AI Governance
A professional service that builds your AI governance with you: policies, design principles, a governance model, staff guidelines, AI FinOps, the regulations that apply and a plan for shadow AI.
A professional service that builds your AI governance with you: policies, design principles, a governance model, staff guidelines, AI FinOps, the regulations that apply and a plan for shadow AI.
Problem
AI arrives sideways. A team tries a tool, another builds a prototype, someone pastes a contract into a chatbot. Meanwhile the EU AI Act, NIS2 and DORA ask who is accountable for what. AI Governance builds your rules with you, so AI can spread without the risk spreading with it.
What You Get
Business work with your leadership, security, legal and DPO. Written from what you really use, not from a template.
You know what the EU AI Act, NIS2 and DORA mean for your AI, what you need to register, and you have the documents to show it.
One register of what is in use, who is accountable, how risky it is and when it is next reviewed.
A one-page guideline on which tools to use and what not to put into them. Your staff stop guessing.
AI spend tied to teams and purposes, with budgets and approval limits.
How to find the AI tools people use outside IT, and what happens when you do: approve, replace or stop.
Also works if you only use ready-made tools such as Copilot and have no AI platform of your own.
Approach
A professional service: a short project with your leadership, security, legal and DPO, and we write the documents. When you run AI on AWS or Microsoft, Managed AI and Managed Agents put the rules to work.
Professional service
Clear rules for AI, written from what you actually use. No maturity score, no slide deck: the documents your people, auditors and builders need.
What the AI Governance Model delivers. Not one thick policy nobody opens: each document is written for the people who have to use it.
00
Assessment
Provider or deployer? What counts as high risk for you, which deadlines apply, and how NIS2 and DORA touch your AI. A short document everything else depends on.
Legal · Management
01
Governance model
Roles and responsibilities, lifecycle, risk tiers, human oversight, deviations, traceability and AI literacy.
Leadership · Auditors
02
Technical principles
Agent identity, action permissions, logging, testing, rollback and the emergency stop. Autonomy level is a decision, not a setting.
Architects · Developers
03
Staff guideline
Which tools you may use, what you may put into them and what you stay responsible for yourself. Plain language, one page.
Everyone
R
System register
Not a document but a register you keep up: system, owner, risk tier, autonomy level, obligations and next review.
Governance owner
Professional service
AI Governance
Run
None needed
A fixed-price project, priced per organisation. The monthly services are Managed AI and Managed Agents.
If you run AI on AWS or Microsoft, Managed AI switches your rules on in the platform: cost controls, policies, security, guardrails and identity. Shadow AI it detects comes back to your governance model.
Managed Agents watches your agents and manages every version from release to retirement, under the design principles you agreed.
AI is only as good as the data it can see. Data classification and ownership come from the Managed Data Platform, so AI uses your data under the same rules as your people.
EU AI Act
The dates your governance model has to plan for, as they stand after the Digital Omnibus on AI.
2/2025
Prohibitions and AI literacy
Prohibited practices banned. Providers and deployers must support AI literacy among their staff.
8/2025
General-purpose AI
Obligations for providers of general-purpose AI models.
8/2026
Transparency
People must be told when they are dealing with AI, and some AI-generated content must be marked.
12/2027
High-risk systems, Annex III
Obligations for standalone high-risk systems, such as AI used in recruitment, credit or critical infrastructure.
8/2028
High-risk in regulated products
Obligations for AI embedded in products already covered by EU product-safety law, Annex I.
Dates per Regulation (EU) 2024/1689, as amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744, which moved the high-risk deadlines (summary). Your assessment document says which of these actually bind you.
How It Goes
Most organisations have their rules signed off within three weeks. Then the managed services put them to work.
About ten hours of your people's time: a two-hour orientation for leadership and four two-hour workshops with 35 questions. Then we write the documents in a day.
An honest look at the AI tools already in use, including the ones nobody approved.
Which data may go where, what a person must approve, and what stays off limits.
Owners, accountability and how often you review.
The five documents, signed off by a named business owner, and the list of controls to switch on in your platform.
AI Governance ModelRules on paper only go so far. When you run AI on AWS or Microsoft, two managed services turn them into daily practice.
Managed AI runs your cost controls, policies, security, guardrails and identity in your own cloud.
Managed AIManaged Agents watches your agents and manages every version from release to retirement.
Managed AgentsFAQ
Field Notes
What we learn helping organisations set rules for AI.
AI
9 min read
AI governance is not a compliance cost but a business investment. How to build the financial case, what the return looks like, and what happens to organizations that skip this step.
AI
6 min read
Most organizations will face this in 2026: a CFO asks, what is our AI strategy? Why the document-driven approach is failing, what the question really exposes, and how disciplined organizations answer it.
AI
10 min read
The next AI advantage belongs to companies that move fast and stay in control. Why governance is the steering wheel that lets you put AI into production safely, and how to start with one real use case.
Start with the rules. In a few weeks you know what you use, what is allowed and what to build next.
