AI governance for regulated industries.
01When the regulator asks, the answer has to be in writing.
AI governance for companies that answer to an inspector, an auditor or a supervisor. The board, the policy and the register — built so the decision trail holds up.
What changes when you are regulated.
The governance itself does not change much. You still need a group of people who decide what AI gets used, a policy staff will read, and a register of every system you run.
What changes is the standard of evidence. In most companies the register answers a customer’s procurement questionnaire. In yours it has to stand up to someone with the authority to stop you trading.
That means dated decisions, named approvers, and a change history that explains why a model was updated and who signed it off. The work is the same. The record-keeping is not.
We do AI governance. We do not do computer system validation.
- The board
- The policy
- The register
- Framework mapping
- Computer system validation
- SOPs
- Inspection readiness
We do AI governance. We do not do computer system validation, and we are not your quality function.
If you run a GxP environment you already have people who own validation, SOPs and inspection readiness. We build the AI governance layer so it sits alongside that, agrees with it, and does not create a second version of the truth.
Firms that claim to do both usually do one of them badly.
Four deliverables, written for an audit reader.
Who decides, how often they meet, what they can approve without escalating. Minuted, with decisions dated and attributed.
Short enough to be read, specific enough to be enforced, and versioned so you can show what the rules were on any given date.
Every AI system you run, its owner, what it touches, and what could go wrong. The document an auditor will ask for first.
Which obligations apply, against the standards that come up in audit and procurement.
The US AI Risk Management Framework. Voluntary, and the one enterprise buyers ask about.
The international standard for running an AI management system. Certifiable, so customers increasingly ask for evidence.
Law if you sell into the EU. The strictest rules moved to December 2027, and August 2028 for AI built into regulated products.
The regulation your clients answer to goes here.
Worth talking to us if a regulator, auditor or large customer has started asking how you govern AI, and the honest answer is that nobody owns it yet.
We chair these boards, and we build the systems underneath them. When a board asks whether something can be built, what it costs to run, or why the pilot behaved differently from the demo, the answer comes in the room.
Questions regulated buyers ask.
What is AI governance in a regulated business?
The same work as anywhere else: a board that decides which AI gets used, a policy staff will read, and a register of every system. What changes is the record. Decisions are dated, approvers are named, and every change has a reason someone signed off.
Do you do computer system validation?
No. Validation, SOPs and inspection readiness belong to your quality function. We build the governance layer that sits alongside it. If you need validation done, we will say so and stay out of the way of whoever does it.
How does this sit alongside our existing quality system?
It points to your quality system rather than copying it. Register entries reference your validation records, policy changes go through your document control, and board decisions use the approval routes you already have. The aim is one version of the truth.
Which frameworks do you work to?
NIST AI RMF, ISO/IEC 42001 and the EU AI Act, mapped against the obligations that actually apply to you. The rules your sector regulator sets sit on top of those.
What does an auditor actually ask for?
Usually the register first: what AI you run, who owns it and what it touches. Then evidence that decisions were made on purpose — minutes, dates, named approvers — and a change history that explains why a model was updated and who signed it off.
Do we need a board, or will a register and an owner do?
Often a register and a named owner is enough to start, and we will tell you so. A board earns its place when several teams are deploying AI and decisions need to be consistent and minuted. If you are not there yet, start smaller.
Get in touch.
A call with a principal to find what’s worth building, and whether we’re a fit.