For CIOs, CTOs and leadership
AI governance in your company, checked tool by tool AI governance: your tools and agents, inventoried and reviewed
AI governance is the set of rules and checks a company uses to know which AI tools it has, what data they touch, what they can do on their own and who answers for each one. It works when what is written down is checked at regular intervals against what those tools really do.
Updated on
We build the inventory of the AI tools and agents your company has already built and review each one: what data it touches, what it can do on its own and who maintains it.
What shows up in AI tools that go unreviewed
Data that ends up where it shouldn't
An agent with access to documents, email or databases can show a user what they should not see, or send it to an external service.
Orders hidden in a text
A text hidden in a document or on a web page can change what your agent does. It is called prompt injection, and we test for it by hand.
Too many permissions
Tools connected with administrator access, with no usage or spending limits and no log of what they did.
Nobody looks after production
The model changes, the data changes and usage grows. Without a periodic review, what used to work degrades without anyone seeing it.
What we check in each tool and agent
- What data it can read and return, and to whom
- Resistance to prompt injection, tested by hand
- Permissions, access, and usage and spending limits
- The decision log and human oversight
- Who built it and who maintains it today
This is a technical review: it does not replace legal advice or issue certificates. The EU AI Act's rules for high-risk systems apply from December 2, 2027.
The reviews that cover it
Each one has its own page: what we review, why it matters and what you get.
Backend and API review
The server side behind your app or your website: what the API exposes, what it protects, what headers it serves and what ends up in its logs.
More than 150 control points- Exposed fields and unprotected routes (OWASP API3 and API5)
- Route inventory and endpoint contract
- Security headers and personal data in logs
Mobile app review
Flutter apps built with AI, tested on real iOS and Android phones by command and with touch gestures, together with their backend.
More than 275 control points- Real iOS and Android devices
- Every flow tested by command and with touch gestures
- Secrets, permissions and the API behind the app
Public website review
Your website's performance, visibility in search engines and in AI assistants (SEO and GEO), accessibility and security, measured on the real page.
More than 275 control points- Core Web Vitals with PageSpeed before and after
- SEO, structured data and how AI assistants read you
- WCAG 2.2 AA accessibility, contrast and security headers
Database review
PostgreSQL, Redis, Elasticsearch and RabbitMQ, in read-only mode: structure, indexes, slow queries, locks and connections.
More than 200 control points- Tables, indexes and migrations
- Slow queries, locks and connections
- Redis memory, Elasticsearch disk and RabbitMQ queues
What you get, every time
One report for two readers: one page for leadership and the detail with evidence for your team.
The health status
For each system reviewed: code, apps, website, backend, databases, server and platforms.
Every finding checked
With the evidence of where it is and why it matters.
The list ranked by impact
What to fix first, what can wait and what doesn't matter.
A meeting and a page
We walk your team through it, and leadership gets a one-page summary.
Frequently asked questions
What is AI governance?
AI governance is knowing which AI tools your company has, what data they touch, what they can do on their own and who answers for them. And checking it at regular intervals, because the model, the data and the usage change.
Who is responsible for AI in a company?
Whoever leadership names in writing, tool by tool. Without that name, each tool ends up with no owner when the person who built it changes jobs. Our inventory records who built each one, who maintains it and which have nobody.
When does the EU AI Act take effect?
It applies in phases. For high-risk systems, the rules apply from December 2, 2027 (Annex III systems) and from August 2, 2028 (Annex I systems). What applies in your case is for your legal counsel to decide.
What is ISO 42001 and what is it used for?
ISO 42001 is an international standard for artificial intelligence management systems. Our review does not attest compliance with that standard or any other: it tells you what state your AI tools are in, which is a starting point for any later work.
What is an AI audit?
It is a review of a company's AI tools and agents: what data they touch, what they can do on their own and whether they hold up. Ours is a technical, periodic health check of what your company has built, designed to be repeated every three months.
Does it replace a lawyer?
No. The review is technical: it tells you what state your AI tools are in, with evidence. What the law asks of you in your case is for your legal counsel to decide.
Request your free meeting
Fill in the form and we email you to set a day and a time. It is 30 minutes to see what you have and what to review first.