What is AI governance and assurance?
AI governance is the set of roles, policies and controls that decide how an organization uses AI. Assurance is the evidence that those controls work. Together they let you show an auditor, customer or board that your AI use is managed.
AI is moving from pilots into production faster than most governance programs can keep up. Responsible-AI statements are easy to publish and hard to prove.
This work puts a management system in place, grounded in ISO/IEC 42001 and the NIST AI Risk Management Framework. We inventory the AI already in use, including shadow AI and models embedded in vendor products, map it to risk, design proportionate controls across the AI lifecycle, and produce the documentation and evidence that stand up to an audit.
Most businesses should start with the AI Security Assessment. This is the next step for organizations that need a formal management system or certification readiness.
Who needs it?
- An organization putting AI into production, not just piloting it
- A company whose customers ask how it governs AI
- A business with an ISO 27001 or SOC 2 program that now needs to cover AI
- Leadership preparing for ISO/IEC 42001 certification
What problems does it address?
- AI in use across the business with no inventory and no owner
- Responsible-AI statements with nothing behind them an auditor could check
- Vendor and embedded AI models nobody has assessed
- No evidence to show a customer, regulator or board
Frameworks
- ISO/IEC 42001 AI Management System (AIMS)
- NIST AI Risk Management Framework (Govern, Map, Measure, Manage)
- OECD AI Principles and responsible-AI alignment
- Mapping to existing ISO 27001 and SOC 2 programs
Assurance and evidence
- Control effectiveness testing and evidence packs
- Third-party and vendor AI assurance reviews
- Continuous monitoring and drift oversight
- Pre-certification readiness assessments
What you receive
- An AI system inventory and model cards
- AI policy, roles and an oversight (RACI) framework
- Control design across the AI lifecycle
- Model documentation and data-provenance records
- Audit and independent-assurance readiness
- Reporting ready for the board and regulators
What happens afterward?
The work continues on the scope and cadence you agreed. Findings that need fixing can move to Remediation Guidance & Retesting, and a fresh assessment can check progress.
How the engagement works
Free consultation
A 45-minute call with a senior consultant about your situation. It is a conversation, not an assessment. You leave with a recommended next step.
Agree the scope
What we cover, how often and how much time, agreed in writing up front.
Ongoing work
The same senior consultant works with you each time, so you are not re-explaining your environment.
Reporting
Regular reporting written for leadership, and useful to an auditor or insurer who asks how security is handled.
