Skip to content

AI Governance

We design and implement AI governance that lets adoption scale with regulatory, security, privacy and operational risk under control, and with clear answers for customers and investors.

Discuss your matter

Typical deliverables

  • AI system inventory and risk classification
  • AI governance framework and policy set
  • AI impact and risk assessments
  • EU AI Act readiness plan by system and role
  • ISO/IEC 42001 gap analysis and audit-ready AIMS documentation
  • AI vendor due diligence reports to inform procurement

A cross-jurisdiction capability, supported across the jurisdictions in our directory. See jurisdictions

Overview

Why it matters

Businesses putting AI into products, operations and decisions need to show that it is governed. The EU AI Act sets obligations according to the risk of each system and the role of each business; customers and investors ask how AI is controlled; and the same systems raise questions of data protection, security, intellectual property and liability. A single governance framework addresses them together, without costly rework later.

We put that governance in place: an inventory of the AI in use, a risk classification that reflects the AI Act and the business's own risk appetite, clear roles and human oversight, and the policies, assessments and documentation that let AI adoption scale and give customers and auditors the evidence they ask for. Where certification is the goal, we implement an AI management system to ISO/IEC 42001 and support the business through the audit.

AI governance is joined up with our Privacy & Data Protection, Information Security & Cybersecurity, Commercial & Technology Contracts and Legal Opinions practices, so that one team answers the data protection, security, contractual and regulatory questions a single AI system raises.

Our work is AI governance, compliance and assurance: the framework, controls and evidence around your AI systems. ROZSUD does not develop, train or technically test AI models.

Key services

From the first gap analysis to the external audit

We identify the gaps, design the programme, help implement it and support you through review by auditors, enterprise customers and regulators, with the evidence each expects.

Certification & External Audit Support

Support through the whole readiness and audit process — for ISO/IEC 27001, ISO/IEC 27701 and ISO/IEC 42001 certification, SOC 2 examinations and other external audits — from the first gap analysis to closing the findings.

  • Building or refining the framework the audit will test
  • Gap analysis against the standard or criteria
  • Policies, procedures, registers and evidence prepared for review
  • Teams prepared for auditor interviews
  • Evidence gathering coordinated across the business
  • Acting as your coordination point with the external auditor, including in audit sessions
  • Remediation of audit findings

Certification and attestation decisions rest with the independent certification or audit body; ROZSUD is not a certification body and does not issue certifications. Our role is to have you ready for that review.

Enterprise Sales & Customer Assurance

Security, privacy and, increasingly, AI reviews are a routine step in enterprise procurement. We help you respond accurately and quickly, so your answers keep pace with the deal — removing security and privacy blockers without overstating the controls behind them.

  • Customer security and privacy questionnaires
  • RFIs and the security sections of RFPs
  • Vendor due diligence and security reviews
  • Enterprise procurement and contractual security requirements
  • Customer audit requests
  • A reusable assurance pack of policies, summaries and evidence

Scope

What we do

Programme & governance

  • AI Governance Programme Design

    A governance framework sized to how the business builds, buys and uses AI: principles, ownership, decision rights and a roadmap.

  • AI Policies & Governance Procedures

    Acceptable-use, development and procurement policies, and the procedures that put them into practice.

  • Roles, Responsibilities & Oversight

    Accountability for AI across the business, from the board and an AI governance forum to the owner of each system.

  • Human Oversight Frameworks

    Where and how people review, override or stop AI outputs, designed around the risk of each use case.

  • AI Governance Documentation

    The records regulators, auditors and customers expect: inventories, assessments, technical documentation and decision logs.

  • Fractional AI-Governance Support

    A senior AI-governance lead on an agreed monthly scope, so governance runs from the start while the internal function is built.

Regulation & risk

  • EU AI Act Readiness

    Whether and how the AI Act applies, the business's role as provider or deployer of each system, and a plan to meet the obligations that follow.

  • AI System Inventory

    A register of the AI systems and models in use or in development, including AI embedded in suppliers' products, showing where obligations attach.

  • AI Risk Classification

    Each system classified against the AI Act's risk categories and the business's own risk appetite, so controls match the risk.

  • AI Impact & Risk Assessments

    Assessments of how AI systems affect people, the business and third parties and how those effects are controlled, including fundamental rights impact assessments where the AI Act requires them.

Security, privacy & third parties

  • AI Security Governance

    Security requirements for AI systems and models — data, access, supply chain and misuse — built into the wider security programme.

  • AI Privacy Alignment

    Lawful basis, transparency, data minimisation and DPIAs for AI systems that process personal data.

  • AI Vendor & Third-Party Risk

    Due diligence on AI providers and models before you rely on them, and oversight of the AI embedded in suppliers' products and services.

