Practice · AI governance · A to F
AI governance, built into how AI is delivered.
Six service lines that take an organization from not knowing where its AI is to governing it continuously. Controls run inside intake, delivery, deployment and monitoring, and trace back to the data on the other plane.
Services A to F
From first assessment to continuous operation.
A · Strategy and assessment
Where are we now?
Establish current state before designing anything. Many enterprises cannot see their full AI footprint, so discovery comes first.
- Governance maturity assessment
- AI risk exposure diagnostic
- ISO/IEC 42001 readiness
- AI inventory and shadow-AI discovery
B · Governance design
What should it be?
Architect the system to fit the organization's risk profile and structure. The output is a design that teams can adopt, not a document set that sits on a shelf.
- Operating-model design
- Risk taxonomy and control framework
- Responsible-AI framework
- Policy and standards suite
C · Implementation
Make it real
Embed governance into the systems and workflows where AI is built and run. Controls operate where the work happens and leave evidence as they do.
- Lifecycle governance implementation
- Control operationalization
- Monitoring and assurance setup
- Governance tooling enablement
D · ISO/IEC 42001 and regulatory
Defensible under review
Prepare for external scrutiny. aerais supports readiness; certification is a decision for an independent body, and legal interpretation belongs with your counsel.
- AI management system build
- Regulatory alignment and mapping
- Audit readiness and assurance
- Mock certification review
E · Managed governance
Run it with you
aerais operates the governance function on a continuing basis, so controls keep running after the program team has gone.
- Governance office as a service
- Risk and compliance monitoring
- Control testing and assurance
- Executive and board reporting
F · Specialized
Focused programs
Targeted programs for the hardest areas, delivered on their own or as part of a larger engagement.
- Shadow-AI detection
- AI incident response
- Model-risk governance
- Agentic and RAG governance
F · Specialized programs
Focused work on the hardest areas.
- Shadow-AI detection. Find AI tools and models in use outside approved channels, then bring them into intake without punishing the teams that adopted them.
- AI incident response. Define what counts as an AI incident, who responds, and what evidence is preserved for review and reporting.
- Model-risk governance. Extend model validation and oversight to learned and generative models, including third-party and vendor models.
- Agentic and RAG governance. Control tool access, permissions and retrieval sources, and keep the records that trace an output to the data it drew on.
Standards and scope
Aligned, mapped and honest about the limits.
Work is aligned to ISO/IEC 42001, the NIST AI RMF and the EU AI Act, and mapped through the unified control crosswalk. Alignment is not certification. Confirm current requirements with counsel and the relevant regulators.
The AI plane is half of the chain. Its inventory, assurance and monitoring records link to the lineage and quality evidence from data governance, which is what allows an AI decision to be traced back to its data.
FAQ
Frequently asked questions
Does aerais certify organizations against ISO/IEC 42001?
No. Certification is issued by independent certification bodies. aerais supports readiness: building the AI management system, mapping controls, preparing for audit and running a mock review.
Is the AI inventory a one-time exercise?
It should not be. The inventory is designed to stay current through intake and change controls, and shadow-AI discovery is repeated so new tools and models are found as they appear.
Do you govern agents and retrieval-augmented systems?
Yes, under the specialized service line. Agentic and RAG governance covers permissions, tool access, retrieval sources and the evidence needed to trace an output back to the data it used.
Contact
Make your data and AI provable.
Start with a diagnostic: current-state maturity, risk exposure and a prioritized roadmap. We aim to reply within two business days.