AI governance & compliance

What governance is for

AI governance is usually sold as risk reduction. In regulated organisations it does the opposite job: it gets things approved. Without it, every proposal stalls at the same meeting on the same unanswerable questions.

Good governance is a defined path to yes, with the evidence already assembled.

What we produce

A complete AI inventory

You cannot govern what you have not counted. Almost every organisation we assess underestimates its footprint, because AI arrives inside tools bought for something else: lead scoring in the CRM, CV screening in the HR platform, auto-triage on the service desk. These are often higher risk than anything on the roadmap, and nobody has assessed them.

A policy people can follow

Most AI policies are written as prohibitions, so they are ignored and the risk goes invisible. Ours say which data classifications may go into which tier of tool, with a route to approval. If the compliant path is impossible, the risk has not gone away. It has moved somewhere you cannot see.

Risk entries with the AI-specific failure modes

Generic technology risk registers miss what goes wrong with AI:

• confident incorrect output
• drift as the world changes under a fixed model
• prompt injection through untrusted content
• over-reliance by users who have stopped checking
• data leaking into a tool tier it was never classified for

Each gets an owner, a control and a review date. "We are aware of hallucination" is not a risk entry.

DPIAs done at design time

For AI processing personal data at scale or with consequences, the DPIA is a legal requirement. Write it before the architecture is fixed, while its conclusions can still change something. Done then, it is the most useful document you will produce, and it answers most of what information governance and procurement will later ask.

EU AI Act position, in writing

A scope determination for each system: whether you are in scope, and as provider or deployer. Article 5 prohibition screening across your third-party tooling. Annex III classification for anything heading toward the December 2027 deadline. Reasoning as well as conclusions, because the reasoning is what you need when someone asks in two years.

Self-assessment and ISO/IEC 42001 groundwork

We work through a structured AI management self-assessment with you, using the themes from DSIT’s AI Management Essentials draft: internal processes, managing risks and communication. Government decided in February 2026 not to publish that tool, so it is a good set of questions rather than a requirement, but procurement panels still ask them. If certification is on your roadmap, we add an ISO/IEC 42001 gap analysis.

How it runs

Weeks 1-2: Discovery and inventory. Systems review, supplier review, interviews, and finding out what is in use.

Weeks 3-4: Assessment. Classification, scope determinations, Article 5 screening, risk identification, control gap analysis.

Weeks 5-6: Artefacts and adoption. Policy, register, DPIAs and templates drafted, then worked through with the people who operate them. A policy written without its operators does not get followed.

Where this is most urgent

• You sell to the public sector, or into a supply chain that does, and AI questions are appearing in tenders.
• You have AI in production that predates any governance around it.
• Your outputs reach EU users and nobody has screened your third-party tools against Article 5.
• Staff are using unapproved AI tools, and you would rather know.

We are not a law firm and this service is not legal advice. We produce the technical and organisational evidence your DPO, counsel and assurance functions need to reach and defend their own conclusions.