Service Scope & Disclaimer

What we do

We support organisations with AI policies, risk management, governance, compliance-related processes, staff training and ongoing governance review.

Depending on the agreed engagement, our work may include:

• identifying AI tools, uses, data flows and decision processes;
• documenting risks, impacts and control gaps;
• developing policies, registers and operating procedures;
• defining responsibilities, approvals and human review arrangements;
• supporting supplier assessment and evidence gathering;
• providing staff training and implementation support;
• reviewing controls, changes, issues and improvement actions.

Each engagement has an agreed scope. The website does not imply that every listed activity is included in every project.

Our methodology

Our 5A approach — Align, Assess, Architect, Adopt and Assure — provides a practical structure for delivering governance work.

It is informed by ISO/IEC 42001 and other relevant references where appropriate. Using the approach does not itself establish conformity with a standard or compliance with every applicable obligation.

Legal and other specialist advice

Our AI governance services are not a substitute for legal advice from an appropriately qualified legal practitioner.

We may help gather operational facts, identify questions and coordinate review, but matters requiring legal interpretation or other regulated professional judgement should be confirmed by the relevant qualified advisers.

We do not provide financial product recommendations, investment advice or clinical advice through this website or as part of the governance services described here.

Technical work

We may help define testing requirements, monitoring expectations, acceptance criteria and evidence needs.

Software development, cybersecurity testing, quantitative model validation and specialist technical assessments are included only where expressly agreed and performed by suitably qualified personnel.

Where these activities are outside scope, the client and its technical teams or suppliers remain responsible for carrying them out.

Client responsibilities

Clients remain responsible for:

• providing accurate and sufficiently complete information;
• identifying relevant systems, business activities and stakeholders;
• appointing authorised decision-makers;
• implementing and operating agreed controls;
• obtaining necessary specialist advice;
• making business decisions and approving residual risk.

Our recommendations depend on the information, access and evidence available within the agreed scope.

Certification and assurance

We do not issue ISO management-system certification.

Individual Lead Implementer qualifications are personal credentials and do not mean that our business or a client holds ISO/IEC 42001 certification.

Where the word “Assure” is used in our methodology, it refers to governance monitoring, review and improvement. It does not automatically mean an independent audit opinion, statutory assurance engagement or certification decision.

Outcomes and limitations

Governance work can improve clarity, accountability and oversight, but no policy, assessment or framework can eliminate all AI risk.

We do not guarantee regulatory approval, certification, the absence of incidents or a particular commercial outcome.

Reviews are limited to the agreed scope and available evidence. Changes in systems, data, business activities or requirements may require reassessment.

Examples and educational materials

Illustrative examples demonstrate an approach. They are not client case studies unless expressly identified as such, and they should not be treated as ready-made advice for a particular organisation.

Your rights

Nothing on this page excludes or limits rights or remedies that cannot lawfully be excluded or limited.

Discussing an engagement

Email [email protected] to discuss your circumstances and an appropriate scope.