AI governance and evaluation that turns AI risk into tested, documented controls.

Cost depends on how many AI systems are in scope, how much risk they carry, how many frameworks you map to and how deep the red-teaming goes. A single customer-facing assistant takes far less work than a portfolio of agents that change records. The first assessment is usually a fixed price, with optional scheduled reviews after it. You'll get a written scope after a free call.

Managed AI agents is the day-to-day operation of live agents: monitoring runs, fixing failures and shipping tested updates. AI governance and evaluation sets the bar those agents must meet and produces the evidence, meaning test sets, red-team results, guardrails, policies and the risk register. Many clients use both, with governance defining the tests and thresholds and the managed service running them every week.

Certification comes from an independent, accredited certification body, and our role is to get you ready for it. We prepare the controls, policies, risk register and evidence an ISO/IEC 42001 