About Clear Direction AI.

AI inventory

We list every AI system and feature in use, bought or built, including the ones that arrived inside another tool. Each row gets an owner, a business purpose and the data it touches.

The outcome is a list leadership can point at when a customer, an insurer or an auditor asks what the organisation runs.

Classification and materiality

We mark which uses touch personal information, which decide things about people, and which the law actually reaches today. The point is a list short enough to run.

The outcome is a scope your team can operate, instead of a statute book nobody opens.

Decision map

For each in-scope automated decision we record the inputs, the logic, the human hand in it, and the outcome. That record is the raw material for an APP 1 disclosure and for any conversation with a regulator.

The outcome is a map someone outside the build team can read.

Risk register

We record risks against the NIST AI RMF functions — govern, map, measure, manage — each with a treatment, an owner and a review date. The register is reviewed on a cadence, not filed.

The outcome is a living record of what could go wrong, who treats it, and when it is looked at again.

AI management system

We shape scope, policy, objectives, documented procedures, internal audit and management review to ISO/IEC 42001:2023. Certification stays a decision you can make later.

The outcome is a management system your people can run, rather than a rebuild that starts when an assessor arrives.

Controls and evidence pack

We put logging, human oversight, vendor and model review, and change control in place, then export the record. A lawyer, auditor, insurer or customer can read it without you in the room.

The outcome is evidence that still works after we leave.

Board summary

We write one page: what you run, what the law requires, what is missing, who owns it, and what it takes to close the gaps.

The outcome is a position a board can review without sitting through the working papers.

The engagement can end

Scope and fee are agreed before work starts. You can stop after baseline, build, assure or operate, and you keep what was built. The parent company’s public entry is a fixed-scope AI assurance audit — AUD $2,650 in Australia, SGD $2,400 in Singapore, USD $1,830 everywhere else, exclusive of tax — and that fee is credited if you proceed to a build.

A programme from Deloitte or Accenture does not start and stop like that. There is no public multi-year lock on the starting engagement.

The record lives in your tools

The register lives where your team already works. The owners sit in your org chart. We do not rent you a governance platform you have to keep paying for in order to read your own inventory.

Larger agencies in this market exist to staff firms such as DXC, EY and Deloitte. You work with the people who own the record, and you can run it after we are gone.

We are not the assessor

We are not a law firm, a certification body, or an IRAP assessor. Sign-off on your privacy policy stays with your lawyer. An engagement does not award ISO/IEC 42001 or SOC 2.

If the only thing you need is an assessor, we are the wrong firm. We prepare the record an external reviewer can read. We do not sell the certificate as the product.

The duties are Australian

Australia has no AI Act. The duties that already exist are the Privacy Act 1988 and the Australian Privacy Principles, Australian Consumer Law, employment and anti-discrimination law, work health and safety, and APRA’s standards where they apply. APP 1 automated-decision disclosures commence on 10 December 2026.

A global playbook that starts from the EU AI Act misses that list. We map the gap against the law you are actually exposed to.

The build does not move to a second firm

Clear Direction AI is the governance practice. When the fix is technical — what to automate, the architecture, a production system — that work is Cipher Projects, Australian-led, with engineers in Australia and Vietnam.

Deloitte and Accenture sell the transformation programme. The build often moves to a second firm. Here the record and the system sit in one company. You can also stop when the right answer is not to build.

Keith Vaughan, Founder and CEO

Keith leads Cipher Projects. His background is defence, enterprise cloud and managed security across AWS and Azure. The same work now covers AI strategy, the secure systems agents run on, and the governance practice on this site.

Profile · LinkedIn · Keith Associates

Phuong, Operations Manager

Phuong runs operations for Cipher Projects. Phuong is an AI agent. The people on the client work are human, across Australia and Vietnam, under Australian leadership.

Who is on the work

You work with senior consultants. Embedded engineers join when the path is a build at Cipher Projects, typically inside 14 days when a seat is free. The practice does not place a junior bench inside someone else’s programme.

Communication

Write to [email protected], use the form on this site, or book 30 minutes. You work with senior consultants on the governance record. Engineering, when the path is a system, is the same company.

Response time

We reply within 24 hours. Critical support, once a system is live with Cipher Projects, is same day. An embedded engineering team is typically in place within 14 days when that is the path and a seat is free.

Onboarding

The first conversation is what you already run. We say what the law already asks for, what we would put in place first, and whether governance work is the right next step. If it is not, we say so.

If it is, scope and fee are agreed before work starts. Engagements are advisory, project-based, or a standing retainer. Nothing on this site is legal advice.

Turnaround

Baseline inventories the systems, maps the decisions and scores the gaps. Build writes the register, the management system, the controls and the evidence where your team already works. Assure runs internal audit and management review with your people in the meeting, against ISO/IEC 42001:2023. Operate sets the review cadence your team owns.

The parent company’s audit is the fixed-scope first piece when the question is what to build. The build is one figure, agreed after that audit. Maintenance is optional once a system is live. The rate card is on the Cipher Projects pricing page.