AI Governance Framework
What needs to be governed.
A catalogue of controls with owners and evidence, mapped from ISO/IEC 42001, the EU AI Act and NIST AI RMF, with a four-level maturity scale. It answers what has to be in place.
AI, data and governance consulting · Latin America
Experience
AGORA Advisory is a consultancy in AI strategy, data and governance. It works with the organisation's leadership and with the teams that will sustain the result after the project ends.
The experience we show is the prior track record of the firm's members, at previous employers and programmes. It is not AGORA Advisory's client portfolio and does not imply a current commercial relationship with those organisations.
Founder
Pedro Pistoni
Founder · AGORA Advisory
Lawyer (Universidad de Mendoza) and MBA in General Management from Universidad Torcuato Di Tella, with a specialisation diploma in Analytics & Business Intelligence. He has spent more than fifteen years at the intersection of regulation, data and operations.
At the City of Buenos Aires government he led Ciudad 3D, the city's digital twin, for three years; it won the Infrastructure & Building award at the 2022 World Smart City Awards. He also directed the build and operation of the data lake at the digital transformation secretariat. He led public-sector consulting portfolios in programmes funded by the World Bank and the IDB in Peru, Colombia and Bolivia, and coordinated the corporate planning of an international sporting event under its organising committee's supervision.
As head of operations at an AI lab he led, in the role of management-system ambassador, that organisation's ISO/IEC 27001 recertification. He is a visiting lecturer on UTDT's Digital Technology capstone and the author of the AI governance framework behind AGORA's methodology.
AGORA Advisory
Why AGORA exists
Most organisations are already using AI without having decided to: it arrived through a tool, a vendor, or one team's initiative. Adoption moved faster than the rules, and the result is that nobody can say precisely where it is being used, with what data, and who is accountable when a decision goes wrong.
That gap is not filled by a technology vendor, who sells the tool, nor by an audit, which verifies afterwards. What is missing is someone who organises the decision beforehand: what is worth doing, in what order, with what controls and what evidence. AGORA exists to occupy that place, without selling the tool that would then have to be governed.
Working principles
Judgement before tooling
Deciding what to do with AI is a business decision. Technology is chosen after understanding the problem, not before.
With the teams, not instead of them
The knowledge has to stay in the organisation. We direct implementation alongside internal teams and existing vendors.
Evidence over declaration
A control exists when it can be shown to operate. We prefer a short verifiable scope to a broad programme without backing.
Explicit limits
We say what we don't know and what falls outside scope. A recommendation without sufficient information is flagged as such.
Two frameworks of our own
We do not work from a bought template or from a borrowed methodology. AGORA has two proprietary frameworks that do not overlap: one defines what needs to be governed, with its G0–G3 maturity scale, and the other how the work gets delivered. Together with the journey, they are the three models explained in How we work.
Reference frameworks: ISO/IEC 42001, the EU AI Act and NIST AI RMF. The control catalogue was built on them; that does not imply certification of the firm or automatic compliance.
AGORA Delivery Framework
How the work gets delivered.
Five phases each with a central question, five dimensions crossing them, and independent review at every crossing. It answers how you get from an idea to sustained value.
Prior experience
Where the judgement comes from. This is work carried out by AGORA's members at previous employers and programmes.
These are not AGORA Advisory contracts, they are not the firm's revenue, and they do not imply a current commercial relationship with those organisations. They are published because they explain where the judgement comes from, not to present them as the firm's own portfolio.
- Public sector
- Track record at the City of Buenos Aires digital transformation secretariat and in public-sector consulting programmes funded by the World Bank and the IDB in Peru, Colombia and Bolivia.
- Health
- Led a data protection and governance framework for a strategic partnership in the health sector, with risk registers and audit cadence aligned to ISO 31000.
- Water and sanitation
- Directed territorial integration strategies for water utilities in Peru, within a World Bank funded programme.
- Transport and infrastructure
- Track record at the City of Buenos Aires subway operator, in a World Bank funded process optimisation programme in Bolivia, and in the corporate planning of an international sporting event under its organising committee's supervision.
Specialist network
Senior-led, not delegated
The person who talks to leadership is the person who leads the work. There is no junior team executing behind a proposal signed by someone else. Technical execution is carried out by the client's teams and their vendors; AGORA leads, documents and holds the line on judgement.
Specialist network
The firm's core is its leadership. The network joins by scope and by agreement; it is not a permanent headcount.
Depending on the scope of each agreement, the firm brings in specialists in data governance, risk and audit.
- Data governance and operating model design.
- Risk, regulatory compliance and readiness for external reviews.
- Systems audit and control design.
- Programme direction with distributed teams and vendors.
Their participation is defined in writing in each agreement: which profiles take part and at which points.
Book a conversation
A 30-minute conversation to understand the context and see whether it makes sense to continue. Scheduling is handled in Calendly, an external service.