01 / Govern
Set the policy, the roles and the accountability before the next model ships.
- AI Policy & Standards
- Acceptable Use Policy
- Roles & Accountability Model
- AI Governance Committee Design
- Procurement & Third-Party Standards
AI you can account for, before someone asks you to.
Most organisations are running more AI than their policy covers. We build the governance layer on the NIST AI Risk Management Framework: an inventory of what is actually deployed, a risk tier for each system, controls proportionate to that tier, and evidence you can hand to a regulator, a customer's security team or your own board.
NIST AI RMFThe framework the program is built on
4Core functions: govern, map, measure, manage
ISO 42001Certification path where it is warranted
InventoryFirst deliverable, every engagement
The practice
How the practice is structured
Four moves, in order. Most programs we inherit are strong at one stage and thin at the others. The assessment tells you which.
02 / Map
Establish what AI is actually running, in what context, at what risk.
- AI System Inventory
- Use Case Intake & Triage
- Risk Tiering & Classification
- Context & Impact Assessment
- Data Provenance Review
03 / Measure
Test each system against the claims being made for it.
- Model Evaluation & Testing
- Bias & Fairness Assessment
- Explainability Review
- Red-Teaming & Adversarial Testing
- Human Oversight Assessment
04 / Manage
Treat the risk, monitor it, and retire the system when it is done.
- Risk Treatment & Control Selection
- Deployment Gates & Sign-Off
- Continuous Monitoring
- AI Incident Response
- Audit Evidence & Reporting
The catalogue
29 services in AI Governance
Everything on the solution map under this domain. If a requirement isn't listed, it's usually still sourceable, so ask.
Govern 6
- AI Policy & Standards
- Acceptable Use Policy
- Roles & Accountability Model
- AI Governance Committee Design
- Procurement & Third-Party Standards
- AI Incident Response Policy
Map 6
- AI System Inventory
- Use Case Intake & Triage
- Risk Tiering & Classification
- Context & Impact Assessment
- Data Provenance Review
- Third-Party Model Mapping
Measure 6
- Model Evaluation & Testing
- Bias & Fairness Assessment
- Explainability Review
- Performance & Drift Monitoring
- Red-Teaming & Adversarial Testing
- Human Oversight Assessment
Manage 6
- Risk Treatment & Control Selection
- Deployment Gates & Sign-Off
- Continuous Monitoring
- AI Incident Response
- Model Retirement & Decommissioning
- Audit Evidence & Reporting
Assurance & Standards 5
- NIST AI RMF Readiness Assessment
- ISO/IEC 42001 Gap Analysis
- EU AI Act Readiness
- Generative AI Profile (NIST AI 600-1)
- AI Vendor Due Diligence
What changes
What you actually get out of it
Not a platform choice. A set of decisions with the reasoning attached, and someone accountable for them at renewal.
- A single inventory of AI systems, including the ones procured inside a SaaS renewal.
- A risk tier per system, so controls are proportionate rather than uniform.
- A named owner for every deployed system, and a documented sign-off gate.
- Evidence organised the way an auditor, a regulator or a customer will ask for it.
AI governance baseline4–6 weeks
01Discovery: AI systems in use, sanctioned and notMap
02Risk tiering against use and impactMap
03Policy and accountability gap analysisGovern
04Control selection proportionate to tierManage
05Evaluation and monitoring plan per tierMeasure
06Governance roadmap and evidence packDeliverable
Inventory firstRequest scoping
Adjacent practices
Where AI Governance usually connects
A finding in one practice commonly implicates another. These are the three most often opened alongside this work.
27 services
PRVData Privacy
Privacy programs built to run, not just to pass an audit: what personal data you hold, where it goes, and the workflow that answers a rights request on time.
Explore25 services
SECCybersecurity
Layered defense on the NIST framework: identify, protect, detect, respond, with compliance evidence you can hand to an auditor.
Explore36 services
CLDCloud & Managed Services
Where the workload should live, how it gets there, and who runs it at 2am, across public, private, hybrid and colocation.
ExploreNext step
This practice begins with an assessment.
Scope, duration and deliverables are agreed in writing before it starts. Ask for the scope document and we will send it.