AI, data and governance consulting
AI governance
Who decides, who is accountable and with what evidence, when a system takes part in a decision that affects people.
What it solves
Governing AI is not slowing it down. It is being able to answer three questions at any moment: where it is being used, who authorised each use, and what happens if a decision goes wrong. Without those answers, an organisation cannot scale without carrying a risk it never measured.
The work starts with the inventory — what systems exist, who uses them and with what data — and continues with assigning accountability. There is no governance without a name behind each decision.
How we do it
On a methodological catalogue of 325 controls built from ISO/IEC 42001, the EU AI Act and NIST AI RMF. Selection is proportional: not every control applies to every organisation, and applying all of them would be as useless as applying none.
Each control ends up with a named owner and associated evidence. A policy nobody can demonstrate is operating is a document, not a control.
What it is not
It is not an independent audit or a certification. We organise readiness and set out in writing what is missing and in what order; external verification, where it applies, is carried out by an accredited third party.
Frequent questions
- Do I need governance if I am still running pilots?
- Yes, and it is the best moment. A pilot already uses real data and already makes decisions. Organising it now costs a fraction of what it costs later, with fifteen tools in use and nobody sure who approved them.
- Does this certify me against ISO/IEC 42001?
- No. No consultancy certifies: certification is issued by an accredited body. What we do is leave the organisation in a position to present itself, with controls operating and evidence available.
- Is it useful if I already have a data committee?
- Useful, and usually faster. The committee already answers who decides; what is missing is translating that into controls with evidence, and a scope that includes AI, which was not always covered.
- How long does it take?
- The initial assessment is four weeks. What follows depends on the scope the assessment itself recommends, and that call is the client's, not ours.