AI inventory & ownership
Map deployed, experimental and third-party AI systems, their purpose, users, data and accountable owners.
Include embedded vendor AI and employee use, not only applications your engineers build.
Services / AI Safety & Reliability
AI governance & compliance.Turn responsibilities into working controls.
Know where AI is used, who owns the risk and which controls are actually enforced. We help connect policies, engineering and evidence so your team can make accountable deployment decisions.
Practical implementation. Reviewable evidence. No compliance guarantees.
The business case
Policy on paper. Accountability in production.
AI adoption can outpace the processes that govern it. Different teams choose tools, vendors change models and new workflows gain access to sensitive information. Governance makes those choices visible and connects them to owners, controls and evidence.
When this becomes useful
When pilots are moving into production, customers request assurance, procurement needs a consistent review process or AI use is spreading across teams without clear ownership. Existing systems can also be brought into a proportionate governance process.
What the service covers
Inventory, risk and requirements mapping, priority control implementation, evidence workflows and operating handover. We work with your legal, privacy, security and risk owners; this is not legal advice, independent certification or a guarantee of regulatory compliance.
Service scope
Six connected parts of responsible operation.
The starting point depends on your organisation's maturity and exposure. We focus on the gaps that affect real decisions rather than requiring every team to adopt the same governance programme.
Risk & impact assessment
Assess potential harm, affected people, failure modes and the consequences of incorrect outputs or actions.
Prioritise according to context and impact rather than assigning one risk level to every model.
Policies & operating controls
Translate acceptable-use rules, approval requirements and data boundaries into workflows and enforceable checks.
A written policy is not evidence that the application enforces it.
Supplier & model assurance
Review provider terms, data flows, model limitations and material changes in third-party services.
Supplier assurances do not replace your own responsibilities as a builder or user of AI.
Evidence & release decisions
Connect tests, assessments, approvals and unresolved risks to the version being released.
Keep the decision owner and residual risk visible, including conditions for reassessment.
Ongoing oversight
Define review cadence, incidents, exceptions, change controls and retirement procedures.
Governance continues after launch; a one-time document pack is not an operating system.
The governance loop
A system. A decision. Evidence that stays connected.
Link a use case to its assessment, accountable review and versioned evidence. Material changes return it for reassessment. Approval is a recorded decision under defined conditions, not a permanent declaration that the system is safe.
01
Map the requirement
Connect each confirmed requirement or risk decision to a control, owner and verification method. Keep unresolved legal questions and evidence gaps explicit.
02
Implement & verify
Enforce the selected control at the right boundary and test both normal and failure paths. A configured setting or policy document is not the same as observed enforcement.
03
Decide & reassess
Record who approved the release, what evidence supported it and which risks remain. Define triggers for review when the model, data, intended use or permissions change.
Inventory & accountability
Know what is running. Know who owns it.
We create a usable register of AI use cases and responsibilities. The right level of detail connects an application to its business purpose, dependencies and decision authority without turning every prompt into a bureaucratic project.
System records
Record intended use, users, affected groups, operating environments, models, tools and data categories. Distinguish a pilot from a production service and document prohibited uses.
Decision roles
Identify business, engineering, security, privacy and risk owners. Specify who can approve deployment, accept residual risk, grant an exception or pause the workflow.
Supplier dependencies
Map external models, hosted tools, data sources and downstream systems. Link contracts and processing terms to the systems relying on them.
Staff guidance
Provide role-appropriate AI-use guidance and escalation paths. Address sensitive data, generated claims, human review and unapproved tools; record training where relevant.
Risk & impact
Assess the decision, not just the technology.
A drafting assistant and a system influencing eligibility or employment have different consequences. We help structure assessments with your responsible experts and translate the resulting risk decisions into engineering requirements.
Intended & foreseeable use
Document the intended task, foreseeable misuse, affected people and dependency on human judgement. Check whether a feature merely informs a decision or can execute it.
Impact & failure modes
Assess privacy, discrimination, safety, misleading output, service disruption and unauthorised actions. Include uncertainty, access needs and the ability to challenge or correct an outcome.
Proportionate assurance
Select evaluations, adversarial tests, oversight and release checks according to the consequence of failure. State evidence gaps and avoid collapsing unrelated risks into a reassuring average score.
Residual risk
Record controls, evidence, unresolved concerns and an accountable decision. Reassess when intended use, models, data, access or deployment conditions materially change.
Controls in the application
Make the policy executable where it matters.
We connect governance requirements to the application and its delivery process. Enforcement belongs at the boundary that controls data or actions, not exclusively in a system prompt.
Data & authority boundaries
Enforce identity, tenant isolation, retrieval permissions and tool scope outside the model. Validate generated arguments and prevent delegated agents from silently gaining more authority.
Meaningful human oversight
Require informed approval for consequential actions, with context, uncertainty and a genuine ability to reject or stop. A checkbox without time, evidence or authority is weak oversight.
