A1 launches Guardrails for mid-market AI governance

A1 Technologies launched Guardrails on Monday, November 9, 2026, for mid-market organisations in Australia and New Zealand. The AI security and governance service targets risks attached to applications and AI agents already entering business workflows.

The launch comes as the Australian Prudential Regulation Authority has raised concerns about weaknesses in governance, accountability, monitoring and information security. A1 also cites new Privacy Act transparency obligations that will require relevant organisations to include information about certain computer-assisted decisions involving personal information in their privacy policies.

A1 frames those pressures as a reason to treat AI oversight as an executive compliance question, not an IT purchasing decision alone. It says Guardrails turns scattered AI use into a recurring control process.

What problem is Guardrails built to solve?

A1 says Guardrails covers AI use inside Microsoft environments and in third-party tools outside centrally managed systems. The service is designed to manage risk around both applications and AI agents.

A1 says employees may already be using ChatGPT, Claude and Gemini. Teams may also build agents through platforms including Copilot Studio and Microsoft Foundry.

According to A1, that mix can include approved and unapproved tools. It raises three practical questions: what each system can access, where sensitive information goes, and who oversees its activity.

For A1, formal approval covers only the tools an organisation can see and administer. Unapproved use can continue outside that central view, widening the gap between policy and practice.

Guardrails responds through a quarterly process covering discovery, governance, management and reporting. The core problem is visibility, not simply permission to buy AI.

How does the quarterly review work?

Each engagement begins with a fixed-price survey. A1 says the survey produces a Compliance Score measuring how much of an organisation's AI use is known, owned, controlled and recorded.

The score gets reviewed each quarter. In A1's model, the fixed starting engagement becomes part of a recurring control cycle instead of a one-off technology assessment.

A1 divides the service into four stages:

• Discovery: identify AI applications and agents, assess readiness, review overshared data and establish AI system registers.
• Governance: define AI policies, acceptable use requirements, governance responsibilities, agent lifecycle management and employee guidance.
• Management: use Microsoft Defender to identify and control AI applications, Purview to protect sensitive information, and Agent 365 to oversee agent identities, access and activity.
• Reporting: provide executive updates, risk reviews, AI usage and data security reporting, and agent lifecycle oversight.

Discovery identifies what exists. Governance defines acceptable use. Management enforces access and monitoring, while reporting turns the findings into evidence for executives.

Each review is meant to show who owns AI and what it can reach. The score turns those answers into a quarterly record for management.

Why is governance moving beyond IT?

A1 says responsibility for AI governance now extends beyond IT and security teams. It increasingly sits with executives, risk, compliance and business leaders as AI becomes part of day-to-day business processes.

Rob Rattray, Director, A1 Technologies, said:

“AI use is moving faster than many organisations' ability to govern it. The conversation is no longer only about deploying Copilot or approving a particular AI platform.”

“Businesses need to understand what AI is already being used across their environment, what information it can access, and who is accountable for managing that risk. We've formalised this service because AI security and governance need to be managed as an ongoing business responsibility, not treated as a one-off technology project.”

In A1's account, approval is only one part of the control. The wider job is to identify every tool, inspect its access and assign responsibility.

That broader remit matters because tool use can start before a formal approval process catches it. The business needs an owner for each system and a record of its reach.

Oversight now belongs with the leaders who answer for business risk.

Why target mid-market organisations?

A1 says mid-market organisations face the same regulatory and security questions as larger companies. They often have fewer internal resources dedicated to AI governance.

The company positions Guardrails around a recurring review cycle. A1 says this makes AI oversight part of regular compliance rather than a one-off technology assessment.

Rattray said:

“Those leaders are now fielding questions from regulators, insurers and customers about how AI is used. They need to know what AI is running, who owns it and what it is allowed to do, with rules employees can apply day to day.”

“Guardrails gives them that evidence every quarter.”

For A1, the quarterly evidence answers practical questions from regulators, insurers and customers. It also gives business leaders a record they can use when explaining internal AI use.

The practical takeaway is that smaller teams need recurring evidence, even when governance staffing stays thin.

Why does oversight need to continue?

A1 argues the main challenge extends beyond the initial rollout of AI tools. Organisations need a repeatable way to identify new uses, track ownership and control connections between AI tools and internal systems.

Clint Shiels, Technical Director, A1 Technologies, said:

“The biggest gap is often governance and ongoing visibility of changes. Organisations may have focused on the initial securing of an AI platform but have not defined a process to discover new or changes in AI use, who owns an AI platform for development and what that platform should be allowed to connect to.”

“We see this as an ongoing compliance requirement to manage functionality and data security.”

A1 positions Guardrails as an extension of its work hardening Microsoft 365 environments and meeting Purview compliance requirements. It applies that background to AI discovery, access permissions, data exposure and agent activity.

The emphasis falls on what changes after launch. A controlled platform can still gain new functions, users or connections, so A1 treats each change as part of compliance.

The lasting control is the quarterly refresh, not the first launch review.

What will decide whether Guardrails works?

Under A1's model, each quarterly review checks whether the organisation's AI use remains known, owned, controlled and recorded. That means finding new tools, assigning ownership and checking which internal systems each agent can reach.

The reporting stage turns those checks into executive updates, risk reviews, AI usage and data security reporting, and agent lifecycle oversight. A1 says leaders can use that record when regulators, insurers or customers ask how AI is used.

For mid-market firms, the coming test is whether quarterly evidence can keep pace with every new agent, connection and access change.