Why AI governance is landing now
EU AI Act obligations are phasing in through 2026–27
Enterprise buyers now ask for AI assurance in security reviews
Boards and regulators want evidence, not AI policy statements
ISO/IEC 42001 is the only certifiable AI standard, and it is auditable like ISO 27001
What we deliver: governance
- AI inventory and use-case classification
- An AI Management System (AIMS) built onto your existing ISO 27001 ISMS
- An AI risk register, AI risk and impact assessments and acceptance thresholds
- ISO/IEC 42001 certification escort and ongoing AIMS operation
What we deliver: AI assurance testing
AI red teaming
Adversarial prompts and jailbreaks, misuse scenarios, harmful-content elicitation, multi-turn manipulation and tool-use abuse in agentic systems.
ISO/IEC 42001 · AI riskLLM penetration testing
Full coverage of the OWASP Top 10 for LLM Applications (2025): prompt injection, sensitive data disclosure, supply chain, output handling, excessive agency and vector store weaknesses.
ISO/IEC 42001 · AI system securityBias and fairness testing
Protected-attribute analysis, dataset representativeness, fairness metrics, subgroup performance and drift monitoring.
ISO/IEC 42001 · Impact assessmentSecure AI development
Workshops and secure-SDLC integration for AI-assisted development: threat modelling, code review labs and guardrails in CI/CD.
ISO/IEC 42001 · AI lifecycle
Every finding is tagged to an ISO/IEC 42001 control and an OWASP LLM category, then tracked to closure and retest.
AI risks we're finding in real environments
Prompt injection
Malicious instructions hidden in documents, emails, web pages and tool output that the model obeys.
Sensitive data disclosure
Customer data, secrets and business logic extracted through crafted prompts or leaked into third-party models.
Excessive agency
Over-permissioned agents with write access and no human approval step before irreversible actions.
AI supply chain
Models, plugins and connectors with no verified provenance.
Misinformation and over-reliance
Hallucinated output relied on in legal, medical or financial decisions.
Unbounded consumption
Token flooding and recursive tool calls that run up costs, and model extraction.
Shadow AI: the risk nobody owns
Business users, not developers, are now building agents and automations wired straight into CRM, HR, finance and customer data. Shadow AI doesn't just store data. It takes actions with the builder's full permissions.
- 01Discover every AI asset
- 02Classify by impact
- 03Put guardrails and ownership in place
- 04Govern it under the AIMS
Outcome
Evidence-based AI governance your customers, auditors and board can trust.
Often combined with
- Certification & complianceISO/IEC 27001 certification escortGap analysis to Stage 2 audit and annual surveillance.Learn more
- Risk & assurancePenetration testingWeb, API, cloud, network and mobile testing, with every finding tracked to closure.Learn more
- Operations & resilienceSecurity awareness & secure development trainingFrom everyday hygiene to the safe use of AI tools.Learn more
Frequently asked questions
Do we need ISO 27001 before ISO 42001?
It isn't mandatory, but it makes ISO 42001 much easier. We build the AIMS onto your existing ISMS so evidence is shared.
We only use third-party AI tools. Does this apply to us?
Yes. Using AI services still creates risks around data, suppliers and decision-making that ISO/IEC 42001 and your customers expect you to manage.
Ready for your free consultation?
Tell us about your security and compliance goals. Within 24 hours of our first conversation, we'll send you a detailed, cost-effective offer tailored to your needs.