Discipline
AI governance and compliance
Being able to answer the regulator, the auditor and the board with evidence, not with confidence.
Your legal team knows the rule better than we do. What we bring is knowing what you will be asked to show, and in what format: eight years answering to a financial regulator without a single finding.
9 services in this discipline
This is yours if
Three signs that this is yours.
- You have to authorize a go-live you did not build.
- You have models or agents deciding things in production.
- A process that matters depends today on a vendor you do not control.
Use this today, without hiring anyone
Independent implementation review
Eight questions to demand from the builder before signing acceptance. A builder who answers all of them, with evidence, did the work properly.
- What cases was it measured against, and who chose them? If the builder chose them, it is not a measurement, it is a demo.
- What is the error rate, measured how and over what sample?
- Reconstruct one specific decision from last week for me: what went in, what came out and why.
- What can the system do without a human approving, and who set that limit?
- What stops it, who can stop it and in how long?
- What gets logged, how long is it kept and who can consult it six months from now?
- What happens when the vendor changes version without notice?
- Who answers for a wrong decision: you, us or the model vendor?
It comes from Independent implementation review. Every service in this discipline brings its own.
The 9 services in this discipline
Would your AI pass an independent audit in 90 days?
The integrator says it works and I am the one who signs.
Pass, conditional pass or fail, issued by someone who did not build it and takes no commission from anyone.
See the situationAutomated decision governanceWho answers for what your AI decides, and with what evidence?
The regulator asks why that case was rejected and nobody can reconstruct it.
What a machine decides inside your organization, with what consequence, who answers for each decision and what evidence is left behind.
See the situationAgent continuity planningHave you ever tested the failure plan for your AI agents?
The process already depends on the agent and nobody remembers how it was done by hand.
Plan B, written and actually tested: the agent gets switched off and how long your team takes to pick it up gets measured.
See the situationAI regulatory evidence fileCan you prove in writing what a machine generates and decides in your organization?
They are asking me to declare what a machine decides and nobody has the list.
The inventory of where you generate and decide with AI, the determination of which obligation falls on each point and the file that proves it.
See the situationShadow AI inventoryWhich AI tools are in use without anyone having approved them?
I know there is AI in use and I do not know which tools or with what information.
What is being used off the record, with what data and with what exposure, and what is best approved, replaced or cut.
See the situationTrust design for decision systemsWhy is your team not using the assistant you already rolled out?
We rolled it out to four hundred people and forty open it. Nobody says it is bad.
Why your people do not trust the system, with the exact moments where trust is lost and the redesign of each one.
See the situationWorkshop: how to audit your vendorHow do you question a vendor without being technical?
My team signs service agreements we cannot enforce afterwards.
So that your team can question a vendor without being technical, with the script built on your own contract.
See the situationAgentic operation guardrailsHow far can an agent go on its own, and who stops it?
The agent no longer just answers: it executes. Nobody defined how far it can go on its own.
What your agent can do on its own, what requires approval, what stops it and who answers when it acts wrongly. Built and tested with a real stop.
See the situationNon-human identity governanceWho answers for what your service accounts and your agents do?
We have service accounts with privileges and nobody knows who answers for them.
The inventory of everything that is not a person and has access, with a named owner, documented rights and its rotation and revocation rule.
See the situationThe other disciplines
AI strategy
12Automation and agents
8Data and analytics
5Cybersecurity and resilience
4Critical operations and crisis
5Mergers, separation and diligence
4Cost of AI and software
5Infrastructure and platform
5Or see it by the cycle: Vanguard, Forge and Taskforce. Or by the question you arrive with, in the seven questions. And if you already know the name, there is the full list.
What is the decision you have in front of you this week?