AI Governance and Assurance
114 questions on how your organisation governs AI, 42 of them on generative and agentic systems.
114 controls · 5 pillars · 31 categories · assessed by people
114 questions on how your organisation governs AI, 42 of them on generative and agentic systems.
114 controls · 5 pillars · 31 categories · assessed by people
Most organisations adopted AI faster than they governed it, and the gap now shows up as regulatory exposure rather than as a technical problem. This assessment tells the board whether AI use inside the organisation has a named owner, a documented purpose, a measured risk and a route to switching a system off. It is the written record the EU AI Act, your sector regulator and your own auditors will each ask for separately.
114 questions across five functions - govern, map, measure and manage, plus a fifth covering generative and agentic risk with 42 questions of its own. It runs as working sessions rather than a scan: an assessor takes your policy owners, model owners and procurement through the bank and scores each control, so nothing touches a production system. The output is a scored report across 31 categories that drops into the same annual cycle as an ISO 27001 surveillance visit or a SOC 2 window.
The bank follows NIST AI RMF 1.0 and its Generative AI Profile - public-domain United States federal works - so the structure is the published one and the question wording is ours. Evidence is documentary: model and use-case inventories, intended-purpose and out-of-scope statements, evaluation output, third-party model and dataset terms, incident records, and the risk metrics you actually implemented rather than listed. The generative pillar's 42 questions span confabulation, data privacy, information integrity, information security, intellectual property, harmful bias, human-AI configuration and value-chain integration.
114 controls across 5 pillars and 31 categories. Every one is scored, and a control nobody can answer is recorded as unanswered rather than counted as a pass.
There is no collector for this assessment. Every answer comes from a document, a system owner or a demonstration during the session, and the assessor records which of the three supported each score.
It cannot tell you whether a model is accurate, fair or safe in use - only whether somebody is measuring that and acting on the result.
A public body using AI in decisions that affect citizens has to show intended purpose, human oversight and a route to challenge, and the govern and map functions ask for each of those in writing.
Model risk and consumer outcome rules already demand documented ownership and ongoing measurement of automated decisions, which is precisely what the measure and manage functions score.
Clinical and administrative AI touches patient safety and patient data at once, so the data privacy questions are scored separately from the oversight questions about who may override a model.
A fixed fee for the engagement, not an annual licence. The band follows the size of the bank: this one is focused at 114 controls.
£2,500
Per engagement, excluding VAT.
£6,000
Per engagement, excluding VAT.
Hold three or more and the Combined Security View is produced at no extra charge: it is derived from the banks you already hold rather than assessed again. See the full assessment rate card, or build a quote with this assessment in it.
There are 16 of them, and the honest answer is that most organisations need two or three rather than all of them. Tell us what you run and what you are being asked to prove.