Responsible AI · AI risk · Compliance
Put clear oversight around how your organization uses AI.
We put responsible AI into practice: AI inventories, risk tiers, policies, oversight workflows with named owners, and monitoring, built on the data governance and AI/ML enablement work we already deliver.
Where this fits
One of our four core areas, built on the data governance and AI/ML enablement we deliver.
Pillar 01
Data & Analytics
- Data governance and data management
- Regulatory compliance, data quality and security
Pillar 02
Engineering & Technology
- AI/ML enablement
The challenge
AI adoption is moving faster than the controls around it.
AI now reaches your organization in several ways: features added to tools your teams already use, services bought from vendors, models built in-house, and increasingly agents that can take actions in other systems. In many organizations, no one can say which of these are in use, what data they touch or who is accountable when an output is wrong.
Banning AI pushes its use out of sight. Adopting it without review creates privacy, security and reputational exposure. What works is a proportionate system, put in place and kept running: a light touch for low-risk uses, and closer review for anything that affects customers, employees or regulated processes.
Who this is for
CIOs and CTOs
A clear view of AI use across the technology estate.
Chief data and analytics officers
Rules for the data that trains, grounds and feeds AI.
Risk, compliance and legal teams
Documented controls and records that show oversight is working.
Business and product leaders
A predictable route to approval for useful AI initiatives.
What we deliver
Services and capabilities
Combine the capabilities below to fit your situation, from a first assessment to a review process that runs inside your existing tools. Each one builds on the data governance, data quality and security, and AI/ML enablement work we already deliver.
Readiness and governance assessment
The first stage of delivery. We review your current AI use, policies, roles and controls against your goals and obligations, and turn the gaps into a prioritized plan we implement with you.
- Stakeholder interviews and policy review
- Maturity view across strategy, risk, data and operations
- Gap analysis that maps your controls to the frameworks you choose, such as the NIST AI RMF or ISO/IEC 42001
AI inventory
You can't govern AI you can't see. We build one register of the AI tools, embedded vendor features, in-house models and agents in use.
- Discovery across business units, IT and procurement
- Purpose, owner, data, users and risk tier recorded for each use
- A simple routine your team can follow to keep the register current
AI risk tiering
Without a shared way to rate risk, every review starts from scratch. We define risk tiers by impact and assess each use against them, so review effort goes where it matters.
- Risk tiers based on impact on people, data sensitivity and degree of autonomy
- Assessment templates for new and existing uses
- Prioritized remediation backlog
Policies and accountability
Unwritten rules get applied unevenly. We write policies and decision rights that people can follow in their day-to-day work.
- Acceptable-use policy for AI tools
- Decision rights for proposing, approving and monitoring AI uses
- Terms of reference for a governance forum
Oversight workflows
Ad hoc approvals become a defined route. We set up intake and approval in your existing tools, with human checkpoints matched to the level of risk.
- Intake and approval workflow
- Human review points for higher-risk outputs and decisions
- Limits and sign-off rules for AI agents that act in other systems
- Escalation and exception handling
Data handling for AI
Unclear data rules let confidential information reach AI tools. We define what data AI may use, building on your existing data governance rather than beside it.
- Guidance for confidential and personal data in prompts, grounding and training
- Approved data sources, with lineage expectations
- Alignment with consent, retention and access policies
- Records and documents that ground AI, governed through our Information Governance & Records practice
- Built on the governance, quality and security controls from our Data & Analytics practice
Third-party AI evaluation
AI features arrive in platforms you already run, sometimes switched on by default. We review the AI you buy and the AI features in your current platforms before people rely on them.
- Vendor due-diligence questionnaire
- Contract, data-use and configuration checkpoints
- Review of AI features in current platforms, including Adobe Experience Cloud applications
Monitoring and compliance records
Oversight can't stop at approval. We set up the monitoring, documentation, incident reporting and reassessment routines that keep it running and show it is working.
- Documentation templates for each use case and model
- Monitoring routines for quality, drift and incidents, each with an owner
- Incident reporting route and reassessment schedule
- Records of reviews and decisions, organized to support audit and regulatory requests
- Applied to the models and AI features we build through our Engineering & Technology practice
Responsible adoption and training
Rules alone don't change how people work. We train your teams to use AI well, with guidance written for each role.
- Role-based guidance and training material
- Everyday dos and don'ts for common AI tools
- Communication plan for the governance program
From vision to victory
Three stages, one accountable team
Each stage ends with something tangible you can review, use and build on. What you keep is listed under What you receive, further down this page.
