Organizations deploying AI
AI is influencing decisions about customers or employees and no one has classified the risk.
AI Governance
Govern the AI you build, buy, and already use
Artificial intelligence is arriving faster than the policies meant to govern it, and regulation is moving behind it. We inventory the AI systems in use across your organization, classify each use case by risk, and establish governance on ISO/IEC 42001 and the NIST AI Risk Management Framework. Where AI sits inside your product, we assess its security directly.
Frameworks and standards in this practice
- ISO 42001
- NIST AI RMF
- US state privacy laws
- EU AI Act
- US state AI laws
Who it is for
Three situations this practice answers
Product companies embedding AI
AI features ship inside the product and customers have started asking how they are secured.
Regulated organizations
Emerging AI regulation concentrates its obligations exactly where your use cases sit.
What it solves
The problems clients bring to this practice
- Nobody can produce a list of the AI systems the organization is using.
- Employees are pasting confidential information into public assistants.
- An AI vendor's data handling and training provenance were never assessed.
- AI features in the product have never been tested for prompt injection or data leakage.
- Governance was written as a policy statement with no intake, assessment, or monitoring behind it.
What you receive
Named deliverables, not a summary of findings
Every engagement in this practice produces artifacts somebody outside your organization can read and rely on.
- An inventory of the AI systems you build, buy, and have embedded, with every use case classified by risk.
- An AI governance program covering decision rights, policy, use case intake, risk assessment, oversight, and monitoring, mapped to ISO/IEC 42001 and the NIST AI Risk Management Framework.
- A gap assessment against the EU Artificial Intelligence Act, the Colorado Artificial Intelligence Act, the Texas Responsible Artificial Intelligence Governance Act, and sector supervisory expectations.
- A shadow AI finding: unsanctioned use, the data exposure it creates, and sanctioned replacements with acceptable use standards and technical controls.
- An AI vendor and model assessment covering data handling, training provenance, security, reliability, contract protections, and regulatory obligations.
- A security assessment of the AI features in your product: prompt injection, data leakage, output handling, access control, tenant isolation, and evaluation practice.
- Recurring assessment of deployed systems with the documentation regulators expect.
How an engagement works
The sequence, and what each step produces
Described as a sequence rather than a schedule. Duration depends on scope, and is agreed in the statement of work.
01
Inventory
Discover the AI systems in use, whether built, bought, or embedded in something else.
02
Classify
Rank each use case by the consequence of it being wrong, and by the obligations that attach to it.
03
Govern
Put decision rights, intake, assessment, and oversight in place, mapped to ISO/IEC 42001 and the NIST AI Risk Management Framework.
04
Monitor
Reassess deployed systems and keep the documentation regulators expect current.
Services
7 services in this practice
Each has its own page setting out what it covers, who it is for, and what you receive.
- AI Governance Program DevelopmentDesign an AI governance program on the NIST AI RMF and ISO/IEC 42001: decision rights, policy, use case intake, risk assessment, oversight, and monitoring.Governance
- AI Regulatory Readiness AssessmentGap assessment against the EU AI Act, the Colorado AI Act, the Texas Responsible AI Governance Act, and sector expectations for AI accountability.Regulatory
- AI System Inventory and Use Case Risk ClassificationDiscover and catalog the AI systems in use across your organization, whether built, bought, or embedded, and classify each use case by risk.Governance
- Shadow AI Discovery and GovernanceFind unsanctioned AI use, measure the data exposure it creates, and replace it with sanctioned tools, acceptable use standards, and technical controls.Governance
- AI Vendor and Model AssessmentEvaluate AI providers and models for data handling, training provenance, security, reliability, contract protections, and regulatory obligations.Transactions
- AI Product Security and AssuranceAssess the AI features in your product for prompt injection, data leakage, output handling, access control, tenant isolation, and evaluation practice.Product security
- AI Risk Assessment and Ongoing MonitoringRecurring assessment of deployed AI systems for fairness, reliability, transparency, security, and regulatory fit, with the documentation regulators expect.Risk and maturity
Questions
Frequently asked questions
What is ISO/IEC 42001?
ISO/IEC 42001 is the international standard for an artificial intelligence management system. It specifies requirements for establishing, operating, and continually improving the policies, processes, and controls an organization uses to develop, provide, or use AI responsibly, and it can be independently certified.
What is shadow AI?
Shadow AI is the use of artificial intelligence tools by employees without the organization's approval or oversight, such as pasting confidential information into public chat assistants. It creates data exposure, intellectual property, and regulatory risk that a governance program must discover and address.
Who needs an AI governance program?
Any organization that develops AI, embeds it in products, or allows employees to use AI tools with company data. Governance becomes essential when AI influences decisions about customers, employees, credit, health, or other consequential outcomes, which is where emerging regulation concentrates its obligations.
Related
Practices most often engaged alongside
Regulatory and Legal Compliance
Technical assessment behind privacy, healthcare, financial, and government obligations, often under counsel.
View practiceProduct and Application Security
Find what an attacker would find in your product, your APIs, and your cloud, before a customer's security review does.
View practiceCyber Risk and Maturity
Measure maturity against NIST CSF or CIS, quantify exposure in dollars, and know what to fix first.
View practiceStart with a confidential conversation
Thirty minutes on where your program stands against this standard, and what would have to be true for the answer to hold up.