01
AI governance & responsible use
Policy, decision rights, an AI register, risk classification, and responsible-use controls that make AI adoption defensible.
AI & technology assurance
Build the assurance before you need it.
This is the work that happens before an audit, and the reason an audit goes well. Governance sets the terms on which technology may be used; oversight and assurance make the resulting claims checkable.
Perspective
The objective is not to slow innovation down. It is to make decisions traceable, risks explicit, controls proportionate, and accountability clear enough that the technology can be used with confidence — by the organization deploying it and by whoever later asks how the decision was reached. When somebody does ask, that examination is an audit, and it sits under Auditing rather than here.
Specialist services
Three disciplines, engaged separately or together.
Governance sets the terms on which AI may be used at all. Model oversight makes a specific system’s behaviour visible and controllable over its life. Technology assurance covers the platforms and data everything else depends on. None of the three is an audit — for independent examination against evidence, see AI audits and technology audits.
02
AI model oversight & lifecycle
Intended use and context of use, evaluation strategy, human oversight design, drift monitoring, and control of model and supplier change.
03
Technology assurance
Assessment and design for cloud services, data flows, interfaces, and digital products supporting regulated work — before they are audited.
Why one practice
The questions do not stay in their own boxes.
An AI feature arrives inside a SaaS platform, trained on data you did not curate, hosted on infrastructure you do not operate, supporting a decision you remain accountable for. Governance that only looks at one of those layers answers the wrong question.
- Intended use, which determines how much of everything else matters
- Data provenance, suitability, and the integrity of the path it travelled
- Model behaviour, its limitations, and what happens as it changes
- Platform and infrastructure control, including what the supplier operates
- Human oversight positioned where it can genuinely catch an error
- Governance, decision rights, and the escalation route when something is wrong
- The record: what a reviewer will need to reconstruct the decision later
Typical triggers
When organizations bring this work in.
Rarely at the start of an AI programme, and usually at one of these five moments.
Adoption has outpaced governance
AI tools are in use across the organization and nobody can produce a current list, an owner, or an approval.
A supplier has added AI
A validated platform releases AI features, and the existing validation and supplier evidence no longer covers what the system does.
A decision needs signing
A go-live, a regulatory submission, or a customer commitment requires somebody to state that the system is fit for its intended use.
A regulation now applies
The EU AI Act, ISO/IEC 42001, or a customer requirement introduces obligations that have to be mapped and evidenced.
Something behaved unexpectedly
Output was wrong, oversight did not catch it, and the organization needs an independent view of scope and cause.
Approach
Context first. Evidence throughout.
A consistent sequence across the practice, scaled to the engagement in front of us.
- 01
Establish context
Clarify the regulated process, intended use, accountable owners, users, data, and the material decisions involved.
- 02
Map the system
Trace technical and organizational dependencies across the full service and supplier landscape.
- 03
Test assurance
Assess evidence, controls, limitations, monitoring, and human oversight against the risk that is actually present.
- 04
Prioritize action
Translate observations into proportionate decisions, remediation, and governance improvements.
Start a conversation
Start with the decision in front of you.
A short discussion is usually enough to establish which of these services fits, and how much of it you actually need.