ServicesAI governance and risk assessment
Find every AI system you run, and the data it sees
Already running AI? We find all of it, map the data each tool touches, and assess it against the rules you fall under. Planning your first deployment? We review the use case, the data and the vendors before you build or buy.
- Fixed scope in writing
- NDA before discovery
- Findings tied to the rule they relate to
| System | Data it sees | Status |
|---|---|---|
| Help desk reply drafts | Customer names, order history | Check DPA |
| CV screening add-on | Applicant CVs | High-risk use |
| Personal chatbot accounts | Unknown | Unmanaged |
| Claims summariser | Health data | Masking needed |
| Meeting notes assistant | Internal calls | Controlled |
What you get
For your engineers, and for your DPO, counsel and board.
AI register
Every model, tool and AI feature in use, approved or not, with its owner, its purpose and the vendor behind it.
Data-flow map
What goes into each system, where it is processed and stored, which vendors see it and how long they keep it.
Risk classification
Each use placed against the EU AI Act risk tiers, GDPR's triggers for a data protection impact assessment, and HIPAA's minimum necessary standard where health data is involved.
Gap report
Each gap tied to the article or rule it relates to, with a technical fix, an owner and an order to tackle them in.
Policy drafts
An acceptable use policy for staff and an approval process for new AI tools, drafted for your legal team to review and adopt.
Pre-deployment review
For AI you haven't launched yet: the use case, the data it needs and the vendors, checked against the rules, with the controls to build in from the start.
Board summary
Two pages in plain language: what AI the organisation runs, where the exposure is and what it will take to close it.
What a data-flow map looks like
team
AI in use
vendor and region
gap report
GDPR Art. 28
AI Act Annex III
GDPR Art. 32
Example: part of a data-flow map from an assessment. Each line is one AI use, traced from the team to the place the data finally rests.
How we find what's in use
People don't mention the AI they weren't supposed to use, so we check the systems too, with your permission.
Interviews
IT, security, data protection and the heads of the teams that handle the most sensitive data.
Technical discovery
Single sign-on and network logs, browser extensions, SaaS admin settings and expense lines, read with your security team.
Data tracing
For each system, we follow a sample record from input to model to storage, and note every place a copy ends up.
Report and walkthrough
We take your team through the findings and agree what to fix first.
What we assess against
The ones we're asked about most. We assess against many more.
| Rule or framework | What we look at for AI | Typical references |
|---|---|---|
| GDPR and UK GDPR | Legal basis and purpose for each AI use, records of processing, DPIA triggers, processor terms, transfers outside the EEA or UK. | Art. 5Art. 6Art. 28Art. 30Art. 35Art. 44 |
| EU AI Act | Prohibited practices, AI literacy, whether any use is high-risk under Annex III, deployer duties, and transparency for chatbots and generated content. | Art. 4Art. 5Art. 6Art. 26Art. 50 |
| HIPAA | Whether AI tools receive PHI, risk analysis coverage, minimum necessary, access controls, audit controls and business associate agreements. | §164.308(a)(1)§164.502(b)§164.312§164.504(e) |
| CCPA and CPRA | Notice at collection, purpose and retention limits, service provider contracts and automated decision-making. | §1798.100§1798.140 |
| Frameworks | Where you already report against a framework, we map AI controls into it rather than starting a parallel one. | SOC 2ISO/IEC 27001ISO/IEC 42001NIST AI RMF |
Also the UAE and Saudi PDPL, India's DPDP Act, US state privacy laws and many more. An assessment is not a legal opinion or a certification.
Questions
We haven't deployed any AI yet. Is this for us?
Yes. We review what you plan to deploy before you build or buy it, so the controls are designed in rather than added later.
Do you need access to our systems?
Read-only access to admin consoles and logs makes the inventory far more complete. We agree exactly what we see, and for how long, with your security team before we start. If access isn't possible, we work from interviews and exports.
How long does an assessment take?
It depends on the size of the organisation and how many systems are in scope. You get a written scope and timeline after the discovery call, before you commit to anything.
Does this replace our DPO or legal team?
No. They own the legal judgement. We bring the technical findings and the fixes.
What happens after the report?
Some clients fix the gaps with their own teams. Others ask us to build the fixes, or to build and deploy the AI they planned. Either way, the report is yours.
How our live systems handle data
Every case study has a section on how its data is handled: what the AI sees, what it never sees and which rules that maps to.