AI & Data · Govern
Govern the use, not the technology.
The question isn't "is this AI tool safe?" but "safe for what?" We help you govern the AI your people already use, and govern every system we build for you, so your board can say yes to AI with confidence. Run under our ISO 27001 and ISO 9001 certification.
Three ways we help.
Governance runs through everything we do, from the first policy to the system running in production.
Governance consultancy
Your own AI governance put in place with you, from the owner, one-page policy, inventory and risk tiers to the briefing for your people and the report to your board. On its own, or as part of an AI assessment or programme.
Governed by design
Every AI system we build comes with its controls in code, including its own access, approvals, confidence checks, a full record and an off switch, and is accepted on evidence before it goes live.
Run and assured
What we build, we can run under our ISO 27001 controls, with evaluation on a schedule, quality and cost monitored, incidents handled and a regular report.
Three moves that work, in this order.
Blocking AI tools doesn't stop people using them; it pushes them onto personal accounts. Make the safe route the easy route.
Provide a sanctioned tool
An AI tool on business terms, where your data isn't used to train anyone's model, so nobody needs a personal account.
Say what may go in, on one page
A one-page policy with a traffic-light list: green, go ahead; amber, go ahead once a condition is met; red, not with these tools.
Then close the old route
Only once the sanctioned route exists, close the unsanctioned ones on the devices you manage.
What good AI governance is made of.
An owner and a policy
One owner, not a committee, who keeps the policy and the inventory and reports to the board.
An inventory and risk tiers
Every AI tool and system in use, who owns it, what data it touches and its tier, from low to high, or stop.
Impact and oversight
For high-risk uses, an impact assessment and real human oversight, with the authority, understanding and time to say no.
People
A short briefing for everyone, and proper training for those who own or oversee AI.
Security
Each system with its own access and only the data its job needs, answers that respect permissions, and logging as the audit trail.
Suppliers and evaluation
The right terms with every AI provider, and every system accepted on evidence, then re-tested on every change.
Incidents and review
Contain, assess, notify, fix and learn, with a short regular report to the board.
What applies, and what doesn't.
An overview to help you ask the right questions, not legal advice.
In the UK
There's no AI statute. AI is regulated through existing law and regulators, including UK GDPR, consumer, equality and employment law, with the ICO's guidance the closest thing to a rulebook.
Selling into the EU
The EU AI Act splits duties between those who provide an AI system and those who deploy it, with the high-risk duties due from December 2027. Who counts as the provider matters when someone builds a system for you.
Standards
ISO/IEC 42001 is the certifiable standard for managing AI. A business with ISO 27001 already has much of what it asks for. We're working towards it, building on our own ISO 27001 and ISO 9001.
Plan. Build. Govern.
Plan
Where AI pays, and in what order. For a whole business, the PureNet Group's Converge Methodology; for a single area, a fixed-scope assessment.
Build
A pilot with a number to move, an owner and a way to stop it, then production in your storefront, portal and back office, integrated with your ERP and CRM.
Govern
Govern the use, not the technology. Your own AI on business terms, with an owner, a one-page policy and an inventory; and every system we build for you tested on every change, logged, overseen by a person and fitted with an off switch, under our ISO 27001 controls.
What people ask us.
Should we ban AI tools until we have a policy?
No. A ban pushes people onto personal accounts, where you can see nothing. Provide a sanctioned tool first, say on one page what may go into it, and only then close the old routes.
Who should own AI governance?
One named person, not a committee. They keep the policy and the inventory, approve the amber uses, see the incidents and report to the board, which sets how much risk it will accept.
Do we need ISO/IEC 42001 certification?
Not necessarily. Many businesses align with it without certifying, especially if they already hold ISO 27001. Certification makes sense when customers or tenders ask for it.
Who is responsible for what an AI system does?
Your business. If an AI system makes a commitment, sends a message or spends money, the business did. That's why everything we build proposes before it commits, keeps a full record and has an owner and an off switch.