sit underneath it.
- Customer business process discovery and opportunity register
- AI ambition, value framework and use-case portfolio
- Sequenced 12–24 month roadmap with capacity plan
- Build / buy / partner disposition and TCO modelling
- Vendor evaluation, RFP authoring and contract clause library
AI Governance, Risk & Audit
For risk, compliance and audit leaders at ASX-listed and APRA-regulated organisations. We build the AI Management System the regulator, the internal auditor and the audit committee will all sign off - anchored to ISO/IEC 42001 and APRA CPS.
- AI & algorithmic system inventory and risk classification
- D1–D6 maturity baseline and ISO/IEC 42001 Annex A gap analysis
- AIMS design - policy stack, RACI, three-lines model
- 38 Annex A controls implemented and evidenced
- Internal audit dry-run and certification readiness
AI Board & Executive Education
For boards, audit committees and conferences. Three sector-tailored board sessions - regulated industry, general commercial, not-for-profit - plus a 45–60 minute conference keynote on the state of AI governance for business and technologists.
- Regulated industry board: ISO/IEC 42001, APRA CPS, FAR / BEAR director duties
- General commercial board: AI strategy and oversight fundamentals
- Not-for-profit board: AI for mission, ethical use, donor data - 30% of fees donated back
- Conference keynote: state of AI governance for business and technologists
- Pre-read briefing pack and follow-up board paper included
- Built-in giving on board sessions - 10% to a charity of choice (30% for NFPs)
Bouddi engagement methodologies
Two methodologies. One evidence discipline.
Strategy work and Governance work answer different questions, on different timescales, with different deliverables. Bouddi runs each on its own named methodology - same evidence discipline, same D1–D6 anchor, different phase structures so neither is forced to wear the other's clothing. The Bouddi Framing Process sits upstream of both as the universal sketch tool.
AI Board & Executive Education uses session-based formats - half-day, full-day, keynote. It's a different engagement shape, not a phased method.
About
Michael O'Keefe, Principal Consultant.
Michael founded Bouddi to close a specific gap: ANZ executives and boards being asked to make AI investment decisions - and sign off on AI governance arrangements - that no-one had built to be defended.
Twenty-five years across technology governance, regional operating model design, partner compliance oversight and Microsoft cloud - most recently as Senior Director of Asia Partner Sales Excellence at Microsoft. The practice is anchored to ISO/IEC 42001:2023, ISO 31000:2018 and APRA CPS 220, 230 & 234, with working knowledge of NIST AI RMF, VAISS and the National Framework for AI Assurance in Government. AB-731 (AI Transformation Leader) certified; Prosci-certified change practitioner.
- Sydney-based · serving Australia and New Zealand.
Engage
Start with a confidential conversation.
Tell us where the heat is - a vendor decision under time pressure, a roadmap your board isn't buying, an AI governance gap a regulator has flagged. The first thirty minutes are no-obligation and covered by NDA on request.