Transparent interaction
Design appropriate AI disclosures, limitations and escalation paths for the use case. Distinguish suggestions from verified facts and proposed actions from confirmed execution.
Change & release gates
Version prompts, models and configuration; attach required tests and sign-offs to a release. Control exceptions, rollout, rollback and evidence for material changes.
Privacy & information handling
Governance and data protection work together.
AI governance does not replace privacy or security obligations. We map the information lifecycle and implement agreed controls with your privacy and security owners; lawful basis and legal applicability need qualified assessment.
Purpose & minimisation
Identify which data is necessary for inference, retrieval, review and testing. Avoid repurposing personal or confidential information for training without the required rights and authorisation.
Processing & transfers
Document provider access, storage regions, subprocessors and cross-border flows. Evaluate contracts and deployment options with the responsible advisers; self-hosting alone does not establish compliance.
Retention & rights support
Implement agreed retention, deletion and access workflows across sources, caches, traces and derived records. Document limitations, backups and responsibility for rights requests.
Sensitive diagnostics
Minimise prompt and output capture, redact before export and restrict evidence access. Separate operational visibility from audit records that require stronger completeness or integrity.
Supplier & model governance
Third-party AI still needs an accountable owner.
We help your team evaluate the dependencies behind a use case and define the evidence needed from suppliers. An approved vendor list is useful only if application behaviour and data flows stay within its conditions.
Due diligence
Review intended use restrictions, data-use terms, security information, processing locations and relevant model documentation. Record unknowns rather than treating missing information as a favourable result.
Selection & testing
Evaluate candidate models and services against representative tasks, boundaries and operating constraints. Model-level benchmarks do not establish fitness for your full application.
Dependency changes
Track provider updates, model deprecations, configuration changes and new subprocessors where information is available. Define triggers for reassessment and alternatives for critical dependencies.
Contract & exit planning
Clarify evidence access, notification, portability and deletion expectations. Procurement and counsel own contractual acceptance; engineering verifies what can be implemented and tested.
Evidence & operating oversight
Make decisions reviewable after the meeting.
We organise evidence around systems, versions and accountable decisions. The aim is a traceable rationale and usable operating process, not a compliance badge generated by a dashboard.
Evidence register
Link assessments, evaluations, supplier reviews, control tests and approvals. Record scope, date, version, owner and limitations so an old test is not presented as evidence for a changed system.
Exception handling
Document the reason, approver, compensating controls and review conditions for deviations. Exceptions should remain visible and be revisited, not silently become the new default.
Incident & complaint paths
Define intake, triage, containment, escalation and corrective action. Legal notification duties and deadlines require case-specific confirmation; an internal alert does not fulfil them automatically.
Review & retirement
Revisit outcomes and controls as usage changes. Plan decommissioning, access revocation, data disposition and retained evidence when an AI service is replaced or withdrawn.
Regulations & frameworks
Map obligations carefully. Use frameworks deliberately.
Legal requirements, voluntary frameworks and certification standards serve different purposes. We support operational mapping and implementation; qualified advisers confirm applicability and legal interpretations for your organisation.
EU AI Act
Applicable requirements depend on territorial scope, your role, the system's intended use and relevant implementation provisions. We support inventory, control and evidence mapping; counsel confirms classification and legal duties.
Read the primary referencePrivacy & sector requirements
GDPR, DIFC data protection law and sector-specific obligations require separate applicability analysis. AI governance does not replace a privacy impact assessment, lawful processing basis or domain-specific approval.
Read the primary referenceNIST AI Risk Management Framework
A voluntary framework for organising governance, context, measurement and risk management. It can guide practical work; use of the framework is not certification or proof of legal compliance.
Read the primary referenceISO/IEC 42001
An AI management-system standard that can inform policies, responsibilities and continual improvement. Readiness support is not certification; certification requires a separate competent certification process.
Read the primary referenceApplicable rules and implementation guidance can change. We do not publish a universal compliance checklist or imply that following a framework satisfies every law. Scope, jurisdiction, organisational role and intended use need case-specific review.
Tools & frameworks
Governance needs engineering, not just another platform.
These are options we evaluate against your existing tools, operating constraints and evidence needs. A focused process with tested controls can be more useful than a large platform without clear owners.
Policy & access enforcement
Open Policy Agent / RegoCedarOIDC / OAuthApplication permission checks
Implement agreed authorisation rules at real execution boundaries. Policy engines do not replace correct integration, identity scope or control testing.
Evidence & workflow
Git / pull-request approvalsJira / ServiceNowExisting GRC platformsVersioned evidence storage
Reuse your review and risk processes where practical. Link decisions to system versions and control evidence rather than introducing another disconnected register.
Evaluation & assurance
promptfoopytest / VitestPyRITTask-specific review datasets
Attach quality, security and permission tests to release decisions. Automated results need agreed criteria, scope and human interpretation.
Traceability & operations
OpenTelemetryLangfuse / LangSmithPostgreSQLAccess-controlled audit storage
Correlate operational events and consequential decisions. Define completeness, integrity, access and retention separately for diagnostic traces and required audit records.