  • AI Procurement & Contractual Governance

    Contract terms for buying and supplying AI: data use, intellectual property, performance, transparency and allocation of liability.

Assurance & capability

  • ISO/IEC 42001 Implementation & Readiness

    An artificial intelligence management system (AIMS) built to ISO/IEC 42001, and support through the certification audit.

  • AI Audit & Customer Assurance Readiness

    Evidence and answers for customer AI questionnaires, due diligence and audits of AI governance, so AI reviews keep pace with the deal.

  • AI Literacy & Training

    AI literacy programmes for staff and management, aligned with the AI Act, and role-based training for teams that build or use AI.

Frameworks

Frameworks, standards & regulations

Standards and frameworks are chosen — to certify against, to report on or to give a programme its structure. Regulations and legislation apply by law, according to where the business operates and what it does. We work with both, mapping one set of controls to the requirements that apply, so you can run and evidence one programme rather than several.

Standards

ISO/IEC 42001
Artificial intelligence management systems (AIMS): the requirements, and the basis for certification.
ISO/IEC 27001 and ISO/IEC 27701
Information security and privacy management systems, which an AI management system often builds on.

Frameworks

NIST AI Risk Management Framework
NIST AI RMF 1.0 and its Generative AI Profile, used to structure how AI risks are identified and managed.
NIST Cybersecurity Framework
Used for the security of AI systems and the infrastructure around them.

Regulations & legislation

EU AI Act
Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence, applying in stages.
GDPR
Where AI systems process personal data: lawful basis, transparency, automated decision-making and DPIAs.

Working with us

Engagement formats

Every engagement is scoped in writing before work begins, in one of these formats or a combination of them.

  • Focused advisory session

    A prepared consultation on a defined security, privacy or AI-governance question, followed by practical action points.

  • Scoped deliverable

    Preparation, review or improvement of a specific policy, procedure, assessment, register, methodology or other governance deliverable.

  • Fractional support

    Ongoing senior security, privacy or AI-governance support under an agreed monthly scope.

  • Programme build or remediation

    Building or improving an ISMS, PIMS, AIMS or broader compliance programme against an agreed framework.

  • Audit & customer assurance support

    Preparation for certification audits, customer audits and enterprise security or privacy reviews, and the remediation that follows.

  • Third-party assurance

    Independent security and privacy assessment of a vendor, partner, investee, acquisition target or other third party, with findings and recommendations.

We set out the timetable for our work in the written scope before it starts. It reflects the size of the organisation, its current maturity, its product and geography, the framework selected and the scope of any audit; the certification date itself follows the audit.

Jurisdictions

Supported across jurisdictions

We support AI Governance across the jurisdictions in our directory, adapting the work to what each jurisdiction's law requires and coordinating local specialists where local law, registration, representation or professional requirements require it.

Cartography by ROZSUD from Natural Earth data (public domain).
Europe18
Asia & Middle East4
Americas & Caribbean11
Africa & Indian Ocean6

Industries

Where we apply it

Questions

Frequently asked

Does the EU AI Act apply to businesses outside the EU?

It can. The AI Act applies to providers that place AI systems on the EU market or put them into service there, and to providers and deployers outside the EU where the output of an AI system is used in the EU. We first establish whether it applies, and in which role, so the work targets your actual obligations.

Do we need ISO/IEC 42001 certification?

Certification is voluntary. Some businesses pursue it to answer customer and investor questions with one recognised standard; others use ISO/IEC 42001 as a framework without certifying. We help you decide and, if you certify, build the AIMS and its evidence and see you through the audit.

We only use AI tools from other providers. Does this apply to us?

Usually, yes. Businesses that deploy third-party AI have obligations of their own, and much of the AI risk in a typical business sits in tools that were bought rather than built. We start with an inventory of the AI in use, including AI embedded in suppliers' products, and set out which obligations are yours.

Related

Related practice areas

  • Privacy & Data Protection

    External DPO services and working privacy programmes: GDPR and global privacy laws, DPIAs, data mapping, transfers and ISO/IEC 27701.

  • Information Security & Cybersecurity

    Fractional CISO support, ISMS and security programmes, certification and audit readiness, DORA, NIS2 and customer assurance for enterprise sales.

  • Commercial & Technology Contracts

    Platform, white-label, B2B supply, SaaS, affiliate and outsourcing agreements, drafted and negotiated to close deals in regulated markets.

  • Legal Opinions

    Regulatory, business model, perimeter, payment, gaming, crypto-asset and cross-border opinions that answer what banks and investors ask.

All practice areas

Need to show how your AI is governed?

Tell us how you build, buy and use AI. The first conversation covers whether and how the AI Act applies and any ISO/IEC 42001 goal; you then receive a written proposal with scope, timetable and fee.

Request a consultation