Leaders and boards
You need a clear view of AI use, the opportunities worth pursuing, the risks that need attention and the decisions that belong with leadership.
AI governance
Clear decisions.
Responsible use.
Know where AI is being used, who is responsible and what needs review. We help leaders and teams put practical governance around AI, with a scope that fits the business.
What AI governance means
A way to make
and review decisions.
AI governance brings together the people, responsibilities, policies and checks around how an organisation develops, buys or uses AI.
We start with what is happening in your business: the tools in use, the information going into them, the decisions they influence and the people affected. From there, we agree what needs attention and how to put it into practice.
Who it helps
For the people making AI decisions.
Teams already using AI
People are trying tools and finding useful applications. You want shared guidance on acceptable use, information handling, review and escalation.
Organisations taking the next step
You are moving beyond individual experiments, introducing a new system or considering a more formal approach to AI management.
What the work can cover
The practical pieces
of AI governance.
We agree the relevant areas before work starts. The scope may focus on one use case, a team or an organisation-wide view.
AI use and ownership
Identify the tools and use cases in scope, why they are used, who owns them and which decisions they support. Include externally supplied systems as well as internal builds.
Risk and impact review
Consider what could go wrong, who could be affected and how serious the consequences could be. Use that context to prioritise checks, limits and escalation.
Data use and access
Clarify what information may be entered, which sources are appropriate and who may access the system. Identify questions that need specialist privacy, security or legal advice.
Human review
Decide which outputs need checking, who can approve a use case and when a person should take over. Make those responsibilities part of the workflow.
Policies people can use
Develop practical guidance for everyday decisions, including approved uses, information handling and reporting concerns. Connect it to existing business policies and controls.
Monitoring and response
Agree what to monitor, when to revisit decisions and how to respond to errors, incidents or material changes. Give someone responsibility for following up.
Scoped deliverables
Useful records.
Clear responsibilities.
Deliverables depend on the agreed scope, available information and the people involved. This is a starting point for discussion, not a fixed package.
An AI register
A working record of use cases, systems, owners, review status and relevant dependencies.
A practical AI-use policy
Clear guidance on permitted uses, information handling, human checks and escalation.
A responsibility and decision map
Who owns the work, who approves a use case and which decisions need leadership involvement.
A risk and impact review
A documented view of the issues that need attention and the controls or further advice to consider.
A prioritised action plan
Recommended next steps, owners and review points, with gaps and assumptions made visible.
The AI council
A place to make
the important decisions.
An AI council brings the relevant people together to decide which uses to explore, what checks are needed and when to pause or escalate. Its decision rights should be written down, with a clear route back to leadership.
The structure should be proportionate. In a small business, existing role holders may cover the responsibilities through a short, regular meeting. A larger organisation may need input from leadership, operations, technology, risk and people teams.
We can help define the purpose, membership, responsibilities and review rhythm, rather than adding a committee without a clear job.
01
What is the job?
02
Who can approve it?
03
How will we check it?
04
When do we stop or escalate?
A book by Sarah-Jane Kavanagh
The AI Council
Playbook
A practical leadership approach to bringing scattered AI use into a shared system of decisions, responsibilities and review.
Written for boards and leadership teams, including associations, peak bodies, not-for-profits and small to mid-sized organisations, the playbook explores how to establish a small AI council with written decision rights.
- Define the council’s purpose, roles and meeting rhythm.
- Run bounded pilots and review evidence before expanding a use.
- Maintain approved-use records and practical staff guidance.
- Report decisions, progress and concerns to leadership.
The book uses a 90-day planning and review framework. Engagement scope and timing are agreed separately.
ISO/IEC 42001
A framework for
AI management.
ISO/IEC 42001:2023 sets requirements and guidance for an organisation’s AI management system. It provides a reference for the policies, responsibilities and processes around developing, providing or using AI.
If the standard is relevant to your goals, we can agree a readiness scope: understand current practices, identify gaps and prioritise the work needed. The work needs to reflect the organisation, the AI uses in scope and the evidence available.
Advisory and readiness support is separate from independent certification. An external certification body assesses the organisation’s management system where certification is pursued. This service does not provide certification or a guarantee of legal compliance.
Relevant training
Informed by implementation training.
Sarah-Jane Kavanagh has completed ISO/IEC 42001 Lead Implementer training through PECB. This informs her approach to AI management systems and practical implementation.
This is completed training, not a claim of PECB professional certification.
Meet Sarah-Jane and view her qualificationsGood questions
Questions about getting started.
Have something more specific in mind? Let’s talk about your business.
Do we need an AI council to start?
Not necessarily. The starting point is clear ownership and a way to make and review decisions. We can discuss whether an AI council, an existing leadership group or a lighter arrangement fits your business.
Do we have to pursue ISO/IEC 42001 certification?
No. We can start with your practical governance needs and agree whether the standard is a useful reference. If certification is a goal, readiness support and independent certification assessment are separate activities.
Can you review the AI tools we already use?
Existing use is a useful starting point. We agree which tools, workflows, people and information are in scope, then identify gaps, dependencies and questions that need specialist review. This is not a blanket certification of the tools.
Does an AI-use policy make us compliant?
A policy is one part of governance. It needs to be supported by responsibilities, working practices, controls and review. Applicable legal and regulatory obligations need appropriate specialist advice; a policy or training course does not guarantee compliance.
Let’s find your starting point
Put a clear structure
around your AI use.
Bring a list of tools, a question from your board or a policy that needs attention. We can discuss a practical scope and a sensible next step.
Book a free 60-minute session