Quick verdict
A Power Day is a one-day working session that leaves the organisation with a living AI inventory and evidence record: systems, owners, data, vendors, risk tiers, and the first pack counsel can use for the 10 December 2026 privacy-policy work. A Power Hour is the onboarding that puts the system and the right people in place before that day.
You do not walk out “compliant”. You walk out able to answer “what AI do we use, who owns it, what data it touches, and what we have not yet assessed.” That is the difference between a policy and an accountability layer. Europe already buys this shape of product because the EU AI Act made evidence expensive. Australia and Singapore are now asking the same question without copying the Act.
Best for: companies that already use AI and cannot produce the register. Honest limit: we are not an assessor, not a law firm, and not an ISO 42001 certification body. A day will not replace a material-system audit in an APRA-regulated bank.
Last updated: 31 August 2026. Clear Direction AI is the Cipher Projects governance practice. The engineering studio is the same company that already sees how AI actually lands in production.
What do we walk out with after six hours?
A populated register, named owners, a risk-tiered backlog, vendor rows with residency and training-opt-out status, and an export. You also walk out with a written list of gaps. The gaps are the point. A day that claims completeness is a day that lied.
Power Hour vs Power Day
| Power Hour | Power Day | |
|---|---|---|
| Length | Onboarding session | One working day (we budget six focused hours plus a short wrap) |
| Job | Stand up the evidence system, accounts, roles, and the hunt list | Fill the register from SSO, spend, vendors and the people in the room |
| Who must attend | Sponsor + one operator | Sponsor, privacy or legal, IT/security, and a lead from each function that uses AI |
| Output | Empty structure, access, first ten suspected rows | Living record + gap list + counsel-ready export |
| Not included | Legal opinions | Certification, privacy-policy publication, model red-teaming of every system |
Book the Hour first if the organisation cannot name owners. Booking a Day with no owners produces a slide deck that nobody updates.
The six hours, in order
- Hour 1 — hunt. SSO apps, expense merchants, API keys, vendor release notes. This is always longer than people expect.
- Hour 2 — confirm rows. Each function answers: what do you paste in, and what writes back to a system of record?
- Hour 3 — data and vendors. Personal information, destination, training opt-in, contract status.
- Hour 4 — decisions. Mark rows that make or support a decision about a person. Those become the December 2026 candidates.
- Hour 5 — tier and controls. Content-only / internal / customer-facing / rights-affecting. Attach the control you already have, not the one you wish you had.
- Hour 6 — export and owners. Every row has a name. Gaps are dated. Counsel gets a pack, not a story.
Field definitions: AI inventory. Why the day exists: Can you prove it?
Who should be in the room
If legal sends an observer and IT sends a contractor, the register will be polite and wrong. We need someone who can say “yes, finance uses that” and someone who can assign an owner before they leave. The sponsor has to have authority to retire a shadow tool the same week. Otherwise the Day becomes a catalogue of problems with no permission to close them.
What we refuse to print on the walk-out pack
- “You are compliant with the Australian AI Act” — there isn’t a general one.
- “You are ready for 2027” as a certificate. You are ready to show your working.
- ISO 42001 certified. That is an assessor’s job after months of an AIMS.
- A privacy policy we authored as if we were your lawyers.
Unique insight: the valuable artefact is the gap list. Boards relax when they see 40 rows. They should read the eight rows marked “unknown data / no owner / rights-affecting” first. Those eight are the December problem and the 2027 problem.
When a Power Day is the wrong product
Pick a longer programme if you need a full ISO 42001 AIMS, an APRA-material-system review, or a red-team of a model that already decides credit. Pick engineering, not governance, if the problem is “we do not have production agents yet” — that is a build quote, not a register. Pick counsel first if you are already in an OAIC or court matter.
The Day is for the common case: AI is already inside the company, the policy is a PDF, and someone just asked you to prove it.
FAQ
Is this the friend’s product or Cipher? Cipher (Clear Direction AI) runs the Hour and the Day on a living evidence system. We do not sell a certificate. If you need the software named on a procurement form, ask us on the scoping call and we will put the exact product name on the order.
Can we do this remotely? Yes. The constraint is attendance, not the office. Cameras on, SSO admin in the call, spend file shared before 9am.
Singapore too? Yes. Same day, IMDA / PDPA flags on the export. The person in the room is usually the Data Protection Officer. Framework map: Singapore 2026.
What happens the week after? Owners update rows when a vendor ships an AI feature. We can stay for a follow-up Hour. We do not “retain you for compliance” as a vague monthly.
Related: Prove it · 10 December 2026 · Timeline · Book a Power Hour