AI Governance Readiness · 4-6 weeks

Your AI governance framework is written.
Can you evidence it operating?

An independent readiness assessment of whether your AI risk controls exist inside your delivery process, or only inside your policy documents. Fixed scope, delivered remotely, mapped to the way your engineers actually ship.

Request a readiness read →

45 minutes with whoever owns your delivery process. You receive a one-page gap sketch. No charge, no obligation.

Where the exposure actually sits

The risk isn’t the framework. It’s the distance between the framework and the release process.

Policy is written by risk. Controls are implemented by engineering. The attestation is signed by you, which means the person carrying personal accountability is the one with the least direct visibility into whether the control is real.

Most organisations will be compliant on paper. Far fewer can evidence a control operating: a re-review actually triggering when a model changed, a human-oversight decision reconstructable from last quarter, a third-party model update noticed at the time rather than in hindsight.

Why now

Regulators and enterprise customers moved at the same time.

Every major jurisdiction now has an AI risk framework in force or in flight, and the transition windows are short enough that the work has to start before the final wording lands. Most of the pressure, though, arrives through procurement. Vendor security questionnaires now routinely ask about AI governance posture, and the answer is increasingly a condition of renewal.

The two elements that take longest don’t change with the final wording: a complete AI inventory, and a materiality assessment actually applied to it.

What we assess
  • ✓AI inventoryEvery model and AI-enabled process in production, including the vendor AI that arrived inside a tool procurement bought rather than something you built.
  • ✓Risk materiality tieringApplied to the inventory across impact, complexity and reliance. Not documented as a methodology and left unused.
  • ✓SDLC control mapWhere each governance obligation lands in your actual delivery process: intake, review, testing, release, change management.
  • ✓Evidence gap assessmentFor each material control, one question: asserted, or demonstrable on request?
  • ✓Third-party AI exposureWhich vendor models changed, when, and what mechanism noticed.
  • ✓Costed remediation roadmapSequenced by exposure and effort, with named owners.
How this differs from a framework engagement

A framework engagement works top-down from policy and produces a governance model. That work is necessary, and you may already have it underway.

This works bottom-up from your release process, and answers a narrower question: did any of it actually get implemented in the way your engineers work?

It is designed to sit alongside existing advisory work rather than replace it. It takes weeks rather than months, and it costs a fraction of the programme it validates.

Straight answers
We already have a Big 4 firm on this.
Keep them. They work top-down from policy and you need that. This asks whether what they wrote got implemented in the way your engineers actually work. A different job, in weeks rather than months, at a fraction of the programme cost.
We are waiting for the final guidelines.
Reasonable, but the two slowest elements do not change with the final text. You will need a complete AI inventory and an applied materiality assessment under any version. Organisations that wait do a twelve-month job in four.
Our engineering team handles this.
They probably handle it well. The question is who signs the attestation, because in most organisations it is not engineering, which means someone carries personal accountability for work they have no independent way to verify.
What data do you need from us?
Configuration and documentation only. No production data, no customer records, no personal data, no source code. Our AI use and client data handling statement is provided with every proposal.
Do you certify us?
No. We assess readiness and map controls. We do not certify, audit for certification purposes, or warrant a regulatory outcome, and nothing we produce is legal advice.
Engagement
Fee
Fixed fee
Scoped and agreed before we start · 50% on signature, 50% at readout · never hourly
Duration
4-6 weeks
100% remote delivery
Output
Board-ready
Live readout plus written assessment

Start with a readiness read

Forty-five minutes with whoever owns your delivery process. You receive a one-page sketch of where your controls are asserted rather than evidenced, and what each would take to close.

No charge and no obligation. If the sketch is useful, we can talk about doing it properly.

Request a readiness read →