Data and process audit
Quality, access, lineage, and retention for the data each idea depends on. Mapped against the workflows where AI would remove work, not add review.
Fund the right AI pilots. Run them safely.
An audit of your data, processes, and risk posture. Three pilots ranked with budgets. Then the governance — use policy, model inventory, EU AI Act mapping — to scale what works.
Readiness and governance
Know what’s ready. Govern what ships.
Half the work finds the pilots worth funding. The other half makes sure they survive legal, security, and the first audit.
Three pilots, ranked
Not thirty ideas. Three, each scoped with a budget, an owner, and a success metric.
ValueRiskBudget
AI use policy
Which tools staff may use, with which data, and when output needs a human check. Written so people follow it.
Approved toolsData rulesDisclosure
Model and vendor inventory
Every model, API, and AI feature in use — owner, purpose, data shared, and contract terms in one register.
ModelsVendorsOwners
AI risk register
Each use case scored for harm, likelihood, and detectability. Mitigations named, owners assigned, reviewed on a schedule.
EU AI Act classification
Each use case mapped to its risk tier, with the obligations that follow. Prepared alongside your legal counsel.
The shortlist
Pilots ranked by value and risk, not by hype.
Most AI roadmaps rank ideas by potential. We rank them like any engineering bet: value, effort, confidence, and risk, written down. The shortlist is one finance can fund and operations can run.
- Each pilot sized in engineering days plus model and vendor cost.
- Each scored against the goals your leadership agreed in week one.
- Risk rated across data, regulatory, and reputational exposure.
- Vendor-neutral. “Don’t build this” is a valid recommendation.
Governance
Governance mapped to the EU AI Act and ISO/IEC 42001.
The EU AI Act (Regulation (EU) 2024/1689) sets obligations by risk tier, and they phase in over several years. ISO/IEC 42001 is the management-system standard for AI. We build one governance set that answers both.
- AI use policy and roles, aligned to the standard’s policy and leadership clauses.
- Model and vendor inventory kept current as a living register, not a spreadsheet snapshot.
- Risk and impact assessments run per use case before it reaches production.
- Transparency duties built in: users are told when they are talking to AI.
- Certification stays an option later — it is issued by an accredited body, not by us.
3
Pilots on the shortlist, each with a budget and an owner
Week 1
Goals agreed before any pilot is scored
4
Governance artifacts: policy, inventory, risk register, Act mapping
Neutral
Model choice made per use case, not per vendor relationship
The audit talked us out of two pilots and into one. The use policy went to every team the same week.
Questions
What buyers ask us first.
Do we need governance if we’re only piloting?
Start light. A use policy and an inventory come before the first pilot. The risk register and Act mapping grow as pilots approach production.
Does the EU AI Act apply to us?
Likely, if you offer AI systems in the EU or their output is used there — even from outside the EU. We map each use case to its tier and obligations, and work alongside your legal counsel rather than replacing them.
Will this get us ISO/IEC 42001 certified?
Certification comes from an accredited certification body, not from us. We structure your policy, inventory, and risk process to align with the standard, so an audit becomes a next step rather than a rebuild.
What do you need from our side?
A sponsor, read access to your data catalogue or warehouse, and interviews with the people who own the processes in scope.
How is it priced?
A fixed fee, quoted after a scoping call. Readiness and governance can be scoped together or separately.
Ready when you are
Tell us where your team thinks AI fits.
A 30-minute call. You leave knowing whether to audit first, govern first, or go straight to a pilot.