The work we cover
Practical AI governance defines what the company allows, who owns each use, and how the organisation checks that it works within those limits. We help leaders turn those decisions into operating processes for tools, data, reviews, releases, suppliers, and incidents.
We assess AI embedded in existing software as well as separately purchased tools and custom applications. The same product can support a low-consequence drafting task or a consequential customer decision. We assess the actual use, information, authority, and affected people rather than giving every tool one generic risk label.
The work can include an AI register, acceptable-use policy, use-case assessment, approval process, supplier questions, decision rights, and management reporting. We also help connect these controls to the application. A policy requiring review needs a real reviewer, evidence, and a way to stop an unsafe action.
How we deliver
We start with the AI already in use and the decisions management needs to make. Interviews, approved tool records, and system walkthroughs establish the initial inventory. We record the business owner, purpose, data, supplier, permitted actions, users, and current evidence of testing and monitoring.
We assess consequences and identify gaps with your risk, IT, privacy, and legal owners. Some actions need a clear rule; others need specialist interpretation. We distinguish a missing record from an ineffective control and assign an action to the person able to resolve it.
Controls follow the workflow. Access permissions restrict what the system can retrieve or change. Release checks cover representative failures. Human review includes the source, proposed action, and authority to reject it. Incident procedures specify who pauses the system, investigates impact, and approves a restart.
The National AI Centre's foundations guidance supports a proportionate approach to accountability and oversight. We adapt the work to your uses and existing management processes. High-risk activity or specialist obligations may require additional expertise and a separately agreed scope.
An illustrative engagement
This is an illustrative engagement design, not a client case study. A growing professional-services company discovers staff using several AI tools for research, meeting notes, proposal drafts, and client document analysis. Managers cannot consistently explain which information goes where or who approves a new use.
We build an initial register and classify the actual workflows. The company agrees approved sources and tools for a limited set of tasks, a route for requesting another use, and rules for client information. Owners record the basis for each decision and the unresolved questions for specialist advisers.
We then test the process with an ordinary request and a simulated incident. A staff member proposes a new document assistant; a manager assesses its data and review needs; the technical owner shows how access is limited and disabled. The exercise reveals whether the policy works in practice and where responsibility is unclear.
How we measure value
We measure whether material uses have accountable owners, tested controls, current records, and a workable review path. Register completeness needs evidence about how the inventory was gathered and its limits. A set of polished policies cannot establish that the applications follow them.
Useful operating measures include unowned uses, overdue actions, tests passed, incidents, time to investigate, and the age of supplier or use-case reviews. Approval time also matters. A process that delays every low-consequence task can encourage workarounds, while a superficial approval can miss a material risk.
The NIST AI Risk Management Framework is a voluntary framework for managing AI risk. Using its concepts does not confer certification. Privacy questions are informed by OAIC commercial-AI guidance, with your advisers responsible for the legal position and applicability to the business.
We report what we examined, what worked in a test, what depends on management action, and what remains unknown. That record gives directors and managers a more useful basis for decisions than a blanket assertion that AI is safe or compliant.
What your team owns
The handover includes the maintained register, policy and approval workflow, responsibilities, assessment records, action list, test evidence, incident instructions, and reporting format. We establish when a change in purpose, source, supplier, or authority triggers another review.
An executive owner maintains accountability, while process and technical owners operate the controls. Staff receive guidance for normal use and uncertain situations. Continuing support can include reviewing new uses or implementing agreed controls, with responsibilities and independence made clear in the engagement.
Questions before you start
Do you certify compliance or ISO conformity? No. This offer covers governance design and implementation support. Formal certification, legal opinions, specialist security testing, and independent assurance require appropriately qualified specialists and their own scope.
Can you independently assure a system you built? We can test and document our delivery, but an independent assurance opinion on our own work requires another party. We state that boundary when agreeing the engagement.
Do we need a large governance programme? We begin with the uses, exposure, and decisions that matter to your company. A focused inventory and practical approval process can be a useful first scope. AI strategy and readiness can establish those priorities, and implementation puts agreed controls into the system.