Discipline 02 · Governance & Risk

Somebody has to sign it. Give them something worth signing.

Seven stages, five possible decisions.

System under assessment

01 Context
02 People
03 Data
04 Model
05 Decisions
06 Controls
07 Residual risk

Proceed Residual risk is acceptable as designed.
Proceed with controls Acceptable once named controls are in place and owned.
Redesign The residual position cannot be reached from this architecture.
Escalate Specialist or legal assessment required before a decision can be taken.
Do not proceed The impact cannot be controlled to an acceptable level.

Regulation

EU AI Act

Likely role and classification per use case, the technical and organisational obligations that follow, existing controls mapped against them, and the evidence gaps that remain.

Management system standard

ISO/IEC 42001

An AI management system structure — policy, objectives, roles, lifecycle controls and internal audit hooks — shaped so certification is achievable rather than assumed.

Risk framework

NIST AI RMF

Govern, Map, Measure and Manage translated into named owners, stage gates and measurable evaluation requirements rather than a reading exercise.

Principles-based regime

UK regulatory expectations

The cross-sector principles and the expectations of the regulators that actually supervise you, reconciled with the controls you already operate.

Patchwork regime

US federal and state rules

No single federal statute, so the obligations follow the states you deploy into — Colorado, Texas, California and the New York City hiring rules among them — while consumer-protection and employment regulators apply existing law to AI systems in the meantime. Reconciled into one control set with the state-by-state deltas named, rather than a separate reading for each jurisdiction.

Supervisory rules

Sector-specific requirements

Financial services, insurance, health and public sector obligations — model risk management, operational resilience, safeguarding and procurement rules — folded into the same control catalogue.

EU AI Act · Article 99 · Administrative fines

€35m

or 7% of worldwide annual turnover

Prohibited practices

€15m

or 3% of worldwide annual turnover

Most other operator obligations

€7.5m

or 1% of worldwide annual turnover

Supplying incorrect or misleading information

Whichever is higher, and these are ceilings rather than expected outcomes. We cite them because they are the regulation's own numbers — not because we can tell you what any particular exposure would be.

2 engagements.

Every engagement is fixed in scope before it starts, and what it costs is agreed in the scoping call and confirmed in writing. Set that against the build it protects — and against paying for that build a second time. The comparison is the whole argument for hiring an architect.

Governance & Risk · Engagement 05

AI Governance & Regulatory Readiness

Build an AI governance framework your organisation can actually operate.

Governance fails when it is written as policy and never becomes practice. We build the operating model, the controls, the stage gates and the evidence requirements — then map them against the regulation and standards that apply to you, and show you exactly where the gaps are.

Scope

Governance operating model and accountability structure
AI policy and supporting standards
AI system inventory and registration process
Risk classification methodology
Lifecycle controls and stage gates from idea to retirement
Third-party, model-provider and supply-chain governance
Human oversight requirements by risk class
Evaluation and monitoring requirements
Incident and change management for AI systems
Evidence requirements — what is recorded, by whom, and where
Roles and RACI, and the governance forums that make decisions
Prioritised implementation roadmap

Deliverables · 7

AI governance framework
Control catalogue mapped to applicable regulation and standards
Gap assessment against current practice
Risk classification methodology and stage gates
AI system inventory structure and registration process
RACI, forum terms of reference and decision rights
Prioritised implementation roadmap

Comes up when · AI use spreading faster than any ability to see or approve it.

Governance & Risk · Engagement 06

AI Risk & Impact Assessment

Understand the risk and impact of an AI system before it reaches production.

One use case, assessed systematically from context to residual risk — and ending in an explicit decision, not a document that sits in a folder. Built for architecture review boards, AI governance committees, risk functions and the executives who have to sign.

Scope

Intended purpose, affected stakeholders and deployment context
Materiality and criticality of the decisions supported
Data and privacy implications
Fairness and potential discriminatory impacts
Explainability and transparency requirements
Model limitations, accuracy and — where relevant — hallucination risk
Security, misuse and abuse scenarios
Human oversight design and its realistic effectiveness
Third-party and model-provider dependencies
Operational resilience and failure consequences
Monitoring, evaluation and drift detection
Regulatory considerations and classification

Deliverables · 5

Risk and impact assessment report
Inherent risk, control, residual risk and decision table
Control recommendations with owners
Monitoring and evaluation requirements
Governance decision record — ready for board sign-off

Comes up when · A system about to go live with no assessment behind it.

We deliver readiness and alignment — formal interpretation of any regulation stays with your legal counsel.

Governance & Risk

If it goes live next quarter, the assessment starts now.

Something is about to go live, and somebody has to answer for it.

Book a call → Email us →