Industries
Policies, privacy and vendor due diligence.
How to choose · AI risk and governance
Assess an AI vendor on data handling, security assurance, model and subprocessor transparency, contractual protections, testing and monitoring support, and operational resilience. Request evidence rather than assertions: independent attestations, data flow diagrams, retention terms and incident commitments. Tailor depth to the risk of the use case, and revisit when features or subprocessors change.
Comparison · AI risk and governance
These instruments do different jobs. A risk management framework offers guidance on identifying and managing risk; a management system standard describes the organisational processes that can be audited and certified; regulation creates legal duties with penalties and applies by jurisdiction. Most organisations use a framework to design practice, a standard to structure it and legal advice to meet obligations.
Problems & fixes · AI risk and governance
Shadow AI arises when approved options are slow, limited or unknown. Prohibition alone seldom works. Combine discovery, a clear policy with examples, an approved alternative that meets real needs, a quick exception route, technical guardrails on sensitive data and training that explains reasons. Treat discovery as information about unmet needs rather than only a disciplinary matter.
Requirements · AI risk and governance
Tools that influence decisions about people face the strictest expectations. Typical requirements include a defined lawful purpose, documented impact assessment, testing for discriminatory effects, transparency to affected people, meaningful human oversight with authority to override, routes to contest outcomes, record keeping, and vendor evidence. Laws differ by jurisdiction, so obtain legal advice and consult regulator guidance before use.