AI Governance
“Who owns AI here —
and show me the evidence.”
AI is already inside your organisation. It arrived through staff using their own accounts, and through vendors switching features on at renewal. Nobody decided either one, so nobody owns it. We turn that into a three-week engagement with a fixed price and an asset you keep.
a 15-minute call — no checkout, nothing to buy online
Before the conversation: Start the assessment
Three weeks · a fixed fee
01 · Where this applies
Four sectors where the stakes are legible.
Every organisation has this problem. In regulated industries it has consequences you can point at — which is what turns it from a good intention into a budget line.
Healthcare
PHI changes the maths. The same tool that is a productivity story elsewhere is a disclosure question here, and the FDA question arrives the moment anything touches a clinical decision.
Telecommunications
AI reaches customers at volume — service, retention, collections — where a single ungoverned prompt change is a compliance event across millions of contacts rather than one conversation.
Energy & utilities
Operational technology and critical infrastructure make autonomy the sharp axis. Advisory output that reaches a control decision is a different risk class from a drafted email.
Financial services
Model risk management already exists here, which cuts both ways: the governance vocabulary is familiar, and examiners already know what good looks like when they ask to see it.
02 · The framework
Five controls. Five questions.
Inventory
Do you know what AI is actually in use?
Ownership
Does every use have a named owner?
Risk tiering
Is each use classified, with proportionate controls?
Vendor control
Does AI enter only through review?
Evidence
Can you show an auditor, customer or insurer the trail?
A weak control names its own remedy.
03 · The Sophia Governance Agent
A register is a monthly job.
Not a hard one — a relentless one. Someone has to read every renewal notice, chase every owner to confirm their use is still accurate, keep the evidence dated, and have the report ready by the fifth. Every month. That work always slips, and not because anyone is careless.
Reads what arrives
Renewal notices, terms updates and release notes, forwarded to one address and turned into structured facts.
Chases the owners
Every use has a named owner. Sophia is the one who asks them to confirm it is still true — and asks again.
Keeps the evidence
Versioned, dated and attributable. The trail an auditor asks for, exportable the moment they do.
Assembles the report
By the fifth, every month, without anyone having to remember that it is due.
She never makes the call. Risk judgment and the recommendations stay human.
04 · The six plays
One assessment. Five services that keep it true.
A register nobody maintains is worthless within a quarter. That is the honest reason a retainer follows an assessment — not because we would like one. Every service is month to month after an initial three-month term.
AI Readiness Assessment
Structured discovery, a no-penalty usage amnesty, and every AI use registered and risk-tiered. You keep the register, the findings report and a sequenced 90-day roadmap.
Fractional AI Governance Officer
A named owner for AI governance without the headcount. The monthly report your auditor, customer or insurer can be handed, and a register that stays true.
Vendor AI Watch
Nothing enters the stack unreviewed. Renewal notices and release notes read for training-data clauses, retention changes and autonomous features — before signature.
AI Adoption Coach
From licences to hours returned, measured as an honest range. Guardrails, pilots with real baselines, and a scorecard a CFO can audit.
The Delivery Health Check
An independent read of your delivery portfolio before the steering meeting, not after the surprise — the read an insider cannot safely write.
Board Briefing Service
Walk into the AI conversation prepared. A board-grade deck refreshed with live data, a one-page pre-read, and a hard-question drill before the meeting.
05 · What we expect to find
These are the pattern, not hypotheticals.
We largely know what we will find before we walk in. That predictability is why the engagement can be priced fixed and delivered in three weeks. What we do not know is which are present at your organisation, how bad, and in what order they should be fixed — and that judgment is what you are buying.
AI arriving default-on through a vendor renewal nobody read
Regulated data pasted into a general-purpose assistant
An AI vendor processing sensitive data with no agreement mapped to it
Decision-support running live with nobody having asked the regulatory question
No named owner for any AI use — “everyone” being the answer
No incident path: nobody knows where to report it when it goes wrong
06 · What we will not do
The limits, stated before you ask.
Let the agent decide
Sophia reads, chases, tracks and assembles. Every risk judgment carries a human name.
Imply a reference we do not have
You will not find a borrowed logo or a case study here. Ask who else we have done this for and you will get a straight answer on the call.
Invent a number
Anything the work did not establish is reported as unknown, never as zero. Hours and savings are ranges.
Hold your work hostage
The register is yours from day one, in a format you can take elsewhere. The retainer earns its renewal every month.
07 · Next step
Thirty minutes, no charge.
Bring whoever has been asked the question. If there is nothing here worth doing, we will say so on the call — that is a useful outcome and it costs you half an hour.
A scoping call
What has already been asked of you about AI, what you can currently evidence, and whether an assessment is the right next step.
Talk to usa 15-minute call — no checkout, nothing to buy online
Security review first?
Reviewers are welcome before a commercial conversation, not after. Every control we claim is written down with the code that implements it.
Security & TrustPartners and advisors
We co-sell with firms who already hold the relationship. You stay in every conversation you want to be in.
Talk to the companyAI Governance
A register nobody maintains is worthless within a quarter.
a 15-minute call — no checkout, nothing to buy online
Before the conversation: Start the assessment