AI Governance & Assurance
AI governance consulting and ISO 42001 readiness
Govern your own AI with confidence. Boards are asking a new question: are we governing our own use of AI safely and compliantly? We help you answer it, with audit-ready AI governance, ISO 42001 readiness and EU AI Act preparation.
Last reviewed . Regulation moves, so check the regulation tracker for the current position.
The definition
What is AI governance?
AI governance is the set of policies, controls and evidence an organisation uses to make sure the AI it builds, buys and uses is safe, lawful and accountable. In practice it means knowing where AI is used, classifying the risk each system carries, putting controls and human oversight in place, and keeping the documentation that proves it, to a standard an auditor, regulator or customer will accept.
Assurance
What is AI assurance?
AI assurance is the independent evidence that an organisation’s AI is governed, safe and lawful, to a standard an auditor, regulator or customer will accept. It is a fast-growing expectation in UK procurement, as customers and regulators increasingly ask for proof rather than assurances.
What we help with
Three ways to get your AI house in order.
ISO 42001 readiness & certification
The AI Management System standard. We get you ready and certification is delivered through certified assessment partners. Because ISO 42001 shares the ISO 27001 management-system structure, much of the groundwork carries straight over.
EU AI Act preparation
We help you prepare for the Act’s phased obligations. High-risk requirements for standalone systems now apply from December 2027 under the Digital Omnibus adopted in June 2026, but transparency duties have applied since August 2026 and general-purpose AI rules are already live. Any UK organisation serving EU users can fall in scope, so this is a UK question too.
Shadow AI & acceptable use
Discover where AI is already being used across the business, put a clear acceptable-use policy in place, and reduce the risk of sensitive data leaking into public LLMs.
How we help
One team, accountable end to end.
AI governance fails when it is a one-off project that nobody owns afterwards. We run it as an ongoing programme, using the same continuous-compliance engine that keeps your other frameworks audit-ready, with Threat Protect as your single point of accountability throughout.
- 01
Find out where you stand
A short discovery across the business: where AI is already in use, which uses carry real risk, and what the Act and ISO 42001 would expect of each. You get a sized, specific list instead of an abstract worry.
- 02
Build the governance
Policy, risk assessment, human oversight and the documentation that evidences all three. Built on your existing management system wherever possible, so it is one framework more, not a parallel programme.
- 03
Certify through assessment partners
When you want the certificate, ISO 42001 assessment is delivered through certified assessment partners. We prepare you, manage the process and stay accountable for the outcome, so you deal with one team throughout.
- 04
Keep it current
Governance decays as the business adopts new tools and the rules move. Continuous compliance keeps the evidence live and the inventory accurate year-round, so the next audit is not a scramble.
Not sure where you stand?
Two minutes, eight questions, and an honest read on your scope and the gaps to close first.
What the work covers
What AI governance consulting includes
Writing a policy is the easy part. The harder part is making governance work once people are using AI every day. Specialist partners do this work and Threat Protect runs the process, so you have one point of accountability from the first inventory onwards.
AI inventory
A register of every AI tool, model and feature in use, including those inside the software you already buy, with an owner for each.
AI risk assessment
Each use is classified by what could go wrong, who could be affected and which rules apply, so that controls match the risk.
Operating model
Who owns AI governance, who can approve or stop a new use, and how decisions reach the board.
Controls and human oversight
Data handling, supplier checks, testing, monitoring and the points where a person must review the output.
Evidence for auditors and customers
The records that prove it all happens, ready for customer due diligence, a certification audit or a regulator’s question.
Proportionate controls
Matching controls to AI risk
Not every use of AI needs the same governance. A meeting summary tool and a system that screens job applicants carry very different risks. The EU AI Act sorts uses into risk tiers, and that gives even organisations outside its scope a sensible starting point.
