Discovery & Risk Baseline
Our compliance process starts with discovery. We map the AI systems, obligations and controls in scope, and agree what has to be evidenced against frameworks such as ISO/IEC 42001.
- Stakeholder alignment
- AI and obligation inventory
- Risk baseline
- Evidence requirements
- Framework scoping
Prevents scope drift and governance blind spots.
Classify & Approve
Each AI system is classified by risk and routed through structured approval, with named owners.
- Risk classification
- Approval gates and criteria
- Committee workflow
- Ownership assignment
- Policy mapping
Prevents unassessed AI systems reaching production.
Sandbox & Policy Review
Systems are tested in a controlled sandbox and reviewed against policy and obligations before release.
- Sandbox testing
- Control design and testing
- Policy and obligation review
- Human oversight points
- Documentation and sign-off
Prevents untested models touching production data or customers.
Deploy, Monitor & Evidence
Go live with runtime monitoring, reporting and evidence captured as the work happens, managed through Know Your Agent (KY-A).
- Runtime telemetry
- Continuous control testing
- Evidence capture
- Regulatory reporting
- Periodic review
Prevents governance decay after go-live, so the compliance process keeps working long after launch.
A transparent compliance process
- Defined timelines
- Measurable milestones
- Clear ownership
- No black-box delivery