Domain 05 of six

AI governance and literacy

Artificial Intelligence is almost certainly already in use in your organisation. This domain establishes where, on what data, under whose authority, and whether the people using it know what the rules are.

Request an assessment All six domains

Why it matters

The problem this addresses

Adoption of Artificial Intelligence rarely arrives as a project. It arrives as individuals finding tools that make their work easier, which is a good instinct and a difficult thing to govern after the fact.

The exposure is quiet. Confidential information pasted into a tool nobody approved. A decision that affects a customer, made with output nobody checked. Neither is visible until somebody asks, and by then the answer has to be reconstructed.

Scope

What we examine

Where Artificial Intelligence is already used, including the tools nobody formally approved
What information is being entered into those tools, and where it goes
Whether output is checked by a person before it reaches a customer or a decision
Who is permitted to authorise a new tool, and on what basis
Whether staff know the rules well enough to follow them without looking them up

Assessed against: A five-level maturity scale, applied against recognised frameworks selected to suit the domain. Framework alignment is a statement of method, not a certification claim.
ISO/IEC 42001:2023: The international standard for Artificial Intelligence management systems. Our approach to this domain is aligned to it.
NIST AI Risk Management Framework: Govern, Map, Measure and Manage.
COBIT 2019: For the accountability and decision rights that sit around adoption.

Beyond policy

Putting Artificial Intelligence to work on the routine

Governance answers whether you should. The harder question most organisations have is what to actually do with these tools, and that is not a prompting course.

We help you find the repetitive, rule-bound work that quietly consumes your team's week, decide which of it is genuinely worth automating, and put the tooling in place with the controls already around it. Reconciliations, report preparation, document drafting, correspondence handling, data entry between systems that were never designed to talk to each other.

Identify candidate processes and size the time actually spent on them
Assess each for suitability, exposure and the cost of getting it wrong
Select tooling, and design the human checkpoint that stays in the loop
Implement, then measure against the time the process used to take
Register it, so what you automated stays visible and governed

Scoped and quoted on request, at a fixed fee agreed in writing. It works best after the acceptable use policy exists, so that what you automate is governed from the first day rather than retrofitted.

Discuss automating a process Check where you stand first

Assessment

Included in the Assessment

Fixed scope, agreed in writing before work begins. Findings your leadership can act on within ten working days of the final interview.

Maturity rating for this domain on the five-level scale
Acceptable use policy written in plain language, for the people who will actually use these tools
Use case and risk register covering what is in use and what is proposed
Adoption decision framework, so a new tool has a route rather than a debate
Staff awareness material, pitched at ordinary users rather than at specialists

Price: SCR 20,000 to 40,000 for this domain, VAT exclusive. Where it sits in that band depends on the size and scope of your organisation, not on which domain you choose. Fixed and agreed in writing before work begins. All six domains together are quoted on request, priced as six with a discount for taking the whole position at once.
What that price does not include: Building what the assessment recommends. That is a separate engagement, scoped and quoted against what you need, and it is where most of the work usually sits. See below.
Evidence gathered: Structured interviews across executive, finance, technology and one business function, plus document and systems review.
Turnaround: Ten working days from the final interview.

Implementation

Available as an Implementation Engagement

An assessment that ends at a report has done half the job. Most organisations know roughly what is wrong. What they lack is the time and the specialist capacity to fix it while also running the organisation.

In this domain that means

Write the acceptable use policy and take it through approval
Build the use case and risk register from what is genuinely in use
Deliver the awareness sessions to your teams

How it is priced: Quoted on request. Fixed scope and fixed fee, agreed in writing before work begins. We do not work on an open-ended basis.
Independence: Assessment and implementation are separately scoped engagements, quoted and agreed in writing before either begins. Keeping them separate is deliberate. It is what allows the assessment to stay independent, and it means you are never presented with findings that happen to recommend more of our own work. Where we have implemented something, any later re-assessment of that work says so plainly.

Where does this sit for you today?

If you are not sure whether this domain is a priority, the Quick Diagnosis takes about two minutes and gives you a position on the page. Nothing is sent anywhere.

Discuss a governance concern Try the Quick Diagnosis