AI Governance & Risk
We give leadership a current record of where AI is used, what data it touches and who approved it, with controls sized to the consequence of each use.
Questions we help answer
- Where is AI already used in our business, including tools staff signed up for themselves?
- What data do our AI vendors receive, where is it processed, and can it be used for training?
- Which uses need a person to approve the output before it reaches a customer?
- What evidence could we show a customer, auditor or regulator about how a feature was tested?
- Which of our AI uses should our lawyers review against the EU AI Act or sector rules?
What we do
AI use register
Every AI tool and feature in use, including browser extensions and personal accounts used for work, with owner, purpose, data touched and status.
Acceptable-use policy and staff guidance
Plain rules on approved tools, data that must never be entered, review of outputs and how to report a problem, written for the people who use the tools.
Vendor and data review
Each vendor's terms on retention, training, processing location and sub-processors summarised, with inputs prepared for your data protection lead and legal adviser.
Risk tiers and controls
Uses grouped by consequence, with the approval, logging, access and testing each tier requires written into the tools themselves.
Evaluation and incident records
Release test results, incidents, fixes and decisions kept in one place, ready for a customer questionnaire or an audit.
- How an engagement with THEFOCUS startsDiscuss this with us
How we approach it
- 01
Find what is in use
We read licence lists, expense claims, browser extension inventories and staff surveys, because the register is only useful if it is complete.
- 02
Tier by consequence
Controls follow what goes wrong if the output is wrong, so a drafting aid and a customer-facing agent carry different requirements.
- 03
Build the controls into the tools
Approval steps, logging and access limits are configured in the systems, where they operate without relying on memory.
- 04
Review on change
The register and tiers are revisited when a vendor changes its terms, a model is replaced or a new use goes live.
Client results
View allRelevant industries
How an engagement with THEFOCUS starts
A first conversation is about your situation. If there is a fit, we propose a scoped diagnostic with a fixed deliverable before any larger commitment.
Discuss this with us01
A working conversation
Forty-five minutes with the person who would lead the work. We ask about the decision, the systems behind it and the deadline.
02
A scoped diagnostic
Read-only access, a fixed timeframe and a written finding: what the records show, what it costs and what to change first.
03
A plan you can act on
Changes, owners, measures and exclusions in writing. The same team then builds and measures, or hands over cleanly.
- One accountable team
- The people who diagnose also build the systems and measure the result.
- Partners chosen per problem
- Independent specialists join for the parts that need them, under one contract.
- Records before dashboards
- Orders, ledgers and logs are reconciled before any recommendation depends on them.
Questions executives ask
Is this legal or regulatory advice?
No. We build the register, policies, controls and evidence your organisation needs to govern AI in practice. Interpretation of the EU AI Act, data protection law or sector regulation stays with your legal advisers, and we prepare the material they need to review.
We are a mid-sized business. Is this proportionate?
The controls are sized to your uses. A business with a few drafting tools needs a register, a short policy and vendor checks. Heavier controls apply only where an AI feature acts for customers or touches sensitive data.
Discuss this with us
A few details help us route your enquiry to the right partner. Fields marked optional can be left blank.