AI Governance

Governance starts with knowing what you run and in which capacity. Through a questionnaire-based scoping exercise we build your AI system inventory, determine your role for each tool (deployer, provider, importer or distributor) and document whether the intended purpose falls under a prohibited, high-risk, limited-risk or minimal-risk category of the EU AI Act.

Typical findings in Life Sciences: an HR screening assistant that qualifies as high-risk under Annex III, a patient-facing chatbot that triggers transparency duties, and a fleet of minimal-risk productivity tools that still process personal data under the GDPR.

We draft or consolidate your Corporate AI Policy, elevating existing employee guidelines into a binding internal rule set: permitted and prohibited uses, data that may and may not be entered into a tool, and the approval route for new use cases.

Around the policy we set up the AI governance SOPs: approval and exception workflows, incident and misuse escalation, and periodic review cycles. Roles are fixed in a RACI for your AI Governance Team, integrated with your existing data protection and quality governance rather than duplicating it.

The core of the workstream is a repeatable process to assess and approve any AI tool (LLM, agent, copilot) before it connects to enterprise systems such as Microsoft 365, Salesforce or your CTMS. Each candidate is scored across four dimensions:

• Compliance and legal: vendor terms, DPA and zero-data-retention provisions; international transfer mechanism (adequacy, EU SCCs, Data Privacy Framework); downstream commitments in your customer and sponsor contracts; sanctions and restricted-origin model screening; purpose definition and the resulting AI Act classification.
• Security and access: security review checklist for the tool and its integrations; identity and access management, delegation flows, token handling and least-privilege scoping.
• Data and connections: tiering of the data the tool may access, with a risk rating per tier, and the controls required at connection level.
• Customer and stakeholder notification: a clear yes/no decision on whether the tool introduces a new sub-processor or data connection that must be disclosed to clients, sponsors or data subjects.

Outputs: an AI Tool Onboarding Policy and SOP, the scored assessment template, an intake and triage form, and a decision register aligned with your vendor assessment process.

Where a tool is used for a high-risk purpose, we operationalise the deployer duties of Art. 26 EU AI Act: use in accordance with the provider's instructions, assignment of trained human oversight, relevance and representativeness checks on input data, retention of automatically generated logs, and information to workers and affected persons.

For deployers that are bodies governed by public law, or private operators providing public services or credit and insurance scoring, we prepare the Fundamental Rights Impact Assessment required by Art. 27, and combine it with the GDPR DPIA whenever health or genetic data are involved.

Since 2 February 2025, providers and deployers must ensure a sufficient level of AI literacy among staff and other persons operating AI systems on their behalf. We design and deliver role-based training: an all-staff module on the Corporate AI Policy and safe prompting, and targeted sessions for medical, clinical, HR, IT and commercial teams whose use cases carry higher risk.

Training is tracked and evidenced so that it stands up to an audit, in the same way as our data privacy training.

Governance only works if someone owns it. As your outsourced AI Compliance Officer we run the process after go-live: intake of new tools, periodic re-assessment of approved ones, regulatory watch (EU AI Act guidelines and delegated acts, EDPB opinions, national authority positions), incident handling and misuse escalation, and reporting to management on the state of AI use across the organisation.

The role is designed to sit alongside your DPO mandate, so that AI governance and data protection are steered from one place, with one set of registers.