01 / 03 —— THE RISK
AI is already in your business
Staff use public AI tools, vendors switch on AI features and teams build their own pilots. Most boards cannot yet say where AI is used, what it decides or who is accountable.
Good governance answers those questions and keeps answering them as AI spreads, without slowing the teams that deliver value.
02 / 03 —— WHAT WE PUT IN PLACE
What we put in place
01
AI policy and principles
A clear, board-approved policy on where and how AI may be used.
04
Vendor and model due diligence
Questions and checks for the AI features in the software and services you buy.
A living register of AI systems, each classified by risk and purpose.
05
AI literacy for staff
Role-based training so people use AI well and know its limits.
03
Controls and human oversight
Proportionate controls, testing and human review for higher-risk uses.
06
Assurance and board reporting
Regular reporting to the board on AI use, risks, incidents and benefits.
03 / 03 —— OUR PRINCIPLES
Governance that enables
01
Proportionate
Controls match the risk: light for everyday tools, deeper for AI that affects people, money or safety.
02
Explainable
Every AI system has an owner, a purpose and a record you can show a board or a regulator.
03
Built into delivery
Governance sits inside your AI programme and ERP processes, not in a separate document.
FAQ —— QUESTIONS LEADERS ASK
AI governance: common questions
What does AI governance cover?
An AI policy, an inventory of every AI system you use or build, risk classification, human oversight and board reporting. Together they let you explain every AI system you run.
Do we need AI governance if we only use off-the-shelf AI tools?
Yes. AI inside the software you buy (copilots, ERP assistants, chatbots) still carries data, accuracy and regulatory risk. It belongs in your inventory and under your oversight.
How does this relate to the EU AI Act and ISO/IEC 42001?
The EU AI Act sets legal duties based on each system's risk level. ISO/IEC 42001 is a certifiable standard for running an AI management system. We build governance that meets both, so you do the work once.
Which frameworks do you work with?
The EU AI Act, ISO/IEC 42001, the NIST AI Risk Management Framework and the OECD AI Principles.
What does the board receive?
A regular report on your AI portfolio covering the systems in use, their risk level, any incidents, and the decisions that need board sign-off.