AI Security, Governance & Assurance

What it is

A six-to-twelve-week engagement that builds the security, governance and assurance foundations the organisation needs before its AI initiatives can move from pilot to production. Combines AI-specific security architecture review, governance design, AI Acceptable Use Policy authoring, regulatory alignment (UK Government AI policy, EU AI Act where relevant), and the audit framework that holds it together.

Who it's for

CISOs, Data Protection Officers, Heads of Information Governance, Risk & Audit leads, and programme directors who need audit-ready foundations before AI deployment. Often commissioned in parallel with Strategy & Roadmap (Phase 2) so the governance design is finalised before implementation begins.

Duration

6–12 weeks

Format

Fixed-scope or threaded

From

£45,000 +VAT

Engagement

Embedded + specialist

What's covered

Eight Foundation Components

AI Acceptable Use Policy — organisation-tailored, role-specific, defensible. Covers generative AI use, data classification, sanctioned tools, prohibited uses.
AI risk framework — AI-specific risk taxonomy, classification scheme (proportionate to use case), risk register template, control catalogue.
Governance architecture & ToR — AI committee structure, terms of reference, RACI matrix, decision rights, escalation paths.
Security architecture review — IAM, data classification, model boundary, prompt injection resilience, output handling, secret management, logging, monitoring — AI-specific.
DPIA template & worked example — AI-specific Data Protection Impact Assessment template, with a fully worked example drawn from your context.
Supplier governance schedule — the AI-specific clauses, transparency requirements, audit rights and exit provisions to embed in supplier contracts.
Compliance map — alignment to UK Government AI policy, ICO guidance, sector regulators, EU AI Act tiers where applicable, with named obligations and named owners.
Audit framework & evidence vault — what documentation needs to exist, where it lives, who maintains it, how it is presented under audit.

Deliverables

Board-Ready Output

Eight deliverables. All audit-ready. All organisation-tailored, not template copies. Forms the governance backbone that every later phase depends on.

AI Acceptable Use Policy — ready to publish across the organisation.
AI Risk Framework & Register Template — populated with starter risk set.
Governance ToR & RACI — ready for committee adoption.
Security Architecture Review Report — current state, gaps, target architecture, remediation roadmap.
DPIA Template + Worked Example — usable for every AI initiative going forward.
Supplier Governance Schedule — contract-ready language for procurement to embed.
Compliance Map — regulator-by-regulator obligations, owners, evidence requirements.
Audit Framework Pack — evidence requirements, vault structure, audit-readiness checklist.