AI governance that survives an audit.
What AI governance advisory actually is.
AI governance advisory is setting up how your company decides what AI it uses. Who signs off. What's off-limits. Where the decision gets written down so someone can find it in eighteen months when a customer asks.
You end up with three things: a group of people who meet and decide, a policy short enough that staff actually read it, and a register listing every AI system you run.
It's a different job from a compliance report or a maturity assessment. Those tell you where you stand today. This is about the decision you have to make next month, on something nobody has thought of yet.
You probably need it once two or three teams are using AI without talking to each other, or the first time a client's procurement form asks how you govern it.
Most firms offering AI governance consulting sell you the framework. We sit in the chair and run it with you.
- A standing body
- The board
- A readable rule set
- The policy
- A living record
- The register
Everything else feeds one of these three.
Most AI governance fails in one of three ways.
Five things you keep.
- 01
The board itself
Who's on it, how often it meets, what it can decide without going upstairs. Five to seven people. Any more and you've built a reporting forum.
- 02
A written policy
Short, and written in the words your team already uses. If someone needs to ring Legal to work out whether they're allowed to paste a customer email into ChatGPT, the policy has failed.
- 03
The risk register
One list. Every AI system, who owns it, what could go wrong, and what it's worth. Most companies have the first two in a spreadsheet somewhere and the last two nowhere at all.
- 04
Framework mapping
Which obligations actually apply to you, against the three standards that come up in procurement and audit.
NIST AI RMFThe US National Institute of Standards and Technology's AI Risk Management Framework. Voluntary, and the one American enterprise buyers ask about most.
ISO/IEC 42001The international standard for running an AI management system. You can be certified against it, so customers increasingly ask for evidence.
EU AI ActLaw, if you sell into the EU. The strictest rules moved: what was an August 2026 deadline is now December 2027, and August 2028 for AI built into regulated products. Plenty of published advice has not caught up.
- 05
Six chaired sessions
We run them with you. The board isn't real until it has turned something down that someone senior wanted, and that meeting tends to be the one that decides whether any of this sticks.
0505 / 09Eight weeks to stand it up. Six sessions to hand it over.
We can keep chairing afterwards if you want. Try not to need it. Boards that depend on an outside consultant to convene them tend to quietly stop when the budget gets reviewed.
We chair these boards. We also build the systems.
Most AI governance is sold by law firms and risk consultancies. They write good policy. But sit in one of these meetings and most of the agenda is technical: can this actually be built, what does it cost to run, why did the demo work when our pilot didn’t. A policy specialist has to take those away and come back.
We run AI governance boards and we run AI delivery. Same people, so the answer comes in the room.
Chairs the AI governance board at a Fortune 500 global beauty brand. Has delivered 60+ projects with zero compliance incidents across clients.
LinkedIn →We sit in the chair.
This isn't a framework we hand over and leave you to run. We chair six full sessions with you, including the one where something gets refused.
We build the systems too.
The same people run our AI delivery work. When the board asks whether something can be built, or what it costs to keep running, that gets answered in the meeting.
We take no vendor money.
No commissions, no resale, no partner tier we're protecting. The board can decide to switch off something you already pay for and nobody in the room loses by it.
One way in, one way to continue.
We don’t resell platforms and we take no vendor commissions. If a spreadsheet and one named owner would do the job at your size, we’ll tell you that on the first call and you can go and do it.
Before you get in touch.
What is AI governance advisory?
It's the work of setting up how a company decides what AI it uses, who signs off, and where those decisions get recorded. You come out of it with a group that meets and decides, a written policy, and a register of every AI system you run. A compliance audit is a different thing — that looks at what you already have and tells you where the gaps are.
What is an AI governance board?
A small group with the authority to approve or refuse AI use cases, and a habit of writing down why. Usually five to seven people meeting monthly. The thing that separates it from a committee is that it can decide on its own rather than making a recommendation to someone else.
Do we need one?
Once a few teams are using AI without talking to each other, or a client's procurement form asks how you govern it. Under that, a spreadsheet and one named owner will usually do, and we'd rather say so than sell you a board you don't need yet.
How is this different from an AI policy?
The policy tells people the rules. The board handles everything the policy didn't see coming, which in this field is most of it. Policies written a year or two ago have generally stopped describing how their own companies use AI, because there was nobody whose job it was to keep them current.
Who should sit on it?
Someone who owns the technology, someone who owns the risk, someone who owns the P&L, and whoever runs the function most affected. Keep it to five or seven. Once you're into double figures people start reading updates to each other instead of deciding anything.
How long does it take to stand up?
About eight weeks to stand it up, then six chaired sessions before handover. The exact timing depends on how complex your setup is — how many systems are in play, how many regulators you answer to. Writing the documents takes days. The rest is sitting through decisions with you until the meeting runs on its own. Allow around four weeks between first enquiry and kick-off.
Does this cover the EU AI Act?
Yes, and against the dates that apply now rather than the ones originally announced. The EU changed the timetable in July 2026. The strictest rules — which cover AI used for things like hiring and credit decisions — moved to December 2027, and to August 2028 for AI built into regulated products. Three sets of rules do apply today. You have to tell people when they are dealing with AI or looking at something AI generated. Companies that supply the large general-purpose models have their own duties. And a short list of uses is banned outright.
How is this different from what a law firm or risk consultancy offers?
They'll write better policy language than we will, and if that's what you need you should use them. The difference shows up in the meeting. Someone asks whether a thing can actually be built, what it costs to run, or why the vendor demo worked and your pilot didn't. Ours is chaired by the person who chairs the AI governance board at a Fortune 500 brand, and he can answer without taking it away.
Which frameworks do you work to?
NIST AI RMF, ISO/IEC 42001 and the EU AI Act. Most US clients are asked about the first in procurement and the second in audit. The third is law if you sell into Europe. We map your register and policy against all three rather than picking one.
Tell us what you’ve approved.
Half an hour with a principal. We’ll tell you whether you need a board yet, and if a spreadsheet would do instead, we’ll say that.