In control of AI
AI governance in four to six weeks, built so your own people can run it: a model the CEO approves, a blueprint your IT runs, and a register of every AI use.
What it is
- 14 900 €, four to six weeks
- 24 900 €, eight to twelve weeks
- Fixed, agreed up front
- Map it, Run it
Governance has a reputation as the brake. Here it is the opposite. When every case has a known path, the next one gets a yes instead of a long debate. The rules exist so nobody has to ask permission twice.
Five disciplines sit underneath it: the AI register, cost, identity, security and deployment. In each one a business risk becomes a policy statement, then a process that watches it, then tooling that enforces it. We open the two or three your risks point at. The rest wait until there is a real risk to open them for.
We built this for our own product first. Brain, which we build for upper mid-market and enterprise companies, holds customer data, so its governance had to meet an enterprise standard: an isolated deployment per customer inside the EU, data never used to train a model, and a record of who decides what. This module is that model, made ready for you.
The shift
Where AI already is, before anyone decided it should be.
Everywhere, not in pilots
People already use AI tools at work, approved or not.
Inside what you already bought
Vendors switch AI on in CRM, ERP and office software. Nobody registered it.
Regulation has arrived
The EU AI Act and NIS2 put names and duties on it. The question is no longer whether to start, but whether anyone can see what is already running.
Governance is how you say yes faster
- A new use case
- Who decides? A long debate
- Blocked, or used anyway
- A new use case
- Into the register, checked against known rules
- Yes, with an owner
The rules are not there to stop AI. They are there so nobody has to ask permission twice.
Three things you can point at
In control is not a document. It is three things a leadership team can hold.
The governance model
Short, non-technical, and reviewed twice a year. It says who decides what, so nobody has to ask permission twice.
The blueprint
Accounts, identities, logging, budgets and versioning: which data may reach which model, written as something a team can implement.
The AI register and decision log
Every model, agent and vendor feature already in use, each with an owner, a data class and a risk level. It keeps the answer true after we leave.
Four to six weeks, three sessions
We look first and set rules second. If your IT governance already does a thing well, we use it. The weeks follow your decision rhythm, not our effort.
-
Benchmark
Six areas, answered before we meet, with your CIO, security and one business owner.
-
Risk session
Half a day on risks, tolerance and data classes, with the CEO or deputy, CIO, security and finance.
-
Rules by area
Half a day. We present, the room decides, with CIO, IT, security and finance.
-
Executive team readout
One hour. The model is approved by the CEO and the register goes live.
Regulation already asks for most of this
The same three outputs answer to four different readers. This is the compliance and risk case, said plainly, not sold as fear.
A list of AI systems with a risk class and human oversight: the register, with owner and risk level.
Management owns cyber risk, vendors under control, incidents reported: the identity and security rules, vendor terms and CEO sign-off.
Know which personal data reaches which model: data classes per model.
Proof that someone decides, and that it is followed: the decision log, current and exportable.
The model is the policy. The blueprint is the control. The register is the evidence.
Two sizes
Base is the answer itself, at the scope your risks point at. Extended adds the people who run it, and it includes Base.
You need the answer for owners and board
14 900 €
What it covers
- The benchmark, a risk session and the governance model, in three sessions.
- A first blueprint for your IT, and the two or three disciplines your risks point at.
- A running AI register, and an executive team readout that stands as the answer.
You need people who run it
24 900 €
What it covers
- Everything in Base, plus all five disciplines and the complete blueprint.
- An AI office designed and staffed with your people, customer-facing rules, contract clauses and training for the owners.
- Closes with an executive team readout and a 90-day rollout.
Fixed price, agreed before the work starts. Started with Base and want the rest? What you paid for Base is credited in full.
Which one fits
Not sure? We will recommend one, and say so when Base is enough.
Base
- AI use is mostly internal
- One or two units use it
- Your IT governance is already in good shape
- You want to see it work before you scale it
Extended
- AI decides or acts in customer or operational systems
- Several units and several vendors
- Regulation such as NIS2 already applies to you
- You want owners inside the company, not a document
What stays yours
Whatever you decide next, these leave with you.
The governance model, in your own words.
The blueprint, as something your IT can run.
The AI register and the decision log, already filled in.
The owners, named, inside your own company.
The same ladder we used in cloud
For the CIO who grew up with a cloud adoption framework. Same structure, one level each: why, path, control, check. This module is the control level.
Recon: where your business is with AI.
Map it, Fix it, Run it. Packages are modules on it.
This module. A module on the path, bought on its own.
A review of every AI use in the register, repeated.
Where this sits
A ready-made module on the Map it, Fix it, Run it path. It starts in Map it and lives in Run it. You can buy it on its own.
Keep it alive and current, with a named owner against every AI use.
See how the path worksOne path, and it compounds
It starts with one problem worth solving. Bring us yours and we will name the price and the date before you commit to anything.