AI risk assessment, for organisations that publish

What's inside

• AI use-case inventory — every place AI touches your work, who owns it, and what goes in and out.
• Accountability and governance — a named owner, a policy people can find, a register of tools.
• Data, IP and vendors — what you're sending to whom, who owns the output, and whether your inputs were cleared.
• Content provenance and disclosure — labelling, Content Credentials (C2PA), and EU AI Act transparency.
• Human oversight — what gets checked by a person before it's published or sent.
• People, likeness and culture — consent for real people's faces and voices, and cultural protocols.
• A scored risk register — likelihood by impact, with owners, mitigations and dates.

Who it's for

Teams that put content into the world — government communications and digital teams, galleries, museums and libraries, broadcasters and publishers, agencies and in-house studios. The questions are written for people who make things, not for a compliance department.

Why now

EU AI Act transparency obligations for AI-generated content have applied since August 2026. Australian Government agencies face mandatory AI requirements, with full compliance due by December 2026. And Content Credentials are becoming visible to audiences in the tools they already use.

Most organisations don't yet have a clear picture of where AI is already in their work. That's where this starts.

General guidance, not legal advice. It draws on Australia's Voluntary AI Safety Standard, the EU AI Act's transparency obligations and the C2PA standard.