Prove your AI is under control
Sooner or later someone will ask what AI you are running, what it is allowed to decide on its own and who signed off the last time it was wrong. We help organisations be able to answer that, with evidence rather than assurances.
The question that is coming
AI governance is usually treated as a paperwork exercise until the first time someone external asks a direct question. Then it becomes urgent.
That question arrives from different directions depending on who you are. A procurement team asks it in a supplier questionnaire. An auditor asks it during certification. A regulator asks it after an incident. A customer asks it before signing. The wording changes but the substance does not: show me that your AI is governed, not improvised.
Most organisations discover at that moment that they cannot produce a list of the AI systems they are running, let alone a risk rating or an owner for each one. Shadow adoption through everyday tooling means the real inventory is almost always larger than the official one.
What we do
Governance work only earns its keep if it reduces real risk and survives contact with an auditor. We keep it practical.
Inventory
Find what is actually running, including the AI arriving through tools you already pay for, and record what each system touches.
Classify
Rate each system by risk and regulatory exposure, so effort lands on what matters rather than being spread evenly across everything.
Control
Design the oversight: what the system may decide alone, what needs approval, who owns it and how that approval gets recorded.
Evidence
Make the controls produce their own proof, so the audit trail is a by-product of normal operation rather than an annual scramble.
Where organisations get caught out
Assuming ISO 27001 covers it
It secures the information an AI system touches, but says nothing about model behaviour, output bias, explainability or who is accountable for an automated decision. It is a strong base to extend from, not a substitute.
Assuming EU rules do not apply
The EU AI Act reaches organisations outside the EU whose systems are placed on the EU market or whose output is used there. Being UK-based settles nothing on its own, and the scoping question is worth answering deliberately.
Governing only the official systems
The AI inside your existing SaaS, copilots and plug-ins is still your exposure. If it drafts a customer response or influences a decision, it belongs in the inventory whether or not it was procured as AI.
Policy without mechanism
A written policy that says a human reviews output means little if the system does not require or record that review. We prefer controls that cannot be quietly skipped under delivery pressure.
We have built this, not only advised on it
Aqyron, one of our live products, exists specifically to solve this problem for compliance-led businesses. It tracks certification evidence and renewals, surfaces AI findings and holds each one for human approval before it becomes a record, writing every state change to a tamper-evident log.
That product encodes the position we take in advisory work: no AI output becomes a compliance record without a named human approving it, and that is an architectural property, not a toggle. It is a useful reference point when designing oversight for your own systems.
Common questions
Does the EU AI Act apply to a UK organisation?
It can. The regulation reaches providers and deployers whose AI systems are placed on the EU market or whose output is used in the EU, regardless of where the organisation is established. A UK business serving EU customers, or supplying a product an EU customer embeds, may fall in scope. The first step is a scoping assessment rather than an assumption either way.
What is ISO/IEC 42001 and do we need it?
ISO/IEC 42001 is the international management system standard for artificial intelligence. It is structured like ISO 27001, covering governance, roles, risk treatment and continual improvement rather than any specific model or technology. It is certifiable, which makes it useful when customers or regulators want independent evidence that AI is managed rather than improvised.
How does the UK regulate AI?
The UK has taken a sector-led approach, with existing regulators applying AI principles within their own remits rather than a single cross-cutting statute. In practice your AI obligations are shaped by the regulator you already answer to, alongside UK GDPR, sector codes and National Cyber Security Centre guidance on secure AI development.
We already have ISO 27001. Does that cover AI?
Partly. It covers the security of the information an AI system touches, but not the behaviour of the system itself. It does not address model risk, data and output bias, explainability, human oversight or accountability for an automated decision. Those gaps are what an AI-specific management system closes, and an existing ISO 27001 programme gives you a strong base to extend from.
What does good AI governance evidence actually look like?
An auditor is looking for a short list of concrete things: a current inventory of AI systems with a risk rating for each, a named owner per system, a record of what each is permitted to decide on its own, logged human approvals where it is not and a trail showing the controls were operating rather than merely documented. If those exist and are current, most AI audit conversations become straightforward.
Could you produce your AI inventory this week?
If the honest answer is no, that is the normal starting position and a short scoping conversation is usually enough to size the work. No obligation either way.