You need evidence your AI is governed, not a policy nobody uses.
A governance readiness assessment shows you where your policy and what actually happens don't match. From there, we close the technical gaps and build controls that keep the fix in place automatically — not a document on a shelf.
Enforced by the platform, not the honor system.
The same tools your engineering team already uses to manage secrets, track services, and monitor systems — wired into policy enforcement instead of bolted on separately.
Recognize the symptoms
The symptoms that show up first.
Policy documents define what should happen. They never define what actually does.
- An engineer ignores the policy document because nothing actually stops them
- Nobody can say which models are in production or who approved them
- The same policy gets interpreted three different ways by three different teams
- Unapproved AI is running somewhere nobody can see, because nothing requires registration
Governance that lives in a document isn't governance.
- AI systems nobody signed off on start appearing in every organization that uses AI. Teams spin up models without approval, prompts change without testing, and agents get more access than they should.
- When something fails, nobody can trace who did what or why. Policy documents exist, but nobody enforces them, so governance turns into paperwork — boxes checked, rules ignored, risk left unmanaged.
- Start with a governance readiness assessment: a structured review of what's actually running, who can act without oversight, and where policy and enforcement diverge.
- From there, security closes the technical gaps the assessment surfaces, and engineering controls make the fix permanent instead of another document.
Why policy documents don't work
What to assess now — the EU AI Act deadline just moved.
On July 27, 2026, the EU's Digital Omnibus pushed the Annex III high-risk deadline from August 2, 2026 to December 2, 2027 — six days before it would have taken effect. Article 50 transparency obligations didn't move; they've been enforceable since August 2, 2026.
The Commission moved the date because the standards bodies (CEN/CENELEC) and the testing and certification process needed to check systems against the law weren't ready, not because the obligations went away. Sixteen extra months to build a risk-management system, human-oversight controls, and audit logging is not sixteen extra months before you need to start.
What's already enforceable: prohibited practices since February 2025, and Article 50 transparency obligations — chatbot disclosure, deepfake labeling, machine-readable marks on AI-generated content — enforced by the AI Office and member-state authorities since August 2, 2026. Penalties scale by tier: up to €35M or 7% of global turnover for prohibited practices, up to €15M or 3% for high-risk and transparency violations, up to €7.5M or 1% for misleading an authority.
Classification doesn't move with the deadline. Map every production AI system against the four tiers now — prohibited, high-risk, limited-risk (Article 50, live today), or minimal-risk — and start on the controls each tier needs. None of it holds without enforcement in code: a risk-management process that lives in a document, not a pipeline gate, fails the first audit that asks for evidence instead of intent.
We don't just design governance. We build the system that enforces it.
Five pieces that turn a policy document into rules a computer actually enforces.
Policy as code
Rules like which models can be used, who can call which APIs, and how data must be classified — written so a computer checks them automatically, not just written down and hoped for.
Access control
Clear rules for who can create agents, change prompts, or access which models and data — everyone starts with the least access needed, not the most, and every permission is logged.
Approval workflows
High-risk changes — new models, new tools, capability changes — get routed to the right people for sign-off, with every decision logged.
Audit trails
Every action logged: who created it, who changed it, what changed, when, and why. A permanent record for compliance, debugging, and incident response.
Model & tool registry
A central inventory of approved models, tools, and integrations. If it's not on the list, it can't run.
From our experts.
Writing on safe rollout, agent governance, and production accountability.
The same nine-phase process, applied to governance.
From discovery to handoff, with an enforcement check at every step instead of a document nobody reads.
Common questions.
Governance that actually works.
A policy framework you build once and enforce everywhere. Checks that stop risky changes automatically. Audit trails that prove compliance. Control that holds up as you grow.
NDA available on request · Scoped engagements · No surprise fees