AI inventory & classification
Discover AI systems and use cases across the organisation and classify them by risk.
AI Security
AI Governance, Risk & Compliance
Put structure around how your organisation builds, buys and uses AI. We set up the policies, inventories, risk assessments and controls that regulators, auditors and customers increasingly expect.
The challenge
AI use is spreading faster than oversight. Business units adopt AI tools, developers ship AI features, and leadership often lacks a clear view of where AI is used, what data it touches and which obligations apply.
Typical risks we uncover
- 01No inventory of AI systems or shadow AI usage
- 02Unclear accountability for AI risk
- 03New regulatory obligations, including the EU AI Act
AI Security
What we do
Build an AI governance programme aligned with ISO/IEC 42001, the NIST AI RMF and the EU AI Act.
01
02
Policy framework
Acceptable-use policy, AI development standards and procurement requirements for AI vendors.
03
AI risk assessment
Repeatable impact and risk assessments covering security, privacy, fairness and reliability.
04
Regulatory readiness
Gap analysis against the EU AI Act and sector rules, with a prioritised compliance plan.
05
ISO/IEC 42001 readiness
Design and implement an AI management system ready for certification.
06
Board & executive education
Briefings that help leadership understand AI risk and make informed decisions.
AI Governance & Compliance
How the engagement runs
011/4
Baseline
Inventory AI use and assess current governance maturity.
022/4
Design
Define roles, policies, risk methodology and controls proportionate to your risk.
033/4
Implement
Embed governance into procurement, development and change processes.
044/4
Operate
Monitor, report and prepare for audit or certification.
01
What you receive
- AI system inventory and risk classification
- AI governance policy set
- AI risk and impact assessment methodology
- Regulatory gap analysis and roadmap
- ISO/IEC 42001 readiness assessment
- Executive briefing pack
02
Frameworks & standards
FAQ
Frequently asked questions
Talk to a consultant about your environment. The first call is free and under NDA if you need it.
Talk to an expert01Does the EU AI Act apply to companies outside the EU?
It can. The Act applies to providers placing AI systems on the EU market and to deployers whose AI outputs are used in the EU, regardless of where they are established. We help you determine your exposure.
02Should we pursue ISO/IEC 42001 certification?
If you build AI products or customers ask for assurance, certification can be a strong differentiator. For others, aligning with the standard without certifying is often enough.
03We already have ISO 27001. Does that help?
Significantly. ISO/IEC 42001 follows the same management-system structure, so much of your existing governance can be extended rather than rebuilt.
Related services
AI Security
AI & LLM Security Testing
Adversarial testing of LLM applications, RAG pipelines and AI agents, before attackers do it for you.
Learn more Advisory & ComplianceCompliance & Certification Readiness
Prepare for ISO 27001, SOC 2, PCI DSS and regional regulations with controls that work in the cloud.
Learn more Advisory & ComplianceVirtual CISO & Security Advisory
Senior security leadership on demand: strategy, governance and board reporting.
Learn moreNext step
Let's map your cloud and AI risk in a single conversation.
Book a free 30-minute scoping call with a senior consultant. No sales script: we listen, ask the right questions and tell you honestly where we can help.