Leafletdrop
Know what AI you're using, and be able to prove it's under control
AI governance sets the rules, responsibilities, checks and evidence for how your business buys, builds and uses AI. Each use gets controls that match its data, its users and what could go wrong, and a clear owner.
When to call us
When AI use has outgrown your rules
If AI has spread faster than your policy, and nobody can say what's being used where, it's time to put governance in place.
AI use has spread faster than your policy, your inventory or your review process.
Staff are putting confidential or personal data into tools nobody has assessed.
Customers are asking how you govern AI, and the answers vary depending on who replies.
You have principles, but no controls, evidence or owners.
Either risky work goes ahead unchecked, or safe work stalls waiting for approval.
Why it matters
AI problems are common, controls are not
Half of organisations using AI have already seen it go wrong, and few have the policies and practices to manage it.
-
51%
of people surveyed at organisations using AI say they've had at least one negative consequence from it.
Source: McKinsey, The state of AI in 2025, November 2025, opens external site
-
24%
of UK businesses using or considering AI have cyber security practices in place to manage its risks.
Source: DSIT, Cyber Security Breaches Survey 2025/2026, April 2026, opens external site
-
31%
of European business and IT professionals surveyed say their organisation has a formal, comprehensive AI policy.
Source: ISACA, AI Pulse Poll, June 2025, opens external site
What we do
-
Find what's in use
An inventory of the AI tools and features across the business, including the ones nobody signed off.
-
Sort by risk
A simple way to tier each use by its data, who it affects and what could go wrong, so low-risk drafting doesn't get the same scrutiny as a customer decision.
-
Write the rules people will follow
An acceptable use policy, approved tools, data rules, and a route for exceptions.
-
Put in the controls
Approval steps, vendor checks, testing, logging and an incident process, sized to each tier.
-
Keep the evidence
Records you can hand to a customer, a board or an auditor, aligned with ISO 42001 and the EU AI Act where they apply.
Worth knowing
What governance really means
Three things people often get wrong.
A policy isn't governance
A policy needs an inventory, owners, risk checks, controls and evidence behind it, or it's a document nobody reads.
ISO 42001 certifies the system, not the model
It shows an organisation manages AI properly. It doesn't guarantee any single AI output is right, which is why each use still needs testing.
Banning tools isn't a plan
People will use AI anyway. Approved tools, clear data rules and a quick way to ask for exceptions work better than a ban.
Self-check
Five questions a customer might ask you
If a customer's security questionnaire asked these tomorrow, could you answer them?
- Which AI tools and features does your business use?
- What data is allowed to go into them, and how do you stop the rest?
- Who approves a new AI use, and how is the risk assessed?
- How do you check AI outputs that reach customers?
- What happens when something goes wrong, and when did it last happen?
Questions
The things people usually ask
Plain answers about AI governance, risk and compliance, what's involved and what we need from you. Anything else, just ask.
Do we need ISO 42001?
Not necessarily. Many businesses need a sensible policy, an inventory and proportionate controls. Certification makes sense when customers or contracts ask for it.
Do you give legal advice?
No. We set up the governance and controls, and work alongside your legal team or advisers where a legal view is needed.
Will this slow our teams down?
It shouldn't. Low-risk uses get a light touch, so the effort goes where the risk is.
