Product 02

AI Compliance

A decision and evidence layer for teams that need AI policy, risk and oversight to work in the flow of delivery.

Designed outcome

From static policy to a live control surface teams can use and leaders can inspect.

Best fit

For organisations that need a consistent way to identify AI use, assign accountability, apply controls and retain reviewable evidence.

01

Use-case register

Create a common view of AI use cases, accountable owners, intended decisions and relevant risk context.

02

Control evidence

Map policy expectations to the decisions, evaluations, approvals and artefacts that show how a system is operated.

03

Human oversight

Keep review authority, exceptions and escalation routes explicit wherever AI influences consequential work.

Operating sequence

A product shaped around decisions, not feature inventory.

The sequence is adapted to the organisation, but every step leaves an inspectable artefact and a clearer owner.

  1. 01

    Discover

    Build the use-case inventory

    Capture purpose, users, data, decisions, deployment context and accountable owners in one reviewable record.

  2. 02

    Classify

    Apply the governance route

    Use organisational policy and relevant obligations to determine proportional controls and review gates.

  3. 03

    Evidence

    Collect proof in the workflow

    Link assessments, evaluations, approvals, incidents and change decisions to the use case they govern.

  4. 04

    Review

    Maintain a current posture

    Reassess material changes, exceptions and expiring evidence instead of treating approval as a one-time event.

What the work produces

Concrete assets for the people who will operate the system.

  • 01AI use-case register
  • 02Accountability and review matrix
  • 03Control and evidence map
  • 04Assessment and approval workflow
  • 05Exception and escalation process
  • 06Portfolio-level oversight view

Clear boundaries

What this product does not claim.

  • It is not legal advice or a certification.
  • It does not replace accountable risk, legal or security functions.
  • It does not present a control as effective without supporting evidence.

Decision questions

Questions buyers should ask early.

Can it align with our existing policies?
Yes. The control model is configured around approved organisational policy and applicable obligations rather than introducing a parallel rulebook.
Is it only for systems already in production?
No. The strongest path begins during intake and design, then follows the use case through evaluation, approval and operation.
What can leadership see?
A portfolio view of ownership, review state, exceptions and evidence health—without hiding the underlying record.

Working session

Put your highest-consequence decision on the table.

In one focused conversation, we will clarify the operating constraint, the evidence available and the smallest credible path forward.

Book a working session