Related
Frameworks
AI governance frameworks
Three names come up most often, and they do different jobs. ISO 42001 and the NIST AI RMF are how you build and run governance; the EU AI Act is the law you must meet where it applies.
| Framework | What it is | Mandatory? | Where it fits |
|---|---|---|---|
| ISO/IEC 42001 | International management-system standard for AI (certifiable) | No, voluntary but increasingly expected in procurement | Proving AI is governed responsibly |
| NIST AI RMF | Voluntary US risk framework (Govern, Map, Measure, Manage) | No | A structure for standing up an AI risk programme |
| EU AI Act | EU law with extraterritorial reach, risk-tiered obligations | Yes, where in scope | The legal obligations themselves |
AI policy
An AI policy people will actually follow
An AI policy is usually the fastest step you can take, and your staff are probably using AI already. It works when it is short, specific and paired with an approved alternative to the tools it restricts.
- Which AI tools are approved, and how to request a new one
- What data must never go into a public AI tool
- When a person must check the output before it is used
- How AI features inside existing software are treated
- How to report a problem, and who owns the policy
Certification
How ISO 42001 certification works
ISO 42001 certification is delivered through certified assessment partners. They audit independently, and Threat Protect does not issue certificates. We prepare you and manage the process.
1.Gap analysis
Measure what you have against the standard, including what carries over from ISO 27001.
2.Build the management system
Policy, roles, risk and impact assessments, and the controls you select from Annex A.
3.Run it and check it
Operate the system long enough to create evidence, then carry out an internal audit and a management review.
4.Stage 1 and Stage 2 audits
The certification body reviews your documentation, then tests whether the system works in practice.
5.Surveillance audits
Certificates usually run for three years, with audits in between to confirm the system is still working.
Related
What you walk away with
What you get from each stage
| What you get | Who it helps | |
|---|---|---|
| Discovery | An AI inventory and a sized list of risks | Board and leadership |
| Design | AI policy, risk method, operating model and controls | Security, legal and business owners |
| Readiness | An evidence pack and an audit-ready management system | Auditors and customers |
| Ongoing | Live evidence and a current inventory | Everyone, at the next audit or review |
Dec 2027
The EU AI Act’s high-risk obligations for standalone (Annex III) systems apply from 2 December 2027, following the Digital Omnibus adopted in June 2026. Treat that as runway, not a reprieve: transparency duties have applied since August 2026, and the governance behind them takes considerably longer to build than the dates suggest.
See the EU AI Act timeline & readiness stepsFAQ
Questions buyers ask
Short, straight answers to what boards and buyers ask most. Still need a steer on your own situation?
Book a call Read the full AI governance guideWhat does an AI governance consultant do?
An AI governance consultant helps you find where AI is used, classify the risk each use carries, write the policy and controls that match, decide who owns them and build the evidence an auditor or customer will accept. The work usually starts with an inventory and ends with a management system that keeps running.What should an AI policy include?
Which tools are approved, what data must never go into them, when a person must check the output, who approves new uses, how incidents are reported and who owns the policy. It should also say how AI features inside existing software are treated, as staff often do not see those as AI at all.How long does ISO 42001 readiness take?
As a guide, plan in months rather than weeks. It depends on how many AI uses are in scope, whether you build or only buy AI, and how much of a management system you already have. An organisation that already holds ISO 27001 can reuse a good deal of that structure.Can we build ISO 42001 on top of ISO 27001?
Yes, in most cases. Both follow the same management-system structure, so document control, internal audit and management review can be shared. The AI-specific work, such as impact assessments and controls across the AI lifecycle, still needs to be added.Who should own AI governance in our organisation?
One named executive, supported by a small group drawn from security, legal or compliance, data and the business teams using AI. Security alone is too narrow and a large committee is too slow. What matters most is that someone can approve, or stop, a new use of AI.How much does AI governance consulting cost?
Pricing is on application. Cost depends on how many AI uses are in scope, whether you build or buy AI, which frameworks you are working towards and how much of a management system you already have. We scope it on a short call and quote before any work starts.
A note on what this is and isn’t: we help you build audit-ready AI governance and prepare for the EU AI Act. ISO 42001 is a management-system standard and a commercial signal that procurement increasingly expects. It is not, on its own, legal compliance with the EU AI Act, and we don’t present it as such. We’ll always be clear about where readiness ends and legal advice begins.
Get ahead of the board’s AI question.
Tell us how AI is showing up in your organisation. We’ll map a path to audit-ready governance and EU AI Act readiness.
Book a call Also available in AWS Marketplace