Services AI governance and compliance
Stop losing a week of senior time to every review.
We build the controls and evidence trail your compliance and audit teams need, so answering how your AI is governed becomes retrieval, not a scramble.
25+ years in enterprise IT, including Fortune 500 regulated-data environments.
No preparation needed. You leave with next steps in writing.
Assess, build, embed
- 25+ yrs enterprise IT
- Fortune 500 regulated-data environments
- Founder-led
Stop losing a week of senior time to every audit, examiner request, and customer security review. Answer "how is your AI controlled" with a record instead of a scramble, including for the AI you already run and did not build.
The problem
Reconstruction is the most expensive way to produce evidence.
The bill for a missing trail arrives twice: once in the days your team spends assembling it while their real work waits, and again in the finding they still cannot close. The trap is timing. A SOC 2 Type II examination tests a population of dated artifacts covering the whole observation window, then samples from it. If an agent acted during that period and there is no retrievable, dated record of what it did, the control has no population to sample and cannot be tested at all. Reconstructing the trail after the audit is announced does not close that gap, it documents it.
What we do
What the next review costs you after this.
- Who can reach what stops being a question that needs researching, because permissioning gives every agent only the access its job requires.
- The decisions that carry real cost have a named approver in the record rather than in somebody's memory of a meeting, because risk-flagged actions route to a human first.
- Audit preparation becomes retrieval rather than reconstruction, because the log is a complete and reviewable account of what the system did, why, and on whose authority.
- Your team maps evidence instead of rebuilding it for each reviewer, because it is structured for the frameworks those reviewers already use. Rebuilding is where most of the preparation time goes.
In practice
Each control, and the exposure or the hours it takes out.
- Permissioning
- Closes the reach an agent never needed in the first place, which is where most of the avoidable exposure sits. Least-privilege access per agent, mapped to your identity provider, so nobody maintains a second access list by hand every month.
- Human-in-the-loop approval
- The costly decisions do not execute before a person has seen them. Risk-flagged actions route to a named human for sign-off, and the approver stays attached to the record afterwards.
- Audit logging, and what it actually buys
- What you are buying is hours off every future review, so it is worth being precise about the guarantee rather than selling it as immutability. An append-only, reviewable record of what the system did, why, and who approved it. Hash chaining makes an alteration detectable, which is tamper evidence, while write-once storage such as S3 Object Lock in compliance mode or an Azure immutable blob container prevents the alteration in the first place. We tell you which one you have and why.
- The four functions we work to
- Govern, map, measure, and manage, the core functions of the NIST AI Risk Management Framework. They are iterative rather than sequential stages, which is why this work does not end at go-live and why the running cost is a small ongoing one rather than a large one-off. The framework is voluntary and non-certifiable, so nobody holds a certification against it, us included.
- Evidence structured for your frameworks
- Cuts the preparation time by removing the translation step, because the evidence already arrives in the shape the reviewer expects. We structure the audit and control evidence in line with the frameworks your reviewers already use: the AICPA Trust Services Criteria behind a SOC 2 report, particularly the logical access, system operations, and change management common criteria, and the ISO/IEC 42001 Annex A control structure for the management system around it. Your compliance and security teams map that evidence to their own obligations. We describe these frameworks, we do not claim status under them.
- The AI you did not build
- The exposure nobody budgeted for is almost always a vendor feature switched on inside a tool you already pay for, which is most of what needs governing. Every one of them is already on an invoice somewhere, so the inventory answers a spend question at the same time as a risk one. We inventory those the same way, record where the data goes and under what agreement, then either bring them under the same controls or write down plainly why they sit outside scope.
What you get
What your compliance team receives, and the work it takes off them.
- A permissioning model and approval-gate policy for your AI, so who can reach what is written down rather than researched at cost every time somebody asks
- Audit logging that produces a reviewable, exportable record with dates that survive sampling, so a request for evidence costs an export rather than a week
- A control and evidence set your compliance team can map to its own obligations rather than rebuild for each reviewer
- A governance gap analysis against your risk and regulatory requirements, so remediation is budgeted rather than discovered
How we deliver it
Built in, because bolting it on costs more.
Retrofitting controls onto a system already in production costs more than building them in, and it still leaves the whole period before the retrofit unproven, which is the part an examiner will ask about. So governance is not added after the fact. It is built into the deployment, and evidence is captured as the system runs, ready when you need to show it. We are not a law firm or an auditor and we do not issue certifications. We build the controls and produce the evidence your own compliance, legal, and audit teams use to meet their obligations.
How a governed agent runs
Where this shows up
See the work in context.
Is this you
- Who this is for
- Best for regulated or high-trust businesses that lose real time to proving how their AI operates, whoever built it.
- Who it is not for
- Not a substitute for your legal counsel or an external audit, and not the place to start if you have no AI running yet and no obligation attached to it. That is strategy and roadmap.
Questions
Questions leaders ask.
- Do you certify us as compliant?
- No. We are not a law firm or an auditor and we do not issue certifications. We build the controls and produce the evidence your own compliance, legal, and audit teams use to meet their obligations. What you are buying is the time and the exposure that comes off them, not a certificate.
- Which frameworks do you work against?
- We structure evidence in line with the frameworks your reviewers use: the AICPA Trust Services Criteria behind SOC 2, the four functions of the NIST AI Risk Management Framework, and the ISO/IEC 42001 control structure, with ISO/IEC 42005 as the guidance on assessing the impact of a specific system and ISO/IEC 42006 as the standard that governs the certification bodies themselves. We describe those frameworks and we do not claim status under them. There is no such thing as SOC 2 certified, and the NIST framework is voluntary and non-certifiable, so your team remains the one that maps evidence to its specific requirements.
- What does the evidence actually look like?
- An append-only record of what each agent did and why, the access it held, and where a human approved a risk-flagged action, exportable for review and dated well enough to be sampled from. In practice it is a directory your compliance lead can hand over, not a project they have to staff.
- Do we need the operating model engagement as well?
- Not necessarily, and we would rather you did not buy one you do not need. If AI runs in one or two places and the pressure is a review with a date on it, this is the whole job. If it runs in five teams and nobody owns it, the controls will keep drifting back out of shape until someone does, and paying to straighten them repeatedly costs more than fixing the ownership once. That is the AI Operating System.
If this is on your plate, let's talk.
A twenty minute intro call is the simplest next step: we work out which step fits, and you leave with one specific thing to act on. If you want the senior read on your business rather than a routing conversation, that is the AI Leverage Briefing.
Within one business dayYour scope is settled, in writing.
What you walk away with Prioritized 90-Day Roadmap · Risk Register · Governance and Compliance Gap Assessment · Safe-to-Deploy Read
25+ years in enterprise IT, including Fortune 500 regulated-data environments.
If AI is not the right tool for your problem, you will hear that from us.