AI Governance & Compliance

AI governance is the set of policies, controls, and documentation an organization uses to manage how AI systems are built, procured, deployed, and monitored. It matters because regulators, customers, and courts now ask the same question: can you show how this model reached that decision, and who was accountable for it? An organization that cannot answer holds a liability, not a capability.

The frameworks have arrived — NIST AI RMF, ISO 42001, the EU AI Act — and boards are being asked which ones apply. Most companies then discover their AI inventory is a guess. Fixing the inventory is where governance actually starts.

Often, yes. The EU AI Act follows the GDPR playbook: it is extraterritorial. If your AI system is placed on the EU market, or its output is used in the EU, the Act can apply regardless of where your company is incorporated. A United States company with no EU office can be in scope through a single customer, distributor, or deployment.

The practical work is exposure mapping: which of your systems touch the EU, what risk category each falls into under the Act, and what the obligations and penalties actually are. We do that mapping in the first sprint, in writing — without dramatizing the risk to sell you remediation you do not need.

ISO 42001 certifies an AI management system the way ISO 27001 certifies an information security management system. Readiness runs in a fixed order: build a complete AI inventory; classify each system by risk; define policies and human-in-the-loop controls; assemble the management system documentation; run an internal gap assessment against the standard's controls; then bring in the auditor.

We take clients through readiness, not certification itself. We are not an audit body and will not pretend to be one. What we deliver is the state where the audit is boring.

We anchor AI governance consulting in NIST AI RMF because it is the frame US regulators and enterprise buyers already recognize, and it maps cleanly onto ISO 42001 and EU AI Act obligations instead of competing with them. One control set, three reporting views.

The work follows our standard engagement models. A two-week Diagnostic Sprint produces your AI inventory, risk classification, and jurisdiction exposure map. Design & Build, six to twelve weeks, stands up the governance framework, human-in-the-loop policy, and audit-ready documentation. A Strategic Advisor retainer covers regulatory change and model reviews if you want it. Clean exit at every stage. Full IP transfer. The framework is yours.

You leave with artifacts, not aspirations: a queryable AI inventory covering built, bought, and embedded models; a risk classification with written rationale for each system; a governance framework mapped to NIST AI RMF, ISO 42001, and the EU AI Act; human-in-the-loop policies specific enough to operationalize; and documentation structured for audit, not for the shelf.

Where governance requires evidence from the systems themselves — logging, evaluation traces, access controls — we specify it as engineering work, because that is what it is. Thinking traces, not black boxes.

Most AI governance consulting is written by people who have never deployed a model. We build them — private LLMs our clients own outright, AI systems running in production — so our governance reflects how models actually fail, drift, and leak. A policy written without that knowledge is a wish.

The practice sits inside strategy, compliance and transformation, and it extends naturally to AI acquired through M&A, where governance gaps become deal terms. If your governance is broken, we will say so. Then we will fix it.