Broker guide
AI Governance for Mortgage Brokers: A Practical Framework
AI governance is how a brokerage decides which AI tools staff use and how it checks them. A small-business framework, risk assessment and maturity check.
- Published
- Updated
AI governance is how your brokerage decides which AI tools staff can use, who is responsible for them and how their work is checked. Start with an owner and an approved-tool register, then set rules for client data and human review.
A small brokerage can keep the framework on one page, supported by a short assessment for each tool. Give higher-risk uses more scrutiny, especially where an error could affect a client’s lender options or expose their information.
What AI Governance Means
AI governance sets the rules for using AI and assigns people to enforce them. It covers the decision to approve a tool, its everyday use and the point at which you restrict or stop it.
For example, approving AI to draft a general marketing email doesn’t approve it to analyse a client’s payslips. The second task introduces personal information and consequences for a real lending decision.
Without those boundaries, staff make separate decisions about what they can upload and which answers they can rely on. Unapproved use, often called shadow AI, can leave the brokerage without a record of where client information went.
A staff policy explains the rules to employees. The governance framework also names the owner, records approval decisions and checks whether staff follow those rules.
What ASIC Expects
The Australian Securities and Investments Commission (ASIC) expects licensees to consider their existing obligations when deploying AI, including risks created by third-party suppliers. Its Report 798, Beware the gap: Governance arrangements in the face of AI innovation, released in 2024, reviews 23 financial services and credit licensees.
The report examines 624 AI use cases in use or development. It finds that governance sometimes lagged adoption, and some risk assessments focused on the business instead of potential consumer harm.
Only 12 licensees had AI policies referencing fairness or related concepts. Ten had policies referencing disclosure of AI use to affected consumers. These are findings about the reviewed licensees, not a measure of every brokerage.
ASIC’s response to the review urges licensees to keep governance ahead of expanding AI use. If you operate as a credit representative, involve your licensee in the approval process.
The framework below is recommended practice drawn from that review and the government’s Voluntary AI Safety Standard. It isn’t a prescribed legal checklist. The government evolved the standard into its Guidance for AI Adoption in 2025.
A Simple AI Governance Framework
A brokerage’s AI governance framework can fit on one page if each rule has an owner and a record showing how it works. Use the National AI Centre’s foundations guidance to build controls that fit your brokerage’s size and use of AI.
| Framework part | What to record | What staff do |
|---|---|---|
| Accountable owner | Name a senior person who can approve, restrict and stop AI use. Nominate a backup. | Bring new uses and incidents to that person. |
| Approved tools | List each tool, approved account or plan, permitted task and data restrictions. Include AI embedded in existing software. | Use only the approved account for the listed tasks. |
| Staff rules | State permitted inputs, required output checks and prohibited actions. | Follow the policy before uploading information or using an answer. |
| Checks | Record who checks outputs and how the brokerage samples completed work. | Keep evidence of the check with the relevant file. |
| Review | Set the next review and triggers such as changed terms, integrations or an incident. | Report changes before extending a tool’s use. |
Put the owner and tool register in place first. Assess each use before approval, brief staff on the resulting rules and review a sample of their work after rollout.
For lender-policy research, name the evidence the reviewer must inspect. Bulma quotes the lender’s policy wording behind each answer, which the broker can retain with the file notes. The broker still checks that the wording applies to the client’s circumstances.
Assess the Risk of Each AI Tool
Assess a specific task in a specific tool, because the same software can create different risks depending on its inputs and permissions. Copy this AI risk assessment template into your tool register and complete it before approval.
| Assessment field | What to record |
|---|---|
| Tool and task | The product, account, responsible person and exact task staff want it to perform. |
| Data entered | Whether the task needs public material, client information or sensitive information. Identify the minimum input. |
| Vendor terms | Whether inputs or outputs train models, how long data remains and who can access it. Record storage locations and subcontractor arrangements. |
| Error impact | What happens if the answer is wrong, incomplete or unfair. Name the affected client or staff group. |
| Controls | The source check, access restrictions and human approval needed before an output is used. |
| Decision | Approve, restrict or reject the use. Record remaining risks, the approver and the next review trigger. |
Rate the likelihood and consequence of each identified harm using your existing risk method. Reassess the risk after controls, then record whether the owner accepts what remains. Don’t approve a task whose risks your brokerage cannot control.
In a hypothetical assessment, a broker wants AI to summarise a client meeting. A missed qualification could turn a tentative intention into a recorded fact. Require the broker to compare the draft with the original record before saving it, and separately assess recording permission and data access.
An AI agent that can send messages or change client records needs controls over those actions too. Limit its permissions and require approval before consequential actions. The National AI Centre’s implementation guidance covers more complex and higher-risk uses.
Check Your AI Readiness
Check readiness by asking whether your brokerage can demonstrate each control in practice. Use this suggested internal score for each item: 0 if absent, 1 if documented and 2 if demonstrated in a recent check.
- We know which AI tools staff use, including features inside other software.
- Each approved use has a named owner and written limits.
- Staff can identify the information they may enter.
- We have assessed vendor data handling and access.
- A reviewer checks outputs before they affect client work.
- Staff know how to report an error or data incident.
- We can pause a tool and continue the work another way.
- Reviews lead to recorded changes when a control fails.
Add the eight scores for a total out of 16. Use the total to track progress within your brokerage, not as certification or proof of compliance. Fix any zero involving client data or consequential outputs before expanding that use.
An AI readiness assessment identifies what must be in place before a use starts. An AI maturity assessment asks whether those controls keep working over time. Repeat the checklist after material changes and compare evidence, not just totals.
Govern Data Used With AI
AI data governance controls which information enters a tool, where it goes and who can see the resulting output. Apply the same scrutiny to an AI-generated client summary as to the original client record.
The Office of the Australian Information Commissioner (OAIC) recommends keeping personal information out of publicly available generative AI tools, particularly sensitive information. Its guidance also explains privacy obligations for personal information in AI inputs and outputs.
Set a default rule that public AI tools receive public material or fictional examples. An approved business tool needs a separate assessment before it receives client information. Removing a name alone doesn’t establish that a detailed borrower scenario is de-identified.
Record storage locations and any overseas handling in the assessment. Identify vendor access, model-training permissions and retention settings. Decide who may see shared histories or exported outputs, and remove access when a staff member leaves.
Keep the approved output and its review evidence in the correct client file under your retention rules. For each approved tool, make sure a staff member can explain what they may upload and who checks the result. If either answer is unclear, resolve it before the next client use.
