What we put in place
- AI use policy: plain-language rules for staff on approved tools, data handling and human review.
- AI inventory and risk register: every AI use case, its owner, data, risk rating and controls.
- Decision rights: who approves new AI use, vendors and customer-facing automation.
- Control library: testing, monitoring, incident response and vendor review for AI systems.
- Documentation library: policies, procedures and runbooks your teams will actually use, built quickly with AI assistance and reviewed by people.
Frameworks we align to
We align your program to the NIST AI Risk Management Framework and ISO/IEC 42001, and map it to the regulations that apply to you. The rules are moving: in 2026 the EU agreed to delay its main high-risk AI Act deadlines, and Colorado replaced its 2024 AI Act with a narrower law focused on notice and consumer rights. We track these changes and work alongside your legal counsel, who confirms legal obligations.
What makes our approach different
We build governance that runs. Every policy has an owner, every control has evidence, and every document has a review date. We report governance as built versus running, so leadership sees what is actually in force.
Frequently asked questions
Do mid-market companies need AI governance?
Yes, if staff use AI tools with company or customer data, or if AI affects customers, employees or financial reporting. A proportionate program can be in place in four to eight weeks.
Are you a law firm?
No. We design the operating program and documentation. Your legal counsel confirms legal obligations, and we work alongside them.
What is ISO/IEC 42001?
An international standard for an AI management system. It sets out how an organization governs, monitors and improves its use of AI. Many companies align to it before deciding whether to certify.