Q2 2026 · AI Governance posture

Acme Pty Ltd · 84 staff · Accounting · TPB-registered

Prepared by Evisent · Signed off by senior engineer 30 Jun 2026 · For board distribution

Section 1 · Executive Summary

Overall posture — current with one item requiring attention.

Acme's AI footprint is governed, inventoried, and policy-aligned across the four pillars Evisent tracks for every Bundle client. Three pillars are at current status; one (Controls) requires attention due to two Microsoft 365 Copilot licences provisioned since the last quarter that have not yet been wrapped under the Acme AUP. Remediation owner and target date are noted in Section 5.

Inventory14 tools tracked · current

PolicyAUP v3.1 · adopted 4 Apr 2026

Controls2 items requiring attention

ReportingQuarterly cadence · current

Section 2 · AI Inventory

14 AI tools tracked · 12 governed, 2 require attention.

Inventory is refreshed via Microsoft Purview Insider Risk telemetry, M365 audit log analysis, and quarterly manager attestation. New tools detected since the previous quarter are flagged and triaged within ten business days.

Tool	Department	Usage	Status
Anthropic Claude	Leadership · Marketing · Operations	Drafting, summarisation, research	GOVERNED
Microsoft 365 Copilot	Finance · Operations	Excel variance analysis · Outlook drafting	ATTENTION
Copilot Studio	IT	Internal helpdesk agent (pilot)	GOVERNED
GitHub Copilot	IT	Code completion · 4 seats	GOVERNED
Canva AI	Marketing	Image generation, copy refinement	GOVERNED
Apollo AI	Sales · BD	Prospect research, signal scoring	GOVERNED
ChatGPT (consumer)	Sales	Outbound drafting (shadow — see §3)	ATTENTION
7 further tools omitted from sample · full inventory in real Bundle report

Section 3 · Controls posture

Eleven controls in scope. Nine current, two require remediation.

Microsoft Purview, Defender, and Intune controls aligned to Essential Eight ML1 plus the ten guardrails in the Voluntary AI Safety Standard. ISO 42001 mapping cross-references each control to the corresponding clause.

✓AUP enforced via Purview sensitivity-label restrictions on AI tool inputs CURRENT
✓DLP on AI tools PII / financial-data egress blocked at the proxy CURRENT
✓Audit logging all Copilot / Claude / Canva interactions retained 12 months CURRENT
↑Vendor guardrails on M365 Copilot two new licences not yet wrapped under AUP ATTENTION
↑Shadow-AI containment one Sales team ChatGPT consumer use case still open ATTENTION
✓Quarterly attestation managers signed-off inventory at 28 Jun 2026 CURRENT

Section 4 · Framework alignment

ISO 42001 + Voluntary AI Safety Standard · cross-referenced.

Every control above maps to one or more clauses in ISO/IEC 42001:2023 (Information technology — Artificial intelligence — Management system) and the Voluntary AI Safety Standard 2024 (DISR, Commonwealth of Australia). Mapping table omitted from sample — included in full Bundle report. This section is the document a Tier-1 auditor opens first.

Section 5 · Recommended next quarter

Three items · all owned · target date 30 Sep 2026.

Sign-off

Prepared by: Evisent senior engineer · Reviewed by: Evisent principal · Distribution: Acme board (quarterly), Acme COO (operational actions), Evisent client file.