- Home
- AI governance
AI risk and policy
AI governance consulting for responsible, compliant AI
Your teams are already using AI. Customers and regulators want to know it's under control. We help you find where AI is used, assess the risks, set clear rules and put oversight in place that scales as adoption grows.
- Frameworks
- ISO/IEC 42001, ISO/IEC 23894, NIST AI RMF, EU AI Act
- Key outputs
- AI register, risk assessment, policy set, governance charter
- Covers
- Built, bought and employee-used AI
- Path to certification
- ISO/IEC 42001
What's included
From AI inventory to ongoing oversight
- AI discovery and inventoryEvery AI system and tool in use, including unapproved ones.
- AI risk assessmentPrivacy, security, bias, intellectual property and reliability risks.
- Acceptable use policyClear rules for staff on which AI tools and data are allowed.
- Governance structureAn AI committee or owner, decision rights and escalation paths.
- Vendor AI due diligenceQuestions and contract terms for suppliers that use AI on your data.
- AI impact assessmentsStructured review of new AI use cases before they go live.
- Regulatory mappingEU AI Act classification and alignment with data protection laws.
- Training and awarenessPractical guidance so people use AI well, not just less.
FAQ
AI governance questions
What is AI governance?
AI governance is the set of policies, roles and processes that decide how your organisation adopts and uses AI: which uses are allowed, how risks are assessed, who signs off and how systems are monitored once they're live.
Our staff already use ChatGPT and similar tools. Where do we start?
Start by finding out what's in use and what data goes into it. An inventory and a clear acceptable use policy usually deliver the fastest reduction in risk, and they're the foundation for everything else.
How does this relate to ISO 42001?
AI governance is the practice; ISO 42001 is a certifiable way to formalise it. Many organisations start with governance basics and move to ISO 42001 certification when customers or regulators ask for it.
Do you cover the EU AI Act?
Yes. If you build or deploy AI that reaches people in the EU, we help you classify your systems under the Act, understand the obligations for your role and plan the controls you need.
Get AI adoption under control.
Start with a short conversation about how AI is used in your organisation today. We'll suggest the first three things to put in place.