AI Governance & Compliance
Most organizations are already using AI in more places than their leadership can name. We help you inventory those uses, record intended purpose and accountable owners, assess vendor and model risks, and put human oversight and monitoring where the consequences justify it.
We give you a defensible governance record and an honest view of obligations. We do not certify AI systems and we do not issue blanket compliance verdicts.
When this helps
Scope & deliverables
Establish what exists before governing it.
Understand what you are relying on and what your suppliers commit to.
Make sure a person is accountable where outcomes matter.
The written and ongoing parts that keep governance real.
The NIST AI Risk Management Framework is voluntary guidance that helps structure AI risk work; following it is not a legal compliance status. ISO/IEC 42001 describes an AI management system, and certification against it is issued by an accredited certification body, not by us; we prepare readiness. Legal obligations differ by jurisdiction and by use case, and rules such as the EU AI Act apply on their own timelines and only to certain roles and risk categories. Sector rules on privacy, consumer protection, employment and discrimination often bite before any AI-specific law does. We explain which of these plausibly applies to your situation and recommend legal counsel for binding determinations; we do not tell you that you are compliant.
How we work
Step 01
Interview teams, review vendor contracts and build an inventory of AI systems and features actually in use.
Step 02
Record intended use, data involved, affected people and consequence level, then assign accountable owners.
Step 03
Run proportionate risk assessments, vendor and model due diligence and impact assessments for higher-consequence uses.
Step 04
Put policy, guardrails, oversight points, evaluations and disclosure wording in place where they are justified.
Step 05
Agree metrics, drift checks, incident handling and a review cadence that keeps the inventory current.
Working together
How we use enquiry information is set out in our privacy policy.
FAQ
No. We assess your governance against recognised practice, explain which obligations plausibly apply to your jurisdictions and use cases, and document the record. Binding compliance determinations belong with your legal advisers.
It depends on your role, where you operate, who your users are and the risk category of the use case, and its provisions phase in over time. We help you work through those questions and document the reasoning; your counsel confirms the conclusion.
Only if a customer, regulator or contract asks for it. We can prepare an AI management system for certification readiness, but certification itself is issued by an accredited body.
Yes, and it is usually lighter. You still need to know which features are on, what data flows into them, what the vendor commits to and who is accountable when output is wrong.
We define the intended use, agree what an unacceptable outcome looks like, build a test set that reflects real cases and set acceptance thresholds with your owners. Evaluation results are recorded with their limitations rather than presented as a guarantee.
It extends it. AI governance reuses your risk register, vendor process, policy workflow and incident handling, and adds AI-specific records such as intended use, oversight design and evaluations.
Keep Exploring
Tell us where AI is used in your organization and we will propose an inventory, risk and oversight scope.
Subscribe to receive the latest business insights, technology updates, company news, and useful ideas delivered to your inbox.
We respect your privacy. Unsubscribe at any time.
