Why 83 per cent AI adoption and 21 per cent governance don’t add up for Australian boards
Talk to directors and executives in any Australian organisation today and you will find AI quietly doing work. Drafting reports, summarising meetings, flagging anomalies in data, answering customer queries. Adoption has moved fast, faster than most boards anticipated even two years ago.
What has not kept pace is governance.
The numbers tell the story
Konica Minolta Australia’s new research, The Information Readiness Gap: Data governance, digital transformation, and AI readiness, surveyed 305 IT and business decision-makers and found that 83 per cent of Australian organisations have adopted AI in at least one area of the business. That is not a niche trend. That is the mainstream.
Yet only 21 per cent of those organisations have a formal AI governance or policy framework in place. Just 17 per cent provide structured AI training or data literacy programs for their people. The gap between doing and governing is stark, and it is widening.
The same research points to why this matters operationally, not just theoretically. Forty per cent of organisations identify information scattered across platforms and departments as their biggest information management challenge. Employees are losing between one and five hours a week hunting for information they should already be able to find, which adds up to roughly two to four working weeks per person, per year. AI trained on or working with fragmented, poorly governed information will simply amplify that fragmentation, not fix it.
There is an upside worth naming too. Fifty-seven per cent of organisations expect better information management, data governance and AI capability to reduce operating costs, and 51 per cent expect productivity gains. The opportunity is real. It is the discipline around it that is missing.
Boards are seeing the same gap
This is not an isolated finding. Research from the Governance Institute of Australia, conducted with the Diligent Institute and the Singapore Institute of Directors, found that while 43 per cent of Australian governance leaders have placed AI adoption at the top of their strategic agenda, only 37 per cent of boards have audited their organisation’s current AI usage. Sixty-one per cent have restricted or formally defined employee AI use, well ahead of the regional average, but oversight and verification still lag intent.
The Australian Institute of Company Directors, working with the University of Technology Sydney, has reported similar momentum without matching structure. AI adoption among directors and senior decision-makers has climbed from 64 per cent in 2022 to 90 per cent in its most recent survey. Directors are using AI themselves. What most boards have not yet done is establish the operating model, risk reporting rhythm and accountability structure that should sit underneath that usage.
This is a board-level issue, not an IT one
It is tempting to treat AI governance as a technology problem to be solved by the IT team. It is not. It is an information governance, risk oversight and organisational capability problem, and that places it squarely within the remit of the board and executive leadership.
A governance framework does not need to be elaborate to be effective. At minimum, boards should be able to answer four questions with confidence:
- What information does the organisation hold, and where does it sit?
- Who owns that information and is accountable for its quality?
- What AI tools are in use across the organisation, including tools staff have adopted informally?
- And how is AI-related risk reported to the board, on what schedule, and by whom?
If those questions cannot be answered today, that is the starting point, not a reason to wait.
The legal backdrop directors cannot ignore
There is also a direct legal dimension to this, not just a best-practice one. Section 180 of the Corporations Act 2001 (Cth) requires every director and officer to exercise their powers and discharge their duties with the degree of care and diligence that a reasonable person would exercise in that position, in that company’s circumstances. It is a civil penalty provision, and it applies whether the issue at hand is a financial decision, a cyber incident or, increasingly, the oversight of AI.
Section 180(2) provides a business judgment rule as a defence, but it is a narrow one. It protects a director who makes a business judgment in good faith, for a proper purpose, without a material personal interest, and who informs themselves about the subject matter to the extent they reasonably believe appropriate, holding a rational belief that the judgment serves the company’s best interests. Courts have been clear that this defence covers specific business judgments, not the ongoing duty to monitor and oversee. A director cannot claim the protection of s180(2) for a general failure to ask what AI tools are in use, how they are governed, or what risks they carry.
That distinction matters for boards approving AI adoption or relying on management’s assurance that “AI is under control.” If a board has not informed itself about the organisation’s AI usage, that gap is squarely a s180(1) exposure, and no business judgment defence will reach it. Directors are entitled to rely on management and expert advice, but reliance must be reasonable, and reasonable reliance means asking the right questions and documenting that oversight occurred.
[This is general commentary on directors’ duties, not legal advice. Boards should seek advice specific to their circumstances.]
The practical next step
For boards and executives, the sequence matters. Chasing AI capability before establishing information governance foundations is how organisations end up automating their existing problems faster. Getting the foundations right first, understanding what information exists, who is accountable for it, and how AI use is monitored, is what allows AI adoption to translate into the cost and productivity gains organisations are already expecting.
AI has arrived. The governance must catch up, deliberately and soon.
About: Gary Morgan is a director, board advisor and principal consultant at MPT Innovation Group, specialising in governance, technology strategy, and organisational transformation for private and not-for-profit organisations. He is a Fellow and Member of the Queensland State Council of the Governance Institute of Australia, and an Adjunct Fellow and Member of the Griffith University Industry Advisory Board for the ICT School. Gary publishes regularly on board governance, AI, technology, and cybersecurity.
Acknowledgment: This article represents the author’s independent views and incorporates AI-assisted research and drafting.
Sources:
Konica Minolta Australia. (2026). The Information Readiness Gap: Data governance, digital transformation, and AI readiness
Governance Institute of Australia / Diligent Institute. (2025). Australia’s Boards Embrace AI, But Governance Gaps are Widening
Australian Institute of Company Directors / University of Technology Sydney, (2026). A Director’s Guide to AI Governance
Corporations Act 2001 (Cth). Section 180
English