AI Governance
Get control of AI before it gets ahead of you.
AI is already embedded in how your teams work — in marketing copy, customer support, finance, HR and reporting. We help you govern it deliberately: know what’s in use, decide what’s acceptable, and evidence that oversight to customers, auditors and your board.
Data Protection
Data protection and GDPR, handled properly — without hiring a full-time DPO.
We act as your outsourced Data Protection Officer and privacy team: building the records, policies and processes the ICO expects, answering the questions your customers ask in due diligence, and being on hand when something goes wrong.
Why this matters now
Most organisations adopted AI faster than they governed it.
The tools arrived through individual teams and existing software updates rather than a procurement decision. That leaves a gap between what your organisation is actually doing with AI and what it can demonstrate about it.
Shadow AI is already in use
Staff are pasting company and customer data into consumer AI tools that were never reviewed, approved or contracted for.
Regulation is landing
The EU AI Act phases in obligations — including AI literacy duties — and UK regulators are setting sector expectations. ISO/IEC 42001 now gives a certifiable standard.
Customers are asking
AI questions are appearing in security questionnaires and contract renewals. “We don’t track that” is increasingly a lost deal.
What’s included
A governance framework sized to your business.
AI inventory & use-case register
A live record of every AI tool and use case in the business — including the ones arriving inside software you already licence.
AI policy & acceptable use
Clear rules on what staff may and may not do with AI, written to be followed rather than filed.
Risk classification
Each use case assessed by impact and exposure, so effort goes to the decisions that carry real consequences.
DPIAs for AI processing
Where AI touches personal data, the impact assessments and lawful-basis reasoning the ICO expects.
Vendor & model due diligence
Assessment of AI vendors and embedded models: training-data claims, retention, sub-processors and contractual terms.
Data leakage controls
Practical guardrails so confidential, client and special category data doesn’t end up in third-party models.
Human oversight & accountability
Defined ownership, escalation and review points — who is accountable for each AI-assisted decision.
AI literacy & training
Role-appropriate training so teams understand the limits of the tools and their obligations when using them.
Monitoring & incident handling
A process for AI failures, inaccurate outputs and misuse — including what gets recorded and reported.
Board reporting
Regular, plain-English reporting on AI adoption, risk and controls for your leadership team.
The difference it makes
Governed adoption beats both extremes
- KH-InfoSec AI Governance
- A maintained inventory of every AI use case
- Clear guardrails staff can actually follow
- New tools approved quickly, on evidence
- A ready answer for customers, auditors and the board
How the engagement runs
From discovery to demonstrable control.
01
Discover
We find out what AI is genuinely in use across the business sanctioned, embedded and unofficial and build the inventory.
02
Assess
Each use case is classified by risk and reviewed against your regulatory and contractual obligations.
03
Govern
We put the policy, approval route, guardrails and training in place so new AI adoption goes through a decision rather than around one.
03
Assure
Ongoing review, monitoring and board reporting — and the evidence pack to answer customer and auditor questions.
Frequently asked questions
AI governance questions we hear often.
We’re a small business — isn’t AI governance overkill?
The obligations scale, but they don’t disappear. For most SMEs this is a short, focused piece of work: an inventory, a policy people will actually follow, a few guardrails and a review rhythm. It is far cheaper than discovering the problem during a contract renewal or after a data incident.
Does the EU AI Act apply to us if we’re UK-based?
It can. The obligations follow the market rather than the office — if you place AI-enabled products or services into the EU, or your outputs are used there, parts of it may apply. We assess this and document the reasoning, so the position is defensible either way.
Should we just block AI tools instead?
Blanket bans rarely hold. Staff route around them with personal accounts, which is worse than sanctioned use because you lose all visibility. Governed adoption gives you the productivity with a record of what is happening.
How does this relate to your Data Protection service?
They overlap where AI processes personal data — DPIAs, lawful basis and transparency. AI Governance goes wider: model risk, accuracy, oversight, vendor claims and use cases that involve no personal data at all. Many clients take both as one engagement.
Can you help us work towards ISO 42001 certification?
Yes, we can help you work towards ISO 42001 certification. Please contact us for further information.
What if AI is already embedded in software we bought years ago?
That is the common case, and it is exactly what the discovery stage is for. Features added by vendors through updates are in scope, and we assess them alongside the tools you chose deliberately.
Know what your business is doing with AI.
Book a free discovery call and we’ll show you where the gaps are, no jargon, no scare tactics.