Defined risks. Tested controls. Traceable evidence.
We help qualify AI systems for a defined use, document their limitations and prepare the evidence needed for the applicable review process. Human accountability, controlled release and ongoing monitoring remain part of the architecture.
Qualify a system for its intended use.
The model is one component. Governance also covers data, retrieval, tools, workflow, human decisions, operating conditions and changes. The assessment route depends on the system and its intended use.
Responsibility
Who owns the use case, reviews the risks and authorises release?
Evidence
Which requirements and tests support the claims made about the system?
Lifecycle
Which changes require a fresh review, and how are incidents handled?
Capabilities shaped around your use.
Inventory & responsibilities
Map AI systems, intended uses, owners, data and suppliers. Frame the roles and obligations to assess with your legal and quality functions.
Risk & policy
Define approved uses, data classifications, safety and security risks, human oversight, abstention and escalation.
Evaluation & evidence
Link requirements to representative tests. Record model, data and prompt versions, results, known limits, security checks and review decisions.
Release & monitoring
Prepare readiness reviews, operating procedures, user training, change control and incident remediation. Support the applicable assessment process.
A review cycle, supported by evidence.
Define intended use
Specify users, decisions, operating conditions and foreseeable failures before selecting assurance criteria.
Set risks and controls
Assign owners and acceptance criteria. Separate safety, security, grounding and policy behaviour checks.
Evaluate the system
Use representative data and workflow tests. Record versions, results, failures, mitigations and residual risks.
Review evidence and release
Responsible stakeholders review the evidence. Any external assessment or certification follows the route applicable to that system and use.
Monitor and requalify
Track incidents, operating limits and changes. Re-evaluate where models, data, tools or intended uses change materially.
Certification readiness means preparation of evidence, not an acquired certification or a generic certified-LLM status. Frameworks such as the NIST AI RMF can inform risk management; citing them is not a certification.
Healthcare, banking, government and insurance: different uses, different controls.
A healthcare assistant may need verified sources and review by an authorised clinician. A banking workflow may need transaction authority and separation of duties. A public-service tool may need access controls, justification and recourse appropriate to its use. An insurance analysis may require sensitive decisions to be reviewed. These are illustrative scenarios, not claims of delivered client projects or achieved certification.
Deliverables you can use.
AI register & ownership
An inventory, intended-use definitions and a responsibility model.
Gap & evidence plan
Prioritised risks, controls, acceptance criteria and required review records.
Lifecycle procedures
Policies, approvals, release conditions, monitoring and change or incident review.
A clear route from assumptions to evidence.
Scope
Define intended use, actors, jurisdictions and review stakeholders.
Assess
Map risks and gaps against the relevant requirements.
Implement & evaluate
Build controls and collect traceable test evidence.
Review & maintain
Support release decisions and ongoing change or incident review.
AI Governance & Assurance, answered
Does this service certify our AI?
No. We help prepare and maintain technical and operational evidence. Certification and conformity assessment, where applicable, follow the relevant authorised processes.
Does every AI project follow the same assessment route?
No. The route depends on the system, intended use, actors, jurisdiction and applicable requirements. We frame the assessment with your legal and quality stakeholders.
Does human review make a system safe?
Human review is one control. It needs clear authority, usable evidence, appropriate workload and enforcement. It does not by itself establish safety or compliance.
Can you guarantee that alignment and hallucinations are solved?
No. We define behaviour and evidence criteria, evaluate failure modes and implement controls with known limitations. Their effectiveness must be measured on the intended use.
Start with your use case.
Bring the workflow, the constraints and the decision you need to make. Together we can define a useful next step and the evidence it should produce.