Data protection controls
Microsoft PresidioCloud KMSSecrets managementRetention & deletion workflows
Support redaction, encryption and lifecycle controls under an agreed data policy. Detection and redaction have limitations and must be tested on relevant data.
Delivery controls
GitHub Actions / GitLab CIInfrastructure as codeFeature flagsControlled deployment pipelines
Tie release evidence, approvals, access configuration and rollback to the actual operating environment. A passed pipeline is not a legal compliance determination.
Tools are selected for supported capabilities, licensing, processing terms and operational fit. No policy engine, evaluator or evidence platform independently certifies your application or determines legal compliance.
Delivery & outputs
Start with a real use case and a clear owner.
We agree a bounded scope, identify the most important gaps and implement useful controls with your team. Organisation-wide coverage grows from that working example, rather than starting with a promise to make everything compliant.
- 01
Discover systems & responsibilities
Map AI use cases, stakeholders, data flows and existing policies. Identify the decisions and assurance gaps that matter most.
Output: An initial AI inventory, ownership map and prioritised scope.
- 02
Assess & map requirements
Work with risk, privacy, security and legal owners to identify applicable requirements and operational risks. Separate confirmed duties from open legal questions.
Output: A risk register and requirements-to-controls map with accountable owners.
- 03
Implement priority controls
Build agreed access, oversight, release and evidence controls into one selected workflow. Connect existing processes rather than creating a parallel bureaucracy.
Output: Working controls, documented procedures and scoped verification evidence.
- 04
Verify & prepare decisions
Test controls and failure scenarios, review evidence gaps and rehearse escalation. Record unresolved risks and the responsible release or exception decision.
Output: Control-test results, an evidence pack and a remediation backlog.
- 05
Hand over & sustain
Document ownership, guidance, review triggers and change procedures. Agree the next systems to cover and ongoing support separately.
Output: Code, configuration, operating guidance and an accountable review plan.
A bounded first sprint
Start with a paid two-week sprint and one agreed goal, without a required long-term commitment. A first scope can map an important use case and implement selected controls. Wider programmes, legal assessment and certification preparation may require further work.
What your team brings
A business owner, relevant engineering access and the people responsible for privacy, security, risk and legal decisions. Existing policies, supplier information, architecture and known concerns help establish a realistic starting point.
Handover & boundaries
Leave ownership with the people operating the system.
Governance works when responsibilities and evidence remain usable after the engagement. We document what was implemented, what was tested, what remains open and who owns the next decision.
Usable operating material
Your code belongs to you from day one. We hand over agreed controls, configuration, registers, review workflows and guidance, subject to data rights and third-party licences. Independent audit and certification remain separate scopes.
Ongoing review is explicit
Policy maintenance, legal updates, assurance reviews and incident support require accountable internal owners or a separately agreed support engagement. A completed evidence pack does not establish indefinite compliance as the system changes.
Related assurance services
Support decisions with tested evidence.
Connect governance to evaluation, adversarial assessment and production visibility.
Questions before implementation
The practical details.
Will this make us compliant or certified?
No single engagement or tool can guarantee that. We help map requirements, implement controls and prepare reviewable evidence within an agreed scope. Qualified advisers confirm legal duties, and independent certification or regulatory processes remain separate.
Is this legal advice?
No. This is governance implementation and engineering support. We work with your legal, privacy, security and risk owners; legal interpretation, classification, contracts and notification duties need the appropriate qualified advisers.
Does the EU AI Act apply to every AI application?
Obligations vary by territorial scope, provider or deployer role, intended use, system classification and the relevant provisions. We do not infer applicability from the presence of an LLM alone. Counsel should confirm the analysis for your organisation and deployment.
Can you work with our existing governance framework?
Yes. We can extend existing security, privacy, procurement, risk and change-management processes with AI-specific records and controls. The goal is clearer accountability and enforceable boundaries, not replacing a functioning process without reason.
Can you assess AI built by another vendor?
Yes, with authorised access and an agreed evidence scope. We can map use, data flows, contractual information and observable controls. Inaccessible internals and missing supplier evidence are documented as limitations.
How is this different from testing or red teaming?
Testing measures intended behaviour and red teaming probes hostile scenarios. Governance defines who decides, which controls are required, how evidence is reviewed and what happens when risk changes. Assurance findings feed governance decisions; documents alone cannot replace testing.
Do we need a dedicated governance platform?
Not necessarily. A versioned register, accountable review workflow and tested application controls may be the right starting point. We assess your scale, evidence needs and existing tools before recommending another platform.
How do we start?
Start with a paid two-week sprint, one agreed goal and no required long-term commitment. A realistic first scope can map one use case and implement selected controls. Organisation-wide programmes, legal review and certification readiness may require further work. Your code belongs to you from day one, subject to third-party licences.
Start with the responsibility gap
Bring the use case.
Let's make its controls accountable.
Tell us where AI is used, which decisions it influences and what evidence your team needs. We'll define a practical first scope.