Request a scoping call Contact
← All services

Services / Governance & Risk

Know the risk. Keep control of the decision.

Request a scoping call →

Understand where AI is used, who is accountable and what needs to be evidenced. We establish governance and assess individual systems so your organisation can decide with a clear view of the risks and obligations.

Business leaders · Risk and security teams · Data Protection Officers · Consultancy partners

Controls → evidence → decisionIllustrative
Representative assessment: security, privacy and governance checks produce evidence for a decision. Gaps can require a hold or further review.

Governance & Risk

AI Governance

Governance your organisation can operate, with clear owners and decision criteria.

AI can spread faster than accountability. Clear ownership and proportionate controls help your teams make decisions and respond to customers, auditors and regulators.

You need oversight of AI use, evidence for procurement or a clearer view of your obligations.

Work we can scope

  • AI inventory, classification and accountable roles
  • Policy, approval gates and evidence requirements
  • Mapping to applicable regulation and recognised standards
  • Data Protection Officer (DPO) advisory and ongoing governance advice

What you receive

  • Governance operating model
  • Control catalogue
  • Ownership and gate criteria
  • Regulatory gap assessment

Scope follows your AI estate, jurisdictions and existing governance; advisory support is available.

Phased scope, ongoing advice available

Request a scoping call →

Governance & Risk

AI Risk & Impact Assessment

An evidence-led assessment of risks, impacts and the conditions for a decision.

A useful system can still create privacy, security or operational harm. Assessing the system in context exposes gaps before they become costly decisions.

A system needs approval, handles personal data or is changing in ways that affect its risk.

Work we can scope

  • AI risks, affected people and potential impacts
  • Security, fairness, oversight and operational resilience
  • Data Protection Impact Assessments (DPIAs), where applicable
  • Control evidence, residual risk and reassessment criteria

What you receive

  • Risk and impact assessment
  • DPIA where applicable
  • Risk and control register
  • Decision record and conditions

One defined system or processing activity; assessment depth follows context and applicable requirements.

Scoped assessment, repeatable as systems change

Request a scoping call →

Risk & impact method

An assessment that
informs a decision.

Assess the system in context, examine the control evidence and document the residual position. An assessment can lead to redesign, escalation or a decision not to proceed.

  1. 01Context
  2. 02People
  3. 03Data
  4. 04Model
  5. 05Decisions
  6. 06Controls
  7. 07Residual risk

  • Proceed

    Residual risk is acceptable as designed.

  • Proceed with controls

    Acceptable once named controls are in place and owned.

  • Redesign

    The residual position cannot be reached from this architecture.

  • Escalate

    Specialist or legal assessment required before a decision can be taken.

  • Do not proceed

    The impact cannot be controlled to an acceptable level.

Representative decision structure. Approval remains with your authorised decision-maker.

Regulatory readiness

Understand what applies.
Evidence what you do.

Jurisdiction, intended use and your role determine the obligations. We map the relevant requirements into the governance and assessment work.

Regulation

EU AI Act

Likely role and classification per use case, the technical and organisational obligations that follow, existing controls mapped against them, and the evidence gaps that remain.

Management system standard

ISO/IEC 42001

An AI management system structure — policy, objectives, roles, lifecycle controls and internal audit hooks — shaped so certification is achievable rather than assumed.

Risk framework

NIST AI RMF

Govern, Map, Measure and Manage translated into named owners, stage gates and measurable evaluation requirements rather than a reading exercise.

Principles-based regime

UK regulatory expectations

The cross-sector principles and the expectations of the regulators that actually supervise you, reconciled with the controls you already operate.

Patchwork regime

US federal and state rules

No single federal statute, so the obligations follow the states you deploy into — Colorado, Texas, California and the New York City hiring rules among them — while consumer-protection and employment regulators apply existing law to AI systems in the meantime. Reconciled into one control set with the state-by-state deltas named, rather than a separate reading for each jurisdiction.

Supervisory rules

Sector-specific requirements

Financial services, insurance, health and public sector obligations — model risk management, operational resilience, safeguarding and procurement rules — folded into the same control catalogue.

We deliver readiness and alignment — formal interpretation of any regulation stays with your legal counsel.

Next step

Bring clarity to the decision.

Bring the system, the governance gap or the decision that needs evidence.

Request a scoping call → Email us →