- 01
Understand & strategize
Interview stakeholders, review your AI, data and privacy policies, and build a first inventory of AI use, rated by risk.
- 02
Implement & integrate
Put risk tiers, policies, decision rights and an intake and review workflow in place, built on your data governance and your existing tools. Pilot on real use cases and train the reviewers.
- 03
Optimize & grow
Run monitoring, documentation and reassessment routines, and adjust controls as your AI use and the rules around it change.
Deliverables
What you receive
Practical outputs your teams can use, run and maintain.
Governance assessment
Findings, a maturity view and prioritized gaps that set the order of implementation.
AI register
Every known AI use with its purpose, owner, data sources and risk tier, in a format your team can maintain.
Responsibility model
Who proposes, reviews, approves and monitors each AI use, and who is accountable for it.
Policy set
An acceptable-use policy, an AI risk standard and requirements for third‑party AI.
Review workflow
Intake form, risk-tiering questions, review checkpoints and escalation paths, piloted on real use cases.
Governance roadmap
The next steps, in order, that turn initial controls into a lasting program.
Practical applications
How this work applies in practice
These are illustrative scenarios that show typical situations and approaches. They are not descriptions of specific client projects.
FAQ
Frequently asked questions
Do we need AI governance if we only use off-the-shelf AI tools?
Usually, yes. AI built into vendor tools still processes your data and can shape decisions. Governing it is lighter work than governing models you build: an inventory, clear usage rules, and a vendor and configuration review. It still needs an owner.
Which frameworks and regulations do you work with?
We help you align your controls with recognized references such as the NIST AI Risk Management Framework and ISO/IEC 42001, and organize the records the EU AI Act may require. The Act applies in phases and its application timetable has changed since it was adopted, so we confirm current obligations with your legal advisers instead of quoting dates. We don't give legal advice or issue certifications. ISO/IEC 42001 certification comes from an accredited certification body.
Will governance slow down our AI projects?
It shouldn't. The aim is a predictable route to approval. Low-risk uses move quickly under standard controls, and review effort goes to the uses with the most impact.
Can you help us govern the AI features in our Adobe applications?
Yes. Adobe Experience Cloud applications can now include AI Assistant, Adobe Experience Platform agents and generative AI features, depending on your licenses. We review each feature with you: whether to enable it, what customer data it may use under your consent and data usage policies, and who owns it. Because we also implement Adobe applications, we can check configuration as well as policy.
How does AI governance relate to your data and AI/ML work?
AI governance is one of our four core areas, alongside Information Governance, Data Governance and MarTech, and it draws on both. AI is only as reliable as the data it uses, so we build AI oversight on your existing data ownership, quality, consent and retention rules instead of creating a separate structure. If those foundations are missing, our Data & Analytics practice can put them in place. When we build or integrate AI through our AI/ML enablement work, the same risk tiers, owners and monitoring apply.
Who needs to be involved from our side?
An executive sponsor, plus people from IT and security, data, privacy, legal or compliance, and the business teams that use AI most. We keep their time focused on decisions, reviews and pilot use cases.
Where do we start, and how long does it take?
You can start with an assessment and a first inventory, because both show where controls are needed most. Then we implement the priorities with you: risk tiers, policies, the review workflow and training. Timing depends on your size and how much AI is already in use. We agree the scope and timeline with you after a first conversation about your goals.
Connected expertise
Explore related services
- Information Governance & RecordsRecords lifecycle, retention and privacy compliance support, with MapleRecord and MOLI
- Data & AnalyticsData strategy, governance, modern data architecture, data science and visualization
- MarTech & Adobe Experience CloudCustomer data, content, personalization, analytics, marketing automation and commerce on Adobe
- Engineering & TechnologyCloud on AWS and Azure, DevOps, AI/ML enablement, mobile, QA and custom software
- Experience DesignUser research, service design, design thinking, content and CX optimization
- Digital & ProductDigital strategy, product vision, product development, go-to-market and agile delivery
- Business Transformation & CRMProcess optimization, change enablement, program management and Microsoft Dynamics 365
- All servicesCore expertise and all seven practice pillars, in one place.
Start a conversation
Start with a clear picture of your AI use.
Tell us where AI is showing up in your organization and what you need to be confident about. We'll scope a practical first step with you, from a first inventory to a working review process.