AI governance that holds up when someone actually looks.

AI Compliance & Awareness Training

Delivered in four cumulative layers so each audience gets what is relevant to their role rather than one generic all-hands session. On-site in Middle Tennessee or remote. Attendance records and curriculum are retained as evidence of competence under ISO 42001 Clause 7.2 and NIST AI RMF GOVERN 2.2.

• Awareness — baseline literacy for every employee who touches an AI tool: what is permitted, what is logged, what never goes into a prompt
• Role-specific — practical guidance for the teams operating or overseeing AI day to day, including engineering, HR, marketing, and support
• Elevated — deeper training for compliance, risk, privacy, and legal staff responsible for ongoing conformity and impact assessments
• Governance — board and senior leadership session on oversight duties, accountability, and what they are signing when they sign

AI Compliance Assessments

A structured assessment of a specific AI system against the obligations that actually apply to it — what is in scope, what is missing, and what to put in place, in priority order. Depth depends on the sector and the decision the system influences, so this runs in three tracks.

• General & SMB — systems that interact with users, generate content, or make recommendations: disclosure, logging, human review, and acceptable use
• HR & Recruitment — hiring, promotion, task allocation, and worker monitoring, where bias testing and candidate-notice duties bite hardest under state AI and civil-rights law
• Financial Services & Healthcare — credit decisioning, fraud, AML/KYC, claims, and clinical support, where AI duties land on top of existing model-risk and sectoral supervision
• Deliverables — AI system inventory and classification, AI impact assessment, prioritized gap register, and a remediation plan with named owners and dates

What is in the pack

• AI vendor risk classification guide — decide whether a system is prohibited, high, limited, or minimal risk before you spend time assessing it
• Vendor questionnaire & RAG scorecard — structured questions on training data, model provenance, human oversight, retention, sub-processors, and evaluation
• Red-flag reference sheet — the vendor answers that should pause or stop a procurement, and the follow-up question for each
• Compliance declaration & contract addendum — AI-specific clauses on training-data use, model change notice, indemnity, and audit rights
• Assessment record & audit log — complete documentation of how the decision was made, for regulators, customers, and litigation defense
• Annual review cadence — re-assessment triggers tied to model version changes, incidents, and contract renewal dates

ISO/IEC 42001 AI Management System Implementation

End-to-end implementation of a certifiable AI management system — the first international standard for governing how AI is developed, deployed, and overseen. Built to share evidence with any ISO 27001 or SOC 2 program you already run, rather than duplicating it.

• Gap analysis against Clauses 4–10 and the Annex A controls, scoped to your actual AI footprint
• AI policy, roles, and objectives — Clause 5, with a governance forum that meets and leaves minutes
• AI risk assessment and impact assessment — Clauses 6.1.2 and 6.1.4, tied into your existing risk register rather than running parallel to it
• Statement of Applicability with justified inclusions and exclusions
• Internal audit and management review — Clauses 9.2 and 9.3, rehearsed with you before the certification body sees them
• Stage 1 and Stage 2 support — auditor liaison, evidence packaging, and nonconformity response

NIST AI Risk Management Framework Alignment

For organizations that want defensible AI risk practice without a certification audit — commonly federal contractors and their suppliers, and enterprises answering AI questions in customer security reviews.

• Current and target profile across the four functions: Govern, Map, Measure, Manage
• Generative AI Profile — NIST AI 600-1, covering confabulation, data leakage, provenance, and content integrity
• Measurement plan — which AI risks you will actually test, how often, and what triggers escalation
• Crosswalk to ISO 42001 so one set of evidence answers both the framework and the certification auditor

AI Risk Management Program

An AI risk function that produces decisions rather than a heat map nobody reads — built on ISO 31000 discipline and ISO/IEC 23894 AI-specific guidance.

• AI system inventory — including the shadow AI already in use and the AI features switched on inside tools you bought for something else
• AI risk taxonomy and register — bias, drift, confabulation, data leakage, provenance, over-reliance, and misuse, in one register rather than four competing ones
• Appetite and tolerance statements the board can actually apply to a real deployment decision
• Assessment methodology — consistent likelihood and impact scales, calibrated so scores mean the same thing across teams
• Treatment plans — accept, mitigate, transfer, avoid, each with an owner, a date, and a review trigger
• Reporting — management review packs and board reporting that satisfy Clause 9.3 without a custom rewrite

AI Vendor & Third-Party Risk Management

Most organizations do not build AI — they buy it. Your AI posture is only as good as the model provider your vendor forgot to mention. This builds the standing program that finds them; the Vendor Assessment Pack above is the toolkit it runs on.

• AI vendor inventory and tiering — criticality based on decision impact, data exposure, and concentration on a single model provider
• Due-diligence workflow — questionnaire depth matched to tier, with assurance-report review that checks scope and exceptions, not just the logo
• Contract requirements — training-data use, model change notice, evaluation disclosure, sub-processor limits, breach notification, and audit rights
• Fourth-party mapping — the foundation-model provider sitting behind the vendor you are actually contracting with
• Continuous monitoring — reassessment cadence, attestation expiry tracking, and model-version and incident triggers
• Offboarding — data return and deletion evidence, the step almost every program skips

GRC Workflow Design & Automation

We start with where your compliance hours actually go, then decide deliberately which steps are safe to automate, which need a human in the loop, and which should never be automated at all. That last category is where most AI automation projects quietly go wrong.

• Process mapping — the real workflow, including the spreadsheet handoffs and Slack approvals nobody documented
• Automation candidacy rating — each step scored on error tolerance, reversibility, and whether a wrong answer reaches a customer or a regulator
• Workflow design — triggers, handoffs, exception paths, escalation, and the approval gates that stay human on purpose
• Build or build-with — implemented in whatever you already run, or handed over as a specification your own team executes
• Guardrails for internal AI agents — least-privilege tool access, scoped retrieval, action logging, and a defined blast radius
• Controls over the automation itself — change management, access review, and logging, so an assessor can test it like any other control

Evidence Collection & Control Testing Automation

Evidence collection is the largest recurring cost in any certification program, and the thing auditors are quickest to reject when it has been automated badly. Completeness of population is almost always the reason.

• Control-to-evidence mapping — what proves each control, drawn from which system, at what frequency
• Scheduled collection — automated pulls with source attribution, timestamps, and tamper-evident storage
• Continuous control monitoring — exception detection and alerting between audits, not a scramble in the two weeks before one
• Population completeness — demonstrating the sample was drawn from the whole population, the test automated evidence most often fails
• Crosswalked artifacts — one evidence item satisfying ISO 42001, the AI RMF, and your existing ISMS at the same time
• Auditor hand-off pack — evidence presented the way an assessor expects to receive it

Security & AI Questionnaire Response

Customer security reviews are now a sales blocker, and AI questionnaires have been bolted onto the front of them. Retrieval over your own approved control corpus turns a two-week response into a one-day review — but the draft always goes to a human, because a confidently wrong answer here is a misrepresentation to a customer.

• Answer library built from your approved policies, controls, and prior responses, each entry with a named owner and an expiry date
• Retrieval and drafting over that corpus only — no invented capabilities, every answer citing the control it came from
• Confidence flagging — answers the system is unsure of are routed to a reviewer rather than smoothed over
• Review-and-release workflow — nothing reaches a customer without a person approving it
• Drift detection — flagging library answers that no longer match the control as actually implemented
• AI questionnaire coverage — the model provenance, training-data, and human-oversight questions now appearing in every enterprise review