AI Risk & Governance
Governance structures for organisations deploying or procuring AI — built ahead of the regulatory questions, rather than in response to them.
What this covers
Most SMEs using AI didn't set out to become "an AI company." A chatbot got added to the website, an AI screening step got bolted onto hiring, an engineer wired a model into the product over a weekend. None of it was necessarily a security or governance decision at the time — but it created real exposure, and increasingly, real obligations.
This service line builds the governance structure around AI you're already using or building, sized to what a small team can actually maintain — not a compliance department's worth of documentation nobody has time to keep current.
What's included
In scope
- AI governance frameworks, aligned to ISO 42001
- AI risk assessments for specific AI/ML deployments
- Vendor & third-party AI due diligence
- AI system inventory and impact assessment
- Policy documentation sized for a small team to maintain
Not included
- Formal accredited ISO 42001 certification audits
- Building or fine-tuning AI models
- Ongoing model performance monitoring
- Legal advice on AI-specific regulation
How an engagement typically starts
Almost always with an honest inventory: what AI is the business actually using or building today, and what would an impact assessment on each one actually reveal. That exercise alone usually surfaces the real gaps — well before certification, accredited auditors, or a big budget line ever enter the conversation.
From there, the work is scoped to what's actually needed: sometimes that's a single governance framework for one AI deployment, sometimes it's an ongoing advisory relationship as AI use in the business grows.
Who this is for
SMEs whose customers, investors, or procurement partners are starting to ask AI governance questions — or founders who'd rather build this in deliberately now than retrofit it under deadline pressure once a deal depends on it.