AI Governance, Strategy, Risk and Assurance Advisory
Independent AI governance advice for boards and executives, from putting arrangements in place through to testing whether they are working.
Boards do not govern AI as an abstract technology. They govern decisions about what AI may do and the conditions under which it may be used.
Ethos Advisory is an independent AI governance, risk and strategy practice working with boards and executive teams across New Zealand and Australia. Bruce Johnson is the principal, and every engagement is scoped, conducted and reported by him.
AI governance is a leadership problem, and the questions a board needs answered are governance questions.
Governance and AI Inside an Organisation
Most recently, as General Manager Business Services at Careerforce, Bruce held executive responsibility for information services, service assurance, cyber security, risk and compliance, and put the organisation’s first AI governance arrangements in place.
He structured and led the annual strategic planning process for the Careerforce Board for three consecutive years, translating board level strategy into implementation plans and organisational reporting.
That is the work sitting closest to what Ethos does: governance arrangements built for an organisation with staff and exposure of its own, and three planning cycles answering directly to a board.
A Career Built On Governing Complexity
That practice rests on a longer career governing complexity where the cost of failure was high.
Bruce began his career as a commissioned officer in the Royal New Zealand Navy, serving on operations in the Arabian Gulf and spending two years as an advisor to the Republic of Fiji Military Forces. He went on to lead operational planning, training programmes, and capital equipment projects at a senior staff level. That foundation — clarity of mission, disciplined risk thinking, command accountability — has shaped everything since.
At the Department of the Prime Minister and Cabinet, he advised on New Zealand’s domestic and external security, contributed to national crisis management, and helped rewrite the National Security Manual. He chaired the National Working Committee on Terrorism and advised the Officials Committee for Domestic and External Security.
As General Manager Maritime Security at the Maritime Safety Authority, Bruce built New Zealand’s national maritime security function from the ground up, designing a port security risk assessment model based on the ISO Risk Management Standard, and leading the assessment of risk across 21 critical infrastructure facilities nationwide. The programme delivered full compliance with New Zealand’s international treaty obligations. It was formative work: designing governance structures under pressure, where the cost of failure was measured in national security, not just reputation.
As a General Manager at the Ministry of Transport, Bruce led maritime and aviation policy across a portfolio that touched national security, international trade, and critical infrastructure. He negotiated international air services agreements directly with foreign governments, led New Zealand’s delegations to ICAO and the APEC Transportation Working Group, and chaired the APEC Aviation Emissions Task Force. He advised nine Ministers of the Crown.
What Drives This Practice
Nearly eight years ago, well before AI reached board agendas, Bruce backed the development of an early AI application inside his own organisation. It worked. It also surfaced things the organisation was not ready to see, and it was never adopted.
The lesson was not about the technology, which did what it was built to do. It was that evidence is uncomfortable for whoever owns what it describes, and that discomfort will stop a system that works. That is a governance problem rather than a technical one, and it is a large part of why independent evidence matters.
Bruce kept researching after that, drawn particularly to agentic AI, systems that do not simply respond but act. Then came the Harvard Business School programme. Working through the ethics, security, privacy, data sovereignty and human oversight dimensions at that level of rigour did not gradually inform his thinking. It sharpened it.
AI has extraordinary potential, and that part everyone sees. What fewer people are grappling with, particularly at board level, is the scale of the downside if it is adopted without understanding, without oversight and without accountability. That is not a theoretical concern, and it is what keeps Bruce focused on governance rather than capability.
That is why Ethos Advisory exists.
Bruce holds a Certificate in Artificial Intelligence for Business from Harvard Business School and a Certificate in Company Direction from the New Zealand Institute of Directors. He holds a Master of International Relations from Victoria University, completed the Executive Programme in Strategy and Organisation at the Stanford Graduate School of Business, and is a graduate of the Australia New Zealand School of Government Executive Fellows Programme. He is a PRINCE2 Registered Practitioner, and his work is informed by internationally recognised AI governance frameworks including the NIST AI Risk Management Framework and ISO/IEC 42001.
Independent advice for boards and executives, from the first decision about AI through to whether what is in place is working.
Based in Wellington, working with clients across New Zealand and Australia.