We set risk tiers, autonomy limits and eight practical controls, mapped to the NIST AI RMF and ISO/IEC 42001. Low-risk work moves fast, high-risk work gets the scrutiny it needs, and every decision leaves evidence.
Find every AI system in use, including vendor tools, and score current practice against the NIST AI RMF.
Agree risk triggers, autonomy levels and the decisions that always need a human.
Define how each of the eight controls runs, who owns it and what evidence it produces.
Build the controls into your delivery gates and set up a monthly and quarterly assurance rhythm.
The tier decides which controls apply and who signs off. That keeps scrutiny where it matters and lets everything else move.
It affects customers or the public, safety, money, legal rights or eligibility, or an agent takes actions on its own.
All eight controls in full. Independent validation. Business and risk sign off every release.
It informs staff decisions in day-to-day operations, with a person making the final call.
Standard validation, a human review of sampled outputs, and monitoring with alert thresholds.
Internal analytics or productivity tools with no personal data and no external impact.
Baseline controls, checked automatically in the pipeline, with periodic spot checks.
No control is just a policy statement. Each one has an owner, a way of running and a record your auditors can inspect.
| Control | How it runs | Evidence produced |
|---|---|---|
| Governance | A cross-functional review sets the risk tier and control set for each product | Product register with tier, owner and decisions |
| Explainability | Explanation method chosen by model type and audience, tested before release | Model card with explanation samples |
| Human oversight | Approval points set by tier; people decide irreversible or customer-facing actions | Approval record for each action |
| Auditability | Inputs, outputs, model versions and agent actions logged in your storage | Logs kept under your retention rules |
| Privacy | Privacy check at discovery; data minimized and masked outside production | Privacy assessment and data lineage |
| Security | Threat model per product; tested for prompt injection, data leakage and unsafe tool use | Security test results and access reviews |
| Model monitoring | Accuracy, drift, bias and cost thresholds per model, with alerts and retraining triggers | Live dashboard and monthly control report |
| Model risk management | Validation by people outside the build team, scaled to tier and repeated on change | Validation report and model inventory |
Everything we design traces back to the four functions of the NIST AI Risk Management Framework, and can support an ISO/IEC 42001 management system.
We score your practice across strategy, governance, day-to-day practice and culture, then plan the move to the next level.
Early AI use, few rules, little visibility.
Pilots running; principles drafted but uneven.
Tiers and controls applied to most new work.
Controls automated, evidence on tap, regular testing.
Governance is a speed advantage and shapes strategy.
A product without its evidence pack does not go live. No exceptions for "just a pilot".
Every control's status, open findings and exceptions, reviewed with the portfolio.
A sample of controls tested end to end, with findings tracked to closure.
