AI governance you can evidence. Mapped, never certified.
Named governance leadership for the AI you put into production. We baseline it against the frameworks your auditors, regulators and customers ask about, run the controls with you, and hand over evidence mapped clause by clause to ISO/IEC 42001, the EU AI Act and the NIST AI RMF. Three tiers, and each one stands alone.
When this is the right service
A questionnaire you cannot answer
A customer or procurement team has asked about ISO/IEC 42001 or your AI controls, and the evidence is scattered or missing.
AI already in production
Models, agents or voice assistants are live, and nobody can produce an inventory with owners and risk ratings.
A regulator asking for the record
You are federally regulated in Canada, selling into the EU, or FCA-regulated in the UK, and the question is shifting from policy to proof.
New use cases every month
You need each new AI use case and material change assessed and approved before release, by someone accountable.
What you would be buying
Named governance leadership for the AI you run, with an inventory, a risk baseline and evidence mapped clause by clause to ISO/IEC 42001, the EU AI Act and the NIST AI RMF.
What you receive
- AI system inventory with named owners
- Risk baseline against ISO/IEC 27001 and 42001, SOC 2 and the OWASP Top 10 for LLM Applications
- Clause-by-clause evidence map, each item rated partial, context or not evidenced
- Gap register and a prioritized 90-day roadmap
- A named governance lead, pre-release review and a quarterly risk committee report, on the retainer
- A signed quarterly Assurance Pack of AI outputs checked claim by claim, at the top tier
What you provide
- Your list of AI systems in use and in build, however incomplete
- Existing security policies and control framework
- Access to system and risk owners
- The questionnaires or regulatory obligations you need to answer
How success is measured
- Coverage of the AI inventory against what is actually in use
- Gaps closed against the 90-day roadmap
- Evidence available when a reviewer asks for it
We map evidence; we do not certify. ISO/IEC 42001 certification comes from an accredited body, and EU AI Act classification and role stay your decisions.
What can hold it up
- Owners for each AI system who can answer for it
- A risk owner who can accept a residual risk on the organization's behalf
After it goes live
Each tier stands alone. The baseline is yours to keep; the retainer and Assurance Pack run under a separate agreement.
Deliverables and measures describe the standard shape of this engagement. Exact scope, duration and commercial terms are agreed and confirmed in writing before work starts.
How we do the work
AI system inventory
Every AI system in use and in build, with a named owner, kept current as new use cases arrive.
Risk baseline
Against ISO/IEC 27001 and 42001, SOC 2 and the OWASP Top 10 for LLM Applications, refreshed every year.
Clause-by-clause evidence map
Your evidence mapped to ISO/IEC 42001, the EU AI Act and the NIST AI RMF, each item rated partial, context or not evidenced.
Gap register and 90-day roadmap
What to fix first, in order, tracked monthly once the retainer is running.
Named governance lead
A vCISO for AI who runs the controls with you: pre-release review of new use cases and changes, policy and escalation routes, incident support and a quarterly report to your risk committee.
Signed quarterly Assurance Pack
AI outputs certified against their sources, claim by claim, with your reviewers' decisions recorded, signed and mapped to ISO/IEC 42001 and the EU AI Act. Delivered with Analect.
Why this matters
Procurement questionnaires already ask about ISO/IEC 42001, and regulators now ask for the record, not the promise: show us what your AI did, and who was accountable.
In Canada, OSFI's Guideline E-23 brings AI and machine learning models into model risk management for federally regulated financial institutions from 1 May 2027. In the EU, the AI Act's high-risk obligations are due to apply from 2 December 2027 for stand-alone systems and 2 August 2028 for AI built into regulated products, and its transparency rules for chatbots, voice agents and generated content sit alongside them. In the UK, the FCA's AI Live Testing shows the governance, monitoring and evaluation evidence it expects.
Mapped, never certified. We give you the evidence; the certificate and the classification stay where they belong.
What we evidence, and what stays yours
ISO/IEC 42001 certification comes from an accredited body, and EU AI Act conformity is assessed system by system. Nobody else can grant either, and we do not.
What we provide is the evidence those reviews ask for: for ISO/IEC 42001, documented information, monitoring and measurement, corrective action, and AI system verification and operation; for the EU AI Act, human oversight, accuracy and its metrics, deployer monitoring, post-market monitoring and transparency design; for the NIST AI RMF, Govern and Map through the baseline, Measure and Manage through the retainer and the Assurance Pack.
