Practice · Two planes, one system
One integrated practice across data and AI.
A data governance service line and an AI governance service line that share one control crosswalk and one chain of custody. Enter at any point, then scale into transformation and a managed governance function that aerais runs with you.
The two planes
Where the chain begins, and where it ends.
DG-1 to DG-5 · Data governance
Where the chain begins
Discovery and catalog, classification and data security posture, lineage and metadata, data quality, and privacy operations. Every data control also feeds the AI plane.
Data governanceA to F · AI governance
Where the chain ends
Strategy and assessment, governance design, implementation, ISO/IEC 42001 and regulatory work, managed governance, and specialized programs for shadow AI, incidents, model risk, agents and RAG.
AI governanceOne system
Not two silos.
Every engagement can span both planes. Data flows into AI, AI risk traces back to the data, and one chain of custody covers the path. The same evidence proves a control on both sides, so a control is tested once and reported many times.
That is the reason the practice is organized around the seam. Lineage, quality gates, blast radius, erasure and the control crosswalk are each described on The Chain.
You do not have to buy the whole system at once. A typical path moves from a diagnostic to design, then to transformation, and then to managed governance. The method and the engagement tiers describe each step.
Aligned, not certified. Work is aligned to ISO/IEC 42001, the NIST AI RMF, the EU AI Act and DAMA-DMBOK, and mapped to DCAM and CDMC. Alignment is not certification.
FAQ
Frequently asked questions
Do engagements cover both data and AI governance?
They can. Work often starts on one plane, and the shared control crosswalk and chain of custody mean the other plane can be added without rework.
Is this a software platform?
No. aerais is a firm that builds governance into your systems, delivery lifecycle and data, and then operates it with you. It does not license software.
Where do we enter?
Anywhere: a diagnostic, an AI inventory, a classification effort or an ISO/IEC 42001 readiness review. Each entry point is scoped so it can grow into transformation and managed governance.
Contact
Make your data and AI provable.
Start with a diagnostic: current-state maturity, risk exposure and a prioritized roadmap. We aim to reply within two business days.