Home/Assurance

Governance is the product, not the paperwork

The difference between a model and a system you can defend is whether the decision can still be explained when nobody who built it is in the room. This page sets out what we are certified against, what we build into every system, and what you can ask us to evidence.

What we can evidence today

ISO 27001: Certified information security management
ISO 42001: AI management system alignment
AWS · Azure · GCP: Hyperscaler delivery partners
IBM: Enterprise AI delivery with watsonx

AI Trust, Risk and Security

AI TRiSM is a service line and an operating posture. These are the controls we build in rather than bolt on.

01Model inventory and ownershipEvery model in production has a named owner, a documented purpose and a review date. You cannot govern what you have not listed.Governance 02Risk assessment per use caseAssessed against your framework and the EU AI Act risk tiers, before build rather than before launch.Risk 03Explainability and audit trailDecisions are reconstructable months later from the evidence that produced them, which is what an auditor actually asks for.Evidence 04Human oversight by designEscalation paths defined where being wrong is expensive, with the threshold agreed by the business, not the model.Oversight 05Monitoring, drift and retrainingProduction monitoring with retraining gated on evaluation rather than the calendar.Operations 06Red teaming and evaluationAdversarial testing before release, and a harness that stays in place so regressions are caught by machines, not customers.Testing

What you can ask us for

Certification evidence	ISO 27001 certificate and scope statement, on request under NDA.
Security review	We complete client security questionnaires and participate in vendor assessment as standard.
Data handling	Delivery inside your tenancy by default. Where a hosted model is used, boundary and retention terms are agreed in writing first.
Model documentation	Model cards, evaluation results and risk register per use case, handed over with the system.
Sub-processors	LIST TO BE SUPPLIED BY NQ

Frequently asked

Is ISO 42001 certification the same as alignment?

No, and we do not claim it. ISO 27001 is a certification we hold. ISO 42001 describes the AI management system our delivery is aligned to. If certification status changes, this page changes with it.

Who is accountable when a model is wrong?

Agreed before build and written into the engagement: which decisions the system may take alone, which require a human, and who owns the outcome in each case. An AI programme without that answer is not ready to deploy.

Do you work with clients under regulatory supervision?

Yes. Financial services, audit and regulated knowledge work are where most of our programmes sit, which is why evidence and traceability lead our design rather than following it.

Vetting us for a procurement process?

We complete client security questionnaires as standard, and our ISO 27001 certificate and scope statement are available under NDA.

Request our ISO 27001 scope Ask a compliance question