AI Governance and Ethics Consulting

AI risk assessments

Risk in AI is specific to the use, not the technology. The same model is unremarkable in one workflow and consequential in another, and the law increasingly turns on that distinction. We assess each use case on the terms regulators are adopting: what decision the system influences, about whom, with what consequence, and with what human involvement.

• Inventory of AI and automated decision systems in use, including the ones procured by business teams without engineering involvement.
• Classification against the EU AI Act risk tiers and the emerging US state rules on consequential decisions.
• Data provenance and training data review, including licensing, scraped sources, and personal data used for training or fine-tuning.
• Assessment of foreseeable harms, including accuracy, bias, explainability, security, and the effect of failure on the person on the other side of the decision.

Ethical frameworks that survive contact with a deadline

A set of principles that no one can apply is a liability, because it establishes a standard you are then measured against. We turn principles into decision rules: what is prohibited outright, what requires review, what requires disclosure to the affected person, and who is empowered to say no. The result is short enough to be read and specific enough to be used.

• Value statements translated into acceptable-use boundaries for each product line.
• A review path with named owners, defined thresholds, and a documented escalation route.
• Human oversight defined as a real intervention with authority, not a person nominally in the loop.
• Transparency language for users, customers and employees that says what the system does without overstating it.

Policy development and responsible implementation

Governance holds when it is wired into how software actually ships. We work with product and engineering to place controls at the points that already exist: intake, design review, procurement, testing, release, and incident handling. Where a control has no natural home, we build the smallest process that will still be followed a year from now.

• AI use policy for employees, covering permitted tools, prohibited inputs, and the handling of confidential and personal data.
• Development standards covering documentation, evaluation, versioning and change management.
• Procurement standards and contract terms for third-party models and AI-enabled vendors, including indemnities and audit rights.
• Incident handling for model failures, harmful outputs, and the discovery of prohibited training data.

Where AI governance meets privacy law

Most AI questions are also personal data questions. Training on customer records, inferring sensitive characteristics, profiling for eligibility decisions, and honouring deletion requests against a trained model are all governed by privacy law that already exists. Running the two disciplines from one desk avoids the common outcome where an AI committee approves something the privacy program has already prohibited.