A1 launches AI governance service for mid-market firms

A1 Technologies has launched Guardrails, an AI security and governance service for mid-market organisations in Australia and New Zealand. It is designed to manage risks linked to AI applications and AI agents.

The launch comes as scrutiny of AI governance increases, including concerns from the Australian Prudential Regulation Authority about weaknesses in governance, accountability, monitoring and information security.

Guardrails focuses on AI use inside Microsoft environments and in third-party tools outside centrally managed systems. Employees may already be using applications such as ChatGPT, Claude and Gemini, while organisations are also building AI agents through platforms including Copilot Studio and Microsoft Foundry.

That mix of approved and unapproved tools can raise questions about access permissions, sensitive data and oversight. A1 says the new service is intended to address those issues through a quarterly process covering discovery, governance, management and reporting.

Under the model, organisations first identify AI applications and agents, assess readiness, review overshared data and establish AI system registers. The governance stage covers AI policies, acceptable use requirements, governance responsibilities, agent lifecycle management and employee guidance.

The management phase uses Microsoft Defender to identify and control AI applications, Purview to protect sensitive information, and Agent 365 to support oversight of agent identities, access and activity. Reporting includes executive updates, risk reviews, AI usage and data security reporting, and agent lifecycle oversight.

Engagements begin with a fixed-price survey that produces what A1 calls a Compliance Score. A1 says the score measures how much of an organisation's AI use is known, owned, controlled and recorded, and is reviewed each quarter.

Governance Pressure

The move reflects a broader shift in how organisations are approaching AI oversight. Alongside APRA's concerns, new Privacy Act transparency obligations will require relevant organisations to include in their privacy policies information about certain computer-assisted decisions involving personal information.

A1 says responsibility for AI governance is moving beyond IT and security teams and increasingly sits with executives, risk, compliance and business leaders. That reflects the growing use of AI tools in day-to-day business processes and the need to account for how those tools are deployed and monitored.

"AI use is moving faster than many organisations' ability to govern it. The conversation is no longer only about deploying Copilot or approving a particular AI platform. Businesses need to understand what AI is already being used across their environment, what information it can access, and who is accountable for managing that risk. We've formalised this service because AI security and governance need to be managed as an ongoing business responsibility, not treated as a one-off technology project," said Rob Rattray, Director, A1 Technologies.

The service is positioned as an extension of A1's work in Microsoft 365 environment hardening and Purview compliance. It applies that background to AI discovery, access permissions, data exposure and agent activity.

Ongoing Oversight

A1 argues that the main challenge is not limited to the initial rollout of AI tools. It also depends on whether organisations have a repeatable process for identifying new AI use, tracking ownership and controlling connections between AI tools and internal systems.

"The biggest gap is often governance and ongoing visibility of changes. Organisations may have focused on the initial securing of an AI platform but have not defined a process to discover new or changes in AI use, who owns an AI platform for development and what that platform should be allowed to connect to. We see this as an ongoing compliance requirement to manage functionality and data security," said Clint Shiels, Technical Director, A1 Technologies.

The service is aimed at mid-market organisations across Australia and New Zealand, a segment that often faces the same regulatory and security questions as larger companies but has fewer internal resources dedicated to AI governance. By centring the service on a recurring review cycle, A1 is seeking to make AI oversight part of a regular compliance process rather than a one-off technology assessment.

Rattray said the pressure is now coming from several directions as AI becomes more widely used across business functions.

"Those leaders are now fielding questions from regulators, insurers and customers about how AI is used. They need to know what AI is running, who owns it and what it is allowed to do, with rules employees can apply day to day. Guardrails gives them that evidence every quarter," said Rattray.