Startup Consultancy Services
Buy blocks of my time and tap straight into 24+ years of hands-on CTO experience. No retainer, no long contract - just the senior guidance you need, when you need it.
Read moreRisk & Assurance
AI Security & Compliance Governance
AI governance fails in two directions: frameworks so heavy nothing ships, or so absent that nobody knows which tools are processing customer data. The useful middle is a proportionate framework - light controls on low-impact use, real scrutiny where decisions affect people, and evidence produced as a by-product of the work.
When this helps
You are probably reading this because of one of these.
- Staff are using AI tools with company data and no approval process
- A customer security questionnaire has asked about AI and you cannot answer it
- You need DPIAs for AI processing and have no template or precedent
- Regulatory expectations are tightening and nobody owns the response
How we help
A delivery sequence, not a discovery phase that never ends.
Every stage produces something you can act on independently, so the engagement can stop at any point without leaving you stranded mid-programme.
Inventory
Find every AI system, vendor, and shadow tool in use, and what data each one touches.
Classify
Rate each use by impact on people and on the business, so controls can be proportionate rather than uniform.
Control
Apply the controls each tier warrants: access, logging, human oversight, testing, and vendor assurance.
Evidence
Produce the artefacts an auditor or enterprise customer will ask for, generated by the process rather than assembled in a panic.
Efficiencies driven
The measurable change this engagement is aiming at.
Where teams usually start
- Shadow AI tools processing data unrecorded
- Uniform controls that block low-risk use and miss high-risk use
- Evidence assembled reactively when an auditor asks
Where the engagement leaves you
- A maintained inventory with owners and data classifications
- Controls proportionate to assessed impact
- Evidence produced continuously as a by-product of the process
Tiered
Controls by assessed impact
Templated
DPIAs and assessments
Continuous
Audit evidence, not reactive
What you receive
Artefacts that outlive the engagement.
- AI system and vendor inventory including shadow usage
- Impact classification model with tiered control requirements
- DPIA templates and completed assessments for live use cases
- Model risk management and human oversight procedures
- Audit-ready evidence pack and customer questionnaire responses
Next step
Review AI governance.
A short call is usually enough to work out whether this is the right engagement, and what it would cost. If it is not, I will say so.
Engagement
Risk & Assurance
Evidence, not intent