AI Governance Implementation
Be able to say which AI systems you run, what they are allowed to do and how each decision was reached.
- Typical timeline
- 6 to 12 weeks
- Typical timeline
- Listed below
- 7 deliverables
- Listed below
- No obligation
- Quoted after scoping
- No obligation
Built for
- Risk, compliance and security leads asked to account for how AI is used
- Organisations whose use of AI has grown faster than the oversight around it
- Teams preparing for questions from auditors, regulators, customers or their own board
You recognise this
- Nobody has a complete list of the AI systems and agents in use
- There is a policy document, but nothing in the systems enforces it
- You could not show how a particular AI-assisted decision was reached
The problem
AI governance often stops at a policy. A policy the systems do not enforce, and that leaves no record, does not help when someone asks what an AI system did and who approved it. This package turns governance into working controls: an inventory, permissions, human checkpoints and an evidence trail.
What you receive
- 01
AI system inventory
A register of the AI systems and agents in use, who owns each one, what data it uses and what it can do.
- 02
Risk assessment
Each system assessed for impact, so effort goes where the risk is.
- 03
Policies and approval rules
Practical policies, including which decisions a person must still approve, written for the people who have to follow them.
- 04
Controls in your systems
The policies put into practice: agent identity, permission limits, approval steps and logging.
- 05
Evidence trail
Records of what each system did and who approved it, kept so they can be produced when a reviewer asks.
- 06
Framework mapping
Where it helps, a mapping of your controls to frameworks you have chosen to work against, such as the NIST AI Risk Management Framework or ISO/IEC 42001, showing what is covered and what is not.
- 07
Operating handover
Who reviews what, and how often, so governance keeps running after we leave.
Phases and expected timeline
- 01
Discovery and inventory
1 to 2 weeks
We find the AI systems in use, including the ones bought or built outside IT, and who owns each.
- 02
Risk assessment and policy design
2 to 3 weeks
We assess each system and write the policies and approval rules with the people who will follow them.
- 03
Control implementation
2 to 5 weeks
The controls are put in place in your systems, starting with the highest-risk ones.
- 04
Evidence and handover
1 to 2 weeks
We check the evidence trail can be produced on request, then hand over the operating routine.
Typical timeline: 6 to 12 weeks
Typical range for a single, well-defined scope. The clock starts once access and the people we need are in place. Your quote confirms the timeline after a scoping call.
Before we start
- An executive sponsor and a named owner for AI governance
- Access to the teams that build, buy and use AI systems
- Existing policies, risk registers and any regulatory obligations you already track
- Technical access to the systems where controls will be put in place
What you can do afterwards
- You have a current list of the AI systems in use and who owns each one
- Policies are enforced in the systems, not only written down
- When asked how a decision was reached, you can produce the record
- You can show which parts of a chosen framework your controls cover, and which they do not
What this work is designed to achieve. Results depend on your systems and your data.
Questions about this package
No package can do that on its own, because whether a system meets a law is assessed system by system. What we deliver is the inventory, the controls and the evidence that assessment relies on, and a clear view of the gaps.
No. We put the technical and operational controls in place. Where a question needs legal advice, we say so, and we can work alongside your legal advisers.
No. Controls can be put in place with tools you already have. Bulwark is our own product for agent identity, permissions and audit, and where it fits we show you how, alongside the alternatives.
Because the work depends on your systems, your data and how far the scope reaches. After a scoping call we send a written quote that states the scope, the deliverables, the timeline and the cost. Larger enterprise projects are quoted separately, based on scope, integrations, deployment requirements and ongoing support.
Yes. Say so in your enquiry and we will sign one before you share details of your systems.
Yes. For example, an architecture review can lead straight into a build, and we can quote the combined work as one engagement with one plan.
Handover includes the documentation, runbook and working session your team needs to run what we delivered. If you want us to stay involved, ongoing support is quoted separately.
Get a quote for this package
Tell us about your systems and what you need. We reply with questions or times for a scoping call, then send a written quote that sets out the scope, the deliverables, the timeline and the cost.
Larger enterprise projects are quoted separately, based on scope, integrations, deployment requirements and ongoing support.
Prefer email? info@bastionshieldtechnologies.com
Often considered alongside
AI Agent Security Assessment
A structured security test of your AI agents and the systems they can reach, with findings ranked and retested once fixed.
Corporate AI Workshop
Hands-on sessions for engineers and leaders, built around your own systems and use cases rather than a generic slide deck.