One named executive, the Chief Commercial Officer, is accountable for AI governance as a whole: how it is run, how risks and incidents are handled, and every customer-facing AI disclosure.
AI governance at Drova
Every AI system has a named owner, a risk assessment and a review date before it reaches a customer.
Drova's AI does real governance work for customers, so the AI itself is governed with the same rigour: a named executive accountable for it, a risk assessment before any system is deployed, a scheduled review afterwards, and a written policy you can ask for.
Doing your due diligence? Good.
Leave your work email and we will come back to you with the certificate, policies and answers your IT or procurement review needs.
Accountability at every level
Responsibility for AI is shared across the company, and each part of it has a named owner.
The CEO and the Head of Product and Strategy set the direction for AI across the platform, so that what we build follows the responsible AI principles.
Every AI use case is approved before it reaches customers, and new AI features get an impact assessment first.
The engineering leads build and run the technical controls, test for bias during development, document model design and data sources, and keep the AI systems register.
Leadership approves the policy, sets the risk appetite, and reviews AI risk, incidents and audit findings on a schedule.
The policy applies to all staff: no AI tool is used for Drova work without approval, and concerns are raised through internal channels.
Assessment and register
How an AI system gets approved
Every AI system is risk-assessed before deployment and at intervals after it, using the same risk framework as the rest of the business. Each assessment covers eight areas:
- Bias and fairness. Whether outcomes could discriminate, and whether the training data is representative.
- Transparency and explainability. Whether a decision can be explained to the people it affects.
- Privacy and data protection. What data is used for training and inference, against GDPR, the Australian Privacy Act and customer contracts.
- Security. Exposure to adversarial attacks, prompt injection, data poisoning and model theft, aligned to our ISO 27001 controls.
- Accuracy and reliability. Performance metrics, error rates, hallucination risk and drift.
- Legal and regulatory. The EU AI Act, the Australian AI Ethics Framework and contractual obligations.
- Reputational. What a failure or misuse would mean for Drova and its customers.
- Operational. Dependence on third-party AI services, continuity, and the human oversight required.
Every system is then recorded in the AI systems register with its purpose, owner, risk rating, data sources, third-party dependencies, customer impact, deployment status and the dates of its last and next review. The register is kept by the engineering leads and reviewed quarterly by the Chief Commercial Officer.
Transparency
What customers are told
Transparency with customers is written into the policy as a commitment.
- Which features use AI, and what kind. Customers are told where AI is used in the platform and whether it is generating, classifying or recommending.
- AI output is identified. Customer-facing documentation states where AI-generated content is used and its limits, and AI-generated output is labelled where appropriate.
- A published AI FAQ. The policy commits Drova to a customer-facing AI FAQ, approved by the Chief Commercial Officer before it goes out and updated when AI capabilities or governance change materially. Ours is the Your questions answered page.
- Contracts say what AI does. Where AI features are in a contract, their scope, limits and data handling are documented, and APRA and ASIC regulated customers receive the additional disclosures their frameworks require.
Third-party AI providers
Every external AI service in the platform is held to the same four conditions.
A provider's AI governance, data handling and security posture are assessed before it is procured.
Data processing agreements, confidentiality obligations and right-to-audit clauses. The providers are named on our subprocessor list.
Each provider's performance, security and compliance are reviewed periodically.
Providers are contractually required to tell Drova about AI incidents that affect our data or our customers.
Bias, incidents and ongoing oversight
Approval is the start. These six things keep it honest afterwards.
Training data and outputs are checked for bias at design, in development and in production. Customers can report a perceived bias and it is investigated within a defined timeframe.
AI incidents run through Drova's incident management process: classified by severity, root-caused across model, data and controls, reported to the accountable executive and, where required, to leadership, with lessons fed back into the risk assessment.
Performance is tracked against accuracy, fairness, reliability and security metrics. Higher-risk systems have dashboards and alerts, and model drift is tracked and addressed.
The AI management system is audited as part of the ISO 27001 audit programme, including the accuracy of the register.
AI governance is a standing item at leadership management reviews, covering risk changes, incident trends, audit findings and regulatory developments.
All staff get AI governance training at onboarding and annually. People who build or run AI get role-specific training on responsible AI and bias.
Document
The policy
The Drova AI Governance Policy, version 1.0, took effect in July 2026. The Chief Commercial Officer is accountable for it. It was approved by the Security and Compliance Committee and signed off by the CEO and the CCO, and is reviewed annually or sooner if an audit finding, incident, new regulation or major change to our AI capabilities calls for it. Changes are approved at CEO level.
It is built on ISO/IEC 42001, the AI management system standard, and sits inside our ISO/IEC 27001 certified management system. Certifications and compliance lists everything we are certified to and build to, including where ISO/IEC 42001 certification stands.
The policy is available to customers on request. If AI governance is new to you, our AI governance explainer covers what it means for any organisation.
Start a free trial, or tell us what your review needs.
See it for yourself
Trust Centre
More from Drova's Trust Centre
AI trust
How our AI works, what it does with your data, and the safeguards in place.
Your questions answered
Security, privacy, compliance and AI questions, answered plainly.
Certifications and compliance
What we are certified to, and what we build to.
Security
Encryption, access, regional deployment and logging.
Privacy
What personal data we process and why, and how requests work.
