AI governance framework.

We put in place the standing apparatus that takes over from a one-off remediation: committee, policy corpus, RACI, decision and escalation paths, incident management. One control framework answers the AI Act, ISO/IEC 42001, NIST AI RMF and your sector rules at once.

Duration: 2 to 6 months
Frameworks: AI Act, ISO/IEC 42001, NIST AI RMF
Includes: AI incident management
Output: Operating framework and board reporting

Scope the engagement

Compliance does not last on its own

A system brought into compliance falls out of it at the first change nobody reviewed, and the next system starts from nothing. The governance framework fixes who decides, on what basis and at what point, so that every new system enters a path that already exists.

One body of evidence

Running one exercise per framework multiplies controls and produces answers that contradict each other. We map each control to the obligations it covers, so that the same evidence answers the AI Act, ISO/IEC 42001, NIST AI RMF and your sector supervisor.

Scope

What the framework puts in place.

Bodies, written rules and controls, connected to one another and tried on your real systems before the engagement ends.

AI governance committee. A charter, a membership, a calendar and written decision rights.

Roles and responsibilities. A RACI stating who proposes, who approves, who operates and who controls each system.

Policy corpus. AI governance, use of generative AI, risk management and data.

Decision and escalation paths. Gates before go-live, and the route an alert takes to the person who decides.

Single control framework. Each control is mapped once to the obligations of the AI Act, ISO/IEC 42001, NIST AI RMF and your sector rules.

Registry and cards. The AI system registry and the model, use-case and agent cards, kept current by the process itself.

Monitoring in production. Tracking of drift, incidents and design changes once a system is in service.

Reporting. A dashboard that shows the board what it is accountable for.

Dedicated stream

AI incident management. A response plan, the procedure for reporting serious incidents under Article 73 of the Act, runbooks by type of incident, a tabletop exercise with the teams involved, a post-incident review and an incident register.

How we run it

Five steps, from diagnosis to business as usual.

DiagnosisTwo to four weeks to establish what exists: the bodies, policies and controls already in place, and what is missing.
DesignThe committee charter, the RACI, the policies and the control framework, written with the departments that will have to apply them.
Bringing it into serviceThe committee holds its first sessions on real systems, and the decision paths are tried on live cases.
Incident capabilityResponse plan, reporting procedure and runbooks, then a tabletop exercise to check that the path holds.
Business as usualHandover to your teams, with ongoing support on incident management where you want it.

Deliverables

What you receive.

Committee charter and RACI Policy corpus Generative AI usage policy Control framework NIST AI RMF control mapping Risk management system Model, use-case and agent cards Incident response plan Reporting procedure (Article 73) Runbooks and tabletop exercise Incident register Board reporting

Who the governance framework is for

Executive, compliance, risk, legal, data and IT leaders, and heads of AI governance charged with putting in place an apparatus that still holds once the engagement is over.

Before and after the governance framework

The framework takes over from remediation.

Before · Remediate

AI Act remediation

The gaps closed on one system supply the substance of the framework’s policies and controls.

After · Equip

AI governance platform selection

Once the framework is in place, a tool makes it hold at scale.

Next step

Put the framework in place.

Tell us what already exists, committee, policies or registry. We will come back with a proposed diagnosis, a duration and a fixed fee.

Write to us