Method · How we deliver
One system, four phases.
A governance program that aerais builds and then operates with you. Each phase produces working governance, and each becomes the mandate for the next.
Four phases
Assess, Design, Implement, Operate.
Assess
Establish current-state maturity, risk exposure, and the data and AI footprint the organization cannot yet see.
You get: a maturity scorecard, an exposure view and a prioritized roadmap.
Design
Architect the operating model, risk taxonomy, control framework and policies that fit the risk profile.
You get: a target operating model, a control set and a policy suite ready for adoption.
Implement
Embed governance into intake, delivery, deployment and monitoring. Controls that run, not controls on paper.
You get: operating controls, evidence capture and lineage integration.
Operate
Assure, monitor and report continuously, or have aerais run the governance office as a managed service.
You get: control testing, regulatory tracking and executive reporting.
Operating model · Structure
Federated governance with central oversight.
The diagram above shows the structure aerais designs toward. Accountability is distributed to the business, standards are held at the center, and assurance stays independent across three lines of defense.
- First line. Business units, engineering and data teams own AI use and the controls that apply to it.
- Second line. Risk, security and legal provide independent oversight and challenge.
- Third line. Internal audit provides independent assurance over both.
- Center. An AI governance council holds decision authority, and an AI center of excellence holds standards and enablement.
The right balance depends on the organization. A design phase tests the model against your size, structure and regulatory exposure before anything is built.
Working with your teams
Built inside your systems.
aerais does not stand up a parallel governance stack. Controls are attached to the intake forms, delivery pipelines, data platforms and review boards your teams already use, so governance does not depend on a separate tool that someone has to remember to update.
Each phase ends with a handover: what was built, who owns it, how it is tested and what evidence it produces. That is what lets an organization continue on its own, or ask aerais to operate it.
Land and expand
Enter at any maturity level.
Start with a diagnostic, a design effort or an implementation scoped to one area. Each phase leaves working governance behind, and the evidence it produces becomes the starting point for the next. The same method covers data governance and AI governance.
FAQ
Frequently asked questions
Do we have to buy all four phases?
No. You can enter at any phase that matches your maturity. Each phase produces working governance and becomes the mandate for the next one.
What does federated governance mean here?
Accountability for AI sits with the business units that use it, while standards, tooling guidance and oversight are held centrally. Risk functions and internal audit stay independent of the teams they review.
Who in the organization needs to be involved?
Typically an executive sponsor, risk, security, legal and privacy leads, and the data and engineering teams that own the systems. aerais agrees the roles during the first phase.
Contact
Make your data and AI provable.
Start with a diagnostic: current-state maturity, risk exposure and a prioritized roadmap. We aim to reply within two business days.