AI Governance review
- 4 to 6 weeks
- For Boards · For Executives
- Online · On site
An independent review of how your company oversees AI. In four to six weeks, we list the AI systems in use, review how they are approved, supervised and reported, test this against the EU AI Act and ISO/IEC 42001, and set priorities for what to fix first. The board or committee receives a written opinion it can minute.
Is this for you?
Boards, audit or risk committees and executive teams that want evidence that AI is under control, for example ahead of a deadline under the EU AI Act, or because there is no complete list of the AI systems in use.
Commissioned by the board, a committee or the executive team. We interview 8 to 12 people across management, IT, risk, legal and the business.
None required.
Core objectives
- 01List the AI systems in use, including tools staff use on their own
- 02Review policies, the approval route, incident handling, audit trails and board reporting
- 03Test them against the EU AI Act and ISO/IEC 42001, the international standard for AI management, and the NIST AI Risk Management Framework where relevant
- 04Set priorities for what to fix first
Boards are increasingly expected to show that AI is under control, and not only to state it.
That takes evidence: a register of systems, clear approvals, records of incidents and consistent reporting. The stakes are real: using AI in ways the EU AI Act prohibits can lead to fines of up to €35 million or 7% of worldwide annual turnover, whichever is higher.
How it works
- 01 Scope and document request
- 02 Interviews, inventory and sample checks
- 03 Analysis and draft opinion
- 04 Presentation to the committee
The review runs in four steps: scope and document request; interviews, an inventory of AI systems and sample checks of approvals and logs; analysis, a draft opinion and a factual check with management; and the presentation to the committee. The review is not legal advice; where legal interpretation is needed, we work alongside your legal counsel.
Deliverables
- A written opinion for the committee
- A register of the AI systems found
- A map of AI uses by risk level
- A gap analysis against the EU AI Act and ISO/IEC 42001
- The board oversight pack: six documents a committee can table and an auditor can test
- A prioritized action plan with owners
What comes next
AI Governance review
An independent written opinion the committee can minute, and a clear order of work.