Bouddi helps risk, compliance and audit leaders build AI governance that withstands regulator review, internal audit and the next material incident - anchored to ISO/IEC 42001:2023, ISO 31000:2018 and APRA CPS 220, 230 & 234.
Most AI governance engagements are written for slides. Ours are written for auditors. Bouddi's governance practice is built around a single conviction: AI governance should produce evidence, not artefacts.
Chief Risk Officers, Heads of Compliance, Internal Audit, and Audit Committee Chairs at ASX-listed and APRA-regulated organisations across Australia and New Zealand - plus the boards and executives who sit above them.
Every artefact we deliver - your AI inventory, your Statement of Applicability, your control narratives - is designed to survive external assurance and stand up in front of a regulator.
And where you already have control libraries, audit frameworks, risk registers, ISMS documentation or policy stacks, we extend them rather than replace them - your existing work is the starting point. We only build from scratch where nothing exists.
Most clients enter at the diagnostic and move into roadmap or implementation once the gap picture is clear. Each tier produces signed-off, evidence-grade deliverables. Indicative pricing is available in the Prospective Clients area.
The Bouddi Governance Method is the engagement methodology behind every governance deliverable. Phases sequence the work; D1–D6 maturity domains measure where you are and where you need to be. The full methodology - phases, deliverables per phase, named audiences and the bridge to the Strategy practice - lives at The Bouddi Governance Method.
Each domain is scored 1 (Unaware) to 5 (Leading). Movement across domains drives the roadmap.
Short, standards-anchored briefings written for risk, audit and board audiences. No vendor pitches, no AI evangelism - just what's working and what's failing on the ground in ANZ.
A working interpretation of CPS 230's tolerance levels and Material Service Provider obligations when a model - not a vendor - sits inside a critical operation. With worked examples across credit decisioning and claims triage.
Annex A's 38 controls overlap heavily with ISO 27001, NIST AI RMF and your enterprise risk framework. A practical crosswalk that lets you absorb 42001 into the controls you already test, instead of running parallel registers.
What ACs are actually asking in 2026 - completeness, classification rationale, vendor concentration, incident readiness, and director-level accountability - and how to answer each with evidence rather than narrative.
The first 30 minutes are no-obligation and covered by NDA on request. We'll discuss your current AI footprint, your regulatory perimeter, and where a diagnostic would land you in 4–8 weeks.
