AI Governance
Can the organisation show it has tested these risks and addressed what was found?
Governance is the evidence layer around the three risks we test. It shows your board, regulator and clients that you know what AI you use, who owns it, how it was tested and what you did about the findings.
We review
- An inventory of AI in use, including unapproved tools
- Named ownership
- Risk classification
- Whether human oversight is meaningful
- Audit trails
- Incident detection and response
- Supplier controls
- Ongoing re-testing
Governance only holds up if the other three have actually been tested. Without testing, it's just paperwork.
The risks governance has to evidence
AI Security
Can the AI be manipulated, or made to expose information or take actions it shouldn't?
AI Reliability
Are its answers accurate and consistent?
AI Fairness and Inclusion
Do different groups of people receive equally good outcomes?
Mapped to the frameworks your regulator uses
Our assessment is mapped to the EU AI Act and ISO/IEC 42001, so you can see where you stand against each. Whether you are compliant depends on your systems and how they're used. Most detailed obligations apply to high-risk systems and EU-facing organisations, and we'll tell you honestly which apply to you.