AI Governance & Risk
AI Governance That Keeps Pace With How Your Business Uses AI
Your teams are already using AI: in chat assistants, in the SaaS tools you license, and in your code. AI governance gives leadership visibility into that use, clear rules for it, and evidence that the risk is managed.
Why AI Governance Can’t Wait
Shadow AI is already here
Employees adopt AI tools faster than policy can keep up. Sensitive data ends up in tools nobody approved, and AI features arrive inside software you already license.
Everyone is asking
Boards, customers, auditors, and insurers increasingly want to know how you govern AI. “We’re looking into it” is no longer a credible answer.
Regulation is arriving
The EU AI Act, new U.S. state AI laws, and sector regulators are setting expectations. The NIST AI RMF and ISO/IEC 42001 give you a defensible structure to meet them.
Where most engagements start
The AI Governance Sprint
Thirty days from “we don’t really know how we’re using AI” to a governance foundation your leadership can stand behind.
Week 1
Discover
Stakeholder interviews and an inventory of AI in use, including shadow AI and AI features inside existing vendors.
Week 2
Assess
Risk-rate each use case and baseline your maturity across the NIST AI RMF functions: Govern, Map, Measure, Manage.
Week 3
Define
Write the AI acceptable-use policy, assign roles and decision rights, and set up an approval process for new AI tools.
Week 4
Deliver
Present a board-ready briefing and a prioritized 12-month roadmap to leadership.
What you walk away with
- →AI use inventory with risk ratings
- →AI acceptable-use policy, ready to publish
- →Governance charter: roles, decision rights, intake process
- →NIST AI RMF maturity baseline
- →Executive and board briefing
- →Prioritized 12-month AI governance roadmap
Beyond the Sprint
Governance isn’t a one-time document. These engagements take the program further.
ISO/IEC 42001 Readiness
Build the AI management system the standard requires and prepare for certification.
Regulatory Applicability
Determine which obligations under the EU AI Act and U.S. state AI laws actually apply to you, and what to do about them.
AI Vendor Risk Reviews
Evaluate AI vendors and AI features in existing software for data handling, security, and contractual risk.
Ongoing AI Oversight
Keep governance current as part of a Fractional CISO engagement.
Start With a Free Self-Assessment
Rate your organization across the four NIST AI RMF functions and get an AI-generated risk roadmap in minutes. No account required.
Launch the AI RMF Assessment →Who Leads the Work
Michael W. Gross built and led Cleveland Clinic’s Cyber Defense Fusion Center and directed a $10M+ annual security budget. He brings that enterprise risk discipline to AI, in language your board understands.
About Michael →AI Governance FAQ
What is AI governance?+
AI governance is the set of policies, roles, and processes an organization uses to decide how AI may be used, track where it is used, and manage the risks it creates. In practice that means knowing what AI tools are in use, having clear rules for them, assigning accountability, and being able to show leadership, customers, and auditors that the risk is managed.
What is the NIST AI Risk Management Framework (AI RMF)?+
The NIST AI RMF is a voluntary framework published by the U.S. National Institute of Standards and Technology in January 2023 to help organizations manage AI risk. It is organized around four functions: Govern, Map, Measure, and Manage.
What is ISO/IEC 42001?+
ISO/IEC 42001 is an international standard, published in December 2023, that specifies requirements for an AI management system. Like ISO 27001 for information security, organizations can be certified against it.
Do we need AI governance if we don’t build our own AI?+
Yes. Most AI risk comes from using AI, not building it: employees adopting chat assistants, sensitive data entering unapproved tools, and AI features arriving inside software you already license. Governance covers how AI is used, not only how it is built.
How long does it take to put AI governance in place?+
The AI Governance Sprint establishes the foundation in 30 days: an AI inventory, an acceptable-use policy, a governance structure, a NIST AI RMF baseline, and a prioritized roadmap. Maturing the program from there is ongoing work that the roadmap sequences.