AI governance
Your vCISO for the agentic era.
AI agents now read your data, call your systems and act on your behalf. Your customers, auditors and regulators want to know that is governed. We have taken multiple clients through ISO 42001 certification, and we use AI across our own practice, so our guidance comes from doing the work.
What’s included
Practical expertise, shaped around your business.
ISO 42001 certification
An AI Management System designed around how you build and use AI, taken all the way through the certification audit.
AI risk and impact assessments
Structured assessments of each AI system: the data it touches, what could go wrong, who it affects and how you control it.
Guardrails for AI agents
What your agents can access, which actions they can take on their own, and where a human must approve. Designed in, not bolted on.
AI policy and acceptable use
Clear rules for how your team uses AI tools and which data can go into them, written so people follow them.
AI vendor due diligence
Assess the AI providers and models you depend on: where your data goes, how it is used and what the contract really says.
Answers for enterprise buyers
Clear, evidence-backed answers to the AI sections of security questionnaires and customer due diligence.
How it works
A clear, structured engagement.
- Step 1
Map
An inventory of the AI you build, provide and use, including agents, models and AI features in your tools.
- Step 2
Assess
Risk and impact assessments for each system, prioritised by what it touches and what it can do.
- Step 3
Govern
Policy, roles, approval processes and agent guardrails your engineers can work with.
- Step 4
Certify
Internal audit, then ISO 42001 certification when your customers or market call for it.
The outcome
What you can expect.
- A credible answer when enterprise customers ask how your AI is governed
- AI agents with clear limits, owners and oversight
- One integrated management system for ISO 27001 and ISO 42001
- Readiness for AI regulation as it arrives in your markets
FAQ
Common questions.
Have you done ISO 42001 before?
Yes. We have taken multiple clients through ISO 42001 certification.
Do we need ISO 27001 first?
No, but the two share the same management system structure, so they fit together well. Many clients run them as one integrated program, or add ISO 42001 once ISO 27001 is in place.
We only use AI tools. We do not build models. Does this apply to us?
Yes. ISO 42001 covers organisations that develop, provide or use AI. If AI touches your customers’ data or makes decisions in your product, it needs governance.
Let’s get your compliance program right.
Tell us where you are and where you need to be. We will spend 30 minutes understanding your situation and give you an honest view of the fastest sensible path.