Fee
Register to see indicative feesConfirmed in writing after scoping01 / Build & Advisory · Standard
AI Governance & Responsible AI
AI decisions are being made across your organisation by people with no framework to make them against, and no record of having made them.
GovernBuild and advisory
Typical duration
10 to 14 weeksDepends on business units and AI touchpoints in scopePrimary artefact
AI governance frameworkPlus 3 moreWho leads it
Steve SharmaFounder & Principal04 / What this is
What AI Governance & Responsible AI is
This service builds the framework your organisation makes AI decisions against: the policy, the approval gates, the risk process, and the named accountability for each.
And what this service produces
It produces a governance model your team operates, not a document that sits in a drive. The test we apply is whether someone could use it next week to approve or refuse a real AI deployment.
05 / Who it is for
Built for a real assurance trigger, not a badge project.
01
This fits when
- AI use has outpaced any policy about it.
- Someone has been made accountable for AI without a framework to work from.
- The board is asking for a defensible position on AI risk.
- You want the governance without the certification.
02
The usual trigger
- The board asked who is accountable for AI and nobody had an answer.
- A team deployed something and you found out afterwards.
- An AI policy exists and nobody follows it.
- A regulator or insurer has started asking.
06 / The obligation
Why AI governance fails where information security governance works
Information security governance had thirty years to settle. The controls are known, the frameworks are mature, and most organisations have a functioning risk process to hang new controls on.
Deployment outpaces review
AI governance has none of that, and it also has a structural problem security never had: the people deploying AI are usually not the people who understand its risks, and the deployment takes an afternoon. A marketing team can put a customer-facing model into production before anyone in risk hears about it.
Voluntary review does not hold
This is why a governance framework that relies on people voluntarily submitting things for review does not work, and why most AI policies fail within two quarters.
Attach to what people already do
The frameworks that hold are the ones attached to something people already have to do: procurement, change management, or the deployment pipeline itself.
We design AI governance to attach to processes that already exist, because a parallel process that depends on goodwill has a predictable half-life.
07 / What you receive
Four artefacts. Each one yours to keep.
- 01
AI governance framework
The policy, the principles and the decision rights, written to be applied, not filed.
Document setGovernance owner - 02
Accountability model
Who decides what, who is consulted, and who is accountable when something goes wrong, mapped to real roles.
RACI + role descriptionsExecutive team - 03
Approval gates and process design
The gates AI systems pass through, attached to existing processes rather than parallel to them.
Process mapsProcess owners - 04
AI use register
Your current AI use, documented. It is usually the first time anyone has had a complete list.
RegisterGovernance owner
08 / Scope
The whole system is visible before work begins.
Discovery
- AI use identified across business units
- Shadow AI surfaced through procurement and expense review
- Existing policy and process assessed
Framework design
- AI policy and principles
- Risk appetite and tolerance statements
- Decision rights and escalation
Accountability
- RACI across AI lifecycle stages
- Role descriptions and mandate
- Board and executive reporting design
Process integration
- Approval gates attached to existing processes
- Procurement and vendor assessment questions
- Change management integration
Handover
- Governance owner briefed and documented
- First governance forum facilitated
- Operating rhythm established
09 / Included / not included
A useful boundary is part of the deliverable.
Included
- Discovery of AI in use across business units
- Governance framework design
- Accountability mapping
- Process integration
- Handover and the first governance forum
Not included
- Certification preparation: If you need ISO 42001 certification, that is a separate and longer engagement.
- Technical control implementation: We design the governance. Building the technical controls it calls for is separate work.
- Model development: We do not build, train or fine-tune models.
- Ongoing governance operation: We hand over to a named internal owner. Running the forum afterwards is yours.
10 / How we do it
A traceable path from scope to evidence.
Discovery
We find the AI actually in use, which is almost never the list you were given.
Framework design
Policy, principles, risk appetite and decision rights, built against your risk process rather than a template.
Accountability mapping
Who decides, who is consulted, who is accountable: mapped to real roles with real mandates.
Integration and handover
Gates attached to existing processes, owner briefed, first forum run.
Mapped againstISO/IEC 42001NIST AI RMFAustralia's AI Ethics PrinciplesEU AI Act
11 / Timeline
10 to 14 weeks of work.
Elapsed time and customer effort are separated because they are not the same number.
Weeks 1 to 3
Discovery
AI use surfaced and documented.
Customer effort
Interviews with 6-10 people, 45 minutes each, plus procurement data access.
Weeks 4 to 7
Framework and policy design
Policy, principles, risk appetite and decision rights, built against your risk process.
Customer effort
One half-day workshop, plus two review cycles.
Weeks 8 to 10
Accountability and process integration
The accountability model mapped to real roles, and approval gates attached to existing processes.
Customer effort
Two workshops with process owners, 90 minutes each.
Weeks 11 to 14
Handover and first forum
Owner briefing and the first governance forum. Discovery is where the timeline moves: organisations with decentralised AI adoption routinely surface twice what they expected.
Customer effort
The named owner's time, roughly 6 hours across the phase.
Our work: 10 to 14 weeks
12 / Scope check
Test whether AI Governance & Responsible AI
is the right next move.
We will cover likely scope, cost and fit.
Book a confidential strategy sessionWith Steve Sharma, who would lead.13 / Who leads the engagement
Named lead. Direct assessment.
Your AI governance lead
Steve Sharma
Founder & Principal
Runs discovery interviews personally and facilitates the first governance forum.
ASD-endorsed IRAP AssessorCISSPCREST
Every engagement has a named lead. Where a second executive or specialist is needed, they are named in the proposal and subject to client approval.
Review leadership record14 / Why Cybersecurity Link
Three decisions.
Accountability.
We attach governance to processes that already exist.
A parallel approval process that depends on goodwill has a predictable half-life. Ours hangs off procurement and change management.
Discovery surfaces what you actually have.
The AI use register is routinely the first complete list an organisation has had, and it usually changes the scope of everything after it.
We hand over to a named person, not a document.
The governance owner is briefed and the first forum is run with them, so the model is operated by your team after we leave.
15 / The boundary
What this engagement does not claim.
Operations
We are not a managed security service.
We do not run your SOC or monitor your environment.
Engineering
We do not build, train or fine-tune models.
Model development is a separate engineering activity.
Certification
This designs governance. It does not prepare you for ISO 42001 certification.
Certification readiness is a longer, separate engagement.
Frameworks
One governance model, mapped across four references.
The work maps to ISO/IEC 42001, the NIST AI RMF, Australia's AI Ethics Principles and the EU AI Act.
What moves the fee
Per additional business unit in scope.
Where a functioning risk process already exists.
Where phase 1 discovers shadow AI. Scope is revisited before phase 2 is committed.
Scope confirmed in writing after discoveryRe-quoted, never absorbed, if scope movesScope revisited before phase 2 is committed
18 / How this fits
Where this sits in the wider programme.
19 / When this is not right
Sometimes the best recommendation is a smaller service, or a later date.
20 / FAQ
The questions that change the decision.
Possibly not. The question we would ask is whether anyone has used it to refuse something. A policy nobody has ever applied is a document, not a governance framework, and if yours has teeth, we would tell you so and scope something smaller.
Procurement records, expense data, and interviews that ask what people actually use rather than what they are supposed to use. It is not sophisticated, and it routinely surfaces twice what the organisation expected.
Rarely the person who deployed the AI, and rarely IT alone. The model we usually land on has risk or legal accountable, technology consulted, and a business owner per system. We design it against your structure rather than prescribing one.
It does a substantial part of the work, but no. Certification readiness needs the management system, the internal audit and the evidence discipline on top. If certification is the goal, start there.
The AI Governance Starter produces a defensible minimum in two weeks. It is not this service, and we would say what it does not cover rather than describing it as an accelerated version.
21 / Next move
If AI Governance & Responsible AI is what you need, the next step is a conversation about scope.
45 minutes, with the executive who would lead it: what your scope actually looks like, and whether this is the right service for you at all.