The governance infrastructure is pre-built. The process is steered by someone who's run the bids.

Australia's Privacy Act ADM obligations come into force December 2026. Every business using AI in a way that affects decisions about people — employees, customers, contractors — needs a documented disclosure position and a board-signed usage policy before that date. This is also the first thing principals and auditors ask for.

The policy builder generates a complete, board-ready AI Ethics and Usage Policy tailored to your organisation, guided by your AI maturity and the sectors you work in. It's not a template you fill in — it's a structured, section-by-section process that produces a document ready for board sign-off and tender submission.

This is the foundation every other layer builds on. Nothing above Layer 1 is possible without it.

The AI6 Guidance is the emerging standard for responsible AI governance in Australian commercial and government contracting. Principals are already referencing it in tender schedules. The six pillars — accountability, transparency, data governance, human oversight, incident management, and training — are what assessors score against in pre-qual.

This system doesn't ask you to build those pillars from scratch. It deploys a pre-configured structure, populated with your business's actual AI use, your vendors, your approval chains, and your data exposure, during the engagement. What comes out the other end is an audit-ready evidence pack your team can maintain without ongoing consultancy.

The DTA's AI Impact Assessment has been mandatory for Commonwealth agencies since December 2025. It is now appearing in tender requirements across defence primes, state government infrastructure projects, and critical infrastructure asset operators. If your AI touches government work, critical infrastructure assets, or decisions affecting your employees, agencies and principals are now requiring it through contract — if you're bidding that work, expect to produce one.

The assessment covers 12 sections across accountability, transparency, fairness, privacy, security, reliability, contestability, and human oversight. It is document-intensive, judgement-heavy, and the risk matrix determines whether a full independent review is required. Done wrong, it creates more exposure than not having one.

The AIIA app guides the full assessment, ingests your existing documentation, and drafts answers traced directly to source passages in your own files. Every suggestion shows exactly where it came from. You accept or reject each one. The AI drafts, never decides.

AI6 and the AIIA cover the core obligations. But for Primes operating across government, defence, and critical infrastructure, there are additional NAIP obligations that sit outside those two frameworks. Layer 4 closes the full picture.

The centrepiece of this layer for bid teams is the Cascade Response Engine. When a principal sends AI compliance requirements — questionnaires, pre-qual schedules, flowdown clauses — down the supply chain, the app ingests them and automatically drafts responses pulled from the stored compliance data built across Layers 1, 2, and 3. Your bid team doesn't start from a blank page. They review, approve, and submit.

This is the layer that turns the governance infrastructure built in Layers 1 through 3 into a commercial asset. The data doesn't sit in registers — it answers tenders.

TenderPulse is not a reporting tool. It is a live compliance operating environment mapped to a specific project and a specific principal's requirements. It shows compliance status across every required artefact, flags gaps before the bid team finds them, and tracks the distance between what the principal is asking for and what the NAIP baseline actually requires.

For bid managers, it replaces the manual compliance chase before submission. For governance teams, it provides the audit trail that builds as the engagement progresses. For boards, it provides attestation evidence that is assembled, not reconstructed after the fact.

The dashboard is configured at the start of the engagement and left running after it closes. Your team maintains it. It doesn't require ongoing consultancy to keep it current.