The model is governed; the use is not.
The same model can be low impact in one workflow and material in another because risk follows purpose, people, data, autonomy and consequence.
AI governance
Govern the use, not only the model.
We build the operating layer that determines whether an AI use remains authorised, what must happen when it does not, and what evidence the institution can rely on.
Where control fails
Approved AI drifts in repeatable ways.
Governance effort commonly attaches to an artefact and a point-in-time approval. Risk moves with use, context, consequence and change.
Approval decays.
A new data source, model version, user group, tool connection or decision context can invalidate the conditions originally approved.
Monitoring is represented as control.
A log produced after external effect is evidence of what happened, not a control over whether it should have happened.
Human oversight is stated, not engineered.
Effective oversight needs timely evidence, capacity, authority, an action window and a defined safe state when the issue cannot be resolved.
Minimum operating model
Four elements around each consequential use.
The structure is installed use case by use case, then scaled through common policy, taxonomy, workflow and technical services.
01Authorised-use baseline
02Runtime decision
03Enforceable outcome
04Operational evidence
Material change re-enters at 01
Consequential-use pilot
A bounded 90-day implementation path.
One real use forces the organisation to resolve authority, ownership, control and evidence in operating conditions rather than in abstraction.
Days 0–30Define
Select one use. Name business, risk and technical owners. Set authorised and prohibited purposes, scope, risk limits, control points and success criteria.
- Approved authorised-use baseline
- Mapped decision rights
- Initial control set
- Success and exit criteria
Days 31–60Instrument
Bind events to the use and baseline version. Configure identity, data, model and purpose checks. Calibrate review and safe-state behaviour.
- Resolved test events
- Working reviewer workflow
- Failure-mode results
- Initial evidence chain
Days 61–90Operate
Run live or near-live activity. Assess exceptions, contextual drift, control performance and risk translation. Decide whether to scale, remediate or suspend.
- Operating evidence pack
- Risk-appetite view
- Accountable exception decisions
- Scale recommendation
Practice coverage
From mandate to operating evidence.
The work can address one control gap, one use case or the enterprise governance capability.
01
Mandate and accountability
Board and executive mandate, policy architecture, committees, role design, decision rights and risk ownership.
02
Risk and impact
Use-case inventory, classification, impact assessment, third-party risk, privacy, legal and regulatory integration.
03
Evaluation and controls
Model and system evaluation, guardrail requirements, human oversight, monitoring, escalation and safe-state design.
04
Production governance
Authorised-use baselines, change triggers, runtime control points, exception management and operational evidence.
Framework alignment
Designed for the institution’s actual obligations.
Engagements can be benchmarked to ISO/IEC 42001, the NIST AI Risk Management Framework, applicable sector requirements, national guidance and privacy law. Framework mapping supports the operating design; it does not replace it.
ISO/IEC 42001NIST AI RMFSector risk requirementsPrivacy and data governanceNational AI guidanceInternal risk appetite
Start with one real problem
Put one consequential use under operational control.
A bounded pilot is often the fastest way to resolve the organisation's real governance decisions and produce evidence that can scale.