Govern · AI Governance
AI governance an auditor can follow and an engineer can live with.
We build your AI management system once, map it to ISO/IEC 42001, the NIST AI RMF and the EU AI Act, and back it with evidence from real testing instead of policy alone.
- Typical length
- 6–12 weeks
- Frameworks
- ISO/IEC 42001, NIST AI RMF, EU AI Act
- Our role
- Readiness and implementation; we don't certify
Workspace · AI risk registerSimulated environment, real workflow.
Scope
What we cover.
Pick what matters for this engagement. We help you scope it in the first call.
ISO/IEC 42001
Design and run an AI management system (AIMS): scope, AI policy, roles, impact assessments and Annex A controls, ready for a certification body.
NIST AI RMF
A current and target profile across Govern, Map, Measure and Manage, including the Generative AI profile (NIST AI 600-1).
EU AI Act readiness
Your role for each system (provider, deployer, importer, distributor), its risk class and the obligations that follow.
AI inventory
Every model, agent, copilot and AI vendor in use, with owner, purpose, data and risk tier.
AI risk register
Risks and impacts per system, with treatments, owners and review dates your board can read.
Test-backed evidence
Red-team findings and retests filed against the controls they prove, so evidence is real, not just written.
Methodology
How the engagement runs.
Five steps, the same on every engagement, with a named lead from scoping to sign-off.
- 01
Inventory
Find every AI system in use, built or bought, and who owns it.
- 02
Classify
Assign EU AI Act roles and risk classes, and decide which frameworks apply.
- 03
Gap
Assess against ISO/IEC 42001 and the NIST AI RMF on one crosswalk, so each gap is fixed once.
- 04
Build
Write the policy set, impact assessments and procedures with your teams, and wire in oversight.
- 05
Evidence
Test the controls, file the evidence and prepare for the certification audit or customer review.
AI readiness
Score the programme before you build it.
We rate six areas against ISO/IEC 42001 and the NIST AI RMF in the first two weeks, then plan the 90 days that close the biggest gaps. Toggle to compare.
- Today
- After 90 days
| Area | Today | After 90 days |
|---|---|---|
| Governance | 2.0 | 4.0 |
| Data | 3.0 | 3.5 |
| Model risk | 1.0 | 3.0 |
| Transparency | 1.5 | 3.0 |
| Monitoring | 1.0 | 3.5 |
| Third parties | 2.0 | 3.0 |
Simulated environment, real workflow.
Crosswalk
Do the work once. Satisfy four frameworks.
Pick a control theme to see where it sits in each framework, and the one deliverable that covers all of them. Clause names are public; the mapping is our working method.
Control theme
Security testing: one piece of work, four frameworks
ISO/IEC 42001
A.6 Life cycle (V&V)
NIST AI RMF
MEASURE 2.7
EU AI Act
Art. 15 robustness, cybersecurity
SOC 2 / ISO 27001
ISO 27001 A.8.29
Simplified mapping for illustration; we confirm the exact clauses per engagement.
Deliverables
What you walk away with.
Written for the engineers who fix things and the leaders who fund them.
- Named lead for the whole engagement
- Critical issues flagged the same day
- Retest included
AI inventory and classification
Every system with owner, EU AI Act role, risk class and applicable frameworks.
Crosswalk and gap report
ISO/IEC 42001, NIST AI RMF and EU AI Act on one control set, with the gaps ranked.
Policy and procedure set
AI policy, acceptable use, impact assessment and oversight procedures, written for your teams.
Evidence file
Control evidence, including red-team retests, organized for your auditor or certification body.
FAQ
Questions we hear most.
Can you certify us to ISO/IEC 42001?
No. Certification comes from an accredited certification body. We get you ready and support you through the audit.
Does the EU AI Act apply to us?
It can apply to companies outside the EU that place AI systems on the EU market or whose AI output is used there. We start by working out your role per system.
When do the EU AI Act obligations apply?
They phase in over several years, and some dates have been under review. We plan against the current official timeline at the start of each engagement.
How does 42001 relate to ISO 27001?
They share the same management-system structure, so an existing ISMS gives you a head start. 42001 adds AI-specific risk, impact and life-cycle controls.
Related
Often paired with.
Scope your AI Governance engagement.
A 30-minute call with a senior practitioner. You leave with a scope, a timeline and a fixed quote.