Whether a system is high-risk, your role as provider or deployer, your risk appetite, and your accountable executives stay your call. The highest rating we ever print is partial, because a check on controls and outputs cannot show a whole management system or a whole conformity assessment, and we say so on the page.
Three tiers. Each one stands alone.
Start with the baseline, add a named lead when you need the controls run, and add the Assurance Pack when you need the outputs evidenced. Scope and terms are agreed in writing before work starts.
Three to four weeks, fixed scope. Where you stand today, and what to fix first.
- AI system inventory with named owners
- Risk baseline against ISO/IEC 27001 and 42001, SOC 2 and OWASP
- Clause-by-clause evidence map with ratings
- Gap register and a prioritized 90-day roadmap
Monthly. A named governance lead who runs the controls with you.
- Everything in the baseline, kept current
- Named vCISO for AI
- Pre-release review of every new use case and material change
- Policy, oversight and escalation routes maintained
- Incident support and a quarterly risk committee report
Quarterly, per AI system. Governed Operations plus the Analect Accuracy Assurance Pack.
- Everything in Governed Operations
- Up to 30 outputs a month certified against their sources
- Reviewer decisions recorded on every flagged output
- A signed quarterly pack (PDF, JSON and CSV) mapped to ISO/IEC 42001 and the EU AI Act
Evidence at the level of individual outputs
Most governance work stops at policies and controls. The Assurance tier goes further with Analect, ETT's platform for AI cost and accuracy, which checks AI outputs claim by claim against their sources and records every reviewer decision.
The relationship behind each technology (formal partnership, authorised resale, or a platform we deploy) is stated on its technology ecosystem entry.
How governance runs
Inventory
Every AI system in use and in build, with an owner.
Baseline
Risk assessed against the standards your buyers and regulators use.
Map
Evidence mapped clause by clause, with an honest rating for each.
Run
A named lead reviews new use cases and changes before release, and keeps the register current.
Assure
Outputs checked claim by claim each month, signed into a quarterly pack your risk committee can use.
Often delivered alongside
Timing, cost, access and ownership
How long does it take?
The baseline takes three to four weeks. Governed Operations runs monthly, and the Assurance Pack runs a quarter at a time for each AI system.
How is it priced?
The baseline is a fixed fee, the retainer is monthly and the Assurance Pack is quarterly per AI system, all agreed in writing before work starts. We do not publish prices, because scope depends on how many AI systems are in use and what you need to evidence.
What access do you need?
Your list of AI systems, however incomplete, your existing policies and control framework, time with system and risk owners, and any questionnaire or regulatory request you are answering.
Do you certify us, or guarantee compliance?
No. We map evidence to the clauses, rate it honestly and say what stays yours. Certification comes from an accredited body, and EU AI Act classification and role are your decisions.
What happens next?
A conversation about the specific process or decision you have in mind. If there is a workable opportunity we will describe a scoped first engagement; if there is not, we will say so and explain why. Requesting a session does not commit you to anything.
About this service
Can ETT certify us to ISO/IEC 42001?
No. Certification comes from an accredited certification body. We produce the evidence an auditor asks for, mapped to the relevant clauses and rated honestly, so the certification audit has something to test.
Does this make us EU AI Act compliant?
Not on its own. Conformity is assessed per system, and your classification and role as provider or deployer are your decisions. We evidence the areas we can (human oversight, accuracy, monitoring and transparency design) and say what stays with you.
How does this help with OSFI Guideline E-23?
E-23 asks federally regulated financial institutions to keep an inventory of models, rate their risk and monitor them across their life. The baseline creates the inventory and risk ratings for your AI systems, and the retainer keeps them current with a quarterly report to your risk committee.
What is the difference between this and vCISO for AI?
vCISO for AI is the named leadership role. AI Governance and Assurance is the full service around it: the baseline, the evidence map, the retainer and, at the top tier, claim-by-claim assurance of AI outputs.
Could you hand an auditor the record of what your AI did last quarter?
Bring your list of AI systems, or the questionnaire you have just been sent. We will tell you where you stand and what to fix first.
Around four minutes. Indicative guidance based on your answers.