AI you can explain and account for — and a return you can show.

Where could the AI deviate — either way?

Risk runs in both directions. ISO 31000 defines risk as the effect of uncertainty on objectives, and says risk management exists to create and protect value. ISO/IEC 42001 uses the harmonised form of that definition and keeps the note that matters most: an effect is a deviation from the expected, positive or negative. We follow the ISO 31000 process across the seven domains where AI creates exposure. And we start from an inventory, because nothing downstream is reliable without one.

• 01

  Start from an inventory

  Every use case and every AI system in one place, proposed as well as running. A company may have Copilot, AI features in SuccessFactors, a customer-service model, engineers using ChatGPT and an agent inside a development platform. That's five AI systems with five different owners, now in one view. ISO/IEC 42001's Annex A asks for the resources behind each AI system to be identified and documented (A.4.2). NIST AI RMF asks for the inventory outright (GOVERN 1.6). The inventory doesn't stand alone: each AI system is tied to the business process it serves, its owner, its objectives and the information it depends on.

• 02

  Set the scope and the criteria

  Which systems and processes are in scope, and whether each one makes you a provider or a deployer. Then what the organization has agreed it will tolerate. The board approves that, so it isn't left to whoever bought the licence.

• 03

  Assess, then decide what changes

  We identify, analyse and evaluate against those criteria. That includes classification under the EU AI Act and assessment against NIST AI RMF and ISO/IEC 42001. Then comes treatment: design controls, accept the exposure, or stop the activity. That's the point where an assessment turns into a decision.

• 04

  Watch it, don't discover it

  Indicators measured against the thresholds set earlier, so movement shows up before an auditor, a regulator, or an incident does.

Does the AI earn what it costs?

Keeping models reliable is only half the job. The other half is finding where AI could deliver more, and weighing that against what it exposes you to. Then investment can follow evidence instead of enthusiasm. We use the same inventory the risk work builds, and read it as an AI portfolio, for return.

• 01

  Value defined before the commitment

  Start with the financial outcome: revenue, cost, cycle time or margin. Name it before you buy, enable or build. Otherwise it gets reverse-engineered afterwards from whatever happened to be measured.

• 02

  A gate every use case passes

  Before anything goes live, we assess expected value, feasibility, risk and data readiness. That applies to a bought licence or a switched-on feature as much as to something you build. Stopping a weak proposal early counts as a success.

• 03

  Risk and return on one ledger

  Every system carries both risk and return, and they reach a decision by different routes: different people, at different times, on different scales. We put them on the same ledger. Expected return is discounted for uncertainty, less the potential cost of failure and the cost of controls. That makes it easier to see where to invest, and where the risk no longer justifies the return.

• 04

  Reliability that protects the value

  Models drift, hallucinate, and degrade under context load. Evaluation, monitoring, and traceability keep the return you built the case on from eroding after go-live.

Do the controls actually work?

Governance and a management system are two different things. The governing body sets direction: what AI is for, how much judgement it will delegate, and what it will tolerate. The management system delivers against that. Most of the effort goes into the management system, but it only holds together when the direction is clear. Responsible AI is a requirement, not a posture. Fairness, privacy, safety, transparency and human oversight become real when they're written as requirements a system has to meet and controls somebody has to operate.

• 01

  Direction, before delivery

  What the organization will use AI for and what it won't, how much opacity is acceptable when an outcome affects a person, and what it will spend for what return. ISO/IEC 38507 places these questions with the governing body. No management system can answer them on its behalf.

• 02

  Accountability that names people

  Roles, responsibilities and authorities are allocated under ISO/IEC 42001 clause 5.3, and extended to suppliers and third parties. Human oversight goes to someone with the competence and the authority to intervene. Without that authority, oversight isn't a control.

• 03

  Controls, and where they are enforced

  EU AI Act Articles 9 to 15 state what a high-risk system must achieve. ISO/IEC 42001 Annex A supplies thirty-eight reference controls to compare against. The Statement of Applicability justifies every inclusion and exclusion. Then comes the architectural question: where in your system landscape is each control actually enforced, and not just written into a policy?

• 04

  Evidence that they still work

  A control that's designed well but never tested is an assumption. Assurance and control indicators show whether it still works, and an ISO/IEC 42001 management system makes the whole thing auditable and connects it to your existing risk function. If you already run an ISMS or QMS — which already cover the business processes and information where your value lives — we determine what can be shared, what needs extending, and what genuinely needs to remain AI-specific.

Literacy for everyone, competence by role

Everyone who works with AI needs a basic level of competence. A few roles need much more than that. In the EU, the AI Act obliges providers and deployers to support the development of AI literacy among the people who operate their systems. Elsewhere, customers, insurers and auditors ask about the same thing. Either way, the work follows one order: first the capabilities an organization needs, then the roles that carry them, and only then the training that builds each role.