Inventory and classification
Every model, tool and vendor in use, recorded with its purpose, data, owner and risk tier, including the tools people bought on a company card.
AI governance and risk
Lightweight controls that let your teams move quickly and still answer the questions your regulator, your clients and your board will ask.
Best for
- Regulated sectors and public sector suppliers
- Businesses answering client security questionnaires
- Groups preparing for an external audit
- Full
- Register of AI systems in use
- 1 page
- Policy your teams will read
- Audit
- Evidence trail for live systems
What it is
Control without the paperwork mountain.
Governance is how a business keeps control of the AI it uses. In practice that means knowing which systems are in play, what data they touch, who is accountable and how a wrong answer gets caught.
We build the smallest set of controls that does the job: a register, a review path, testing expectations and a way to switch a system off. No ninety page framework that nobody reads.
What we do
The work, item by item.
Each engagement covers the same four areas, weighted to where your risk and value actually sit.
Review and approval path
A proportionate process that routes low risk work through a checklist and sends higher risk work to a proper review with named approvers.
Testing and evidence
Evaluation suites, sampling and audit logs that show what a system produced and why, ready for internal audit or an external reviewer.
Policy and training
Plain language policy, acceptable use guidance and a short briefing for the teams who will use these tools daily.
How we implement
The steps, and what you get at each one.
Fixed deliverables, agreed durations and a decision point at the end of every step.
- 01
Baseline
1 week
We find what is already in use, what data it touches and where the current gaps are.
Deliverables
- AI system inventory
- Risk tiering
- Gap summary
- 02
Design
2 weeks
Controls are written to fit how your business already approves change, so governance joins an existing habit rather than adding a new one.
Deliverables
- AI policy and acceptable use
- Review and approval workflow
- Risk register template
- 03
Embed
2 to 4 weeks
We run the first reviews with your team, then hand the process over with the training and templates to keep it going.
Deliverables
- First review cycle completed
- Audit evidence pack
- Team briefing sessions
Related
Often paired with.
Next step
Talk it through with the team who would do the work.
A 30 minute call on ai governance & risk, what it would take in your business, and whether it is worth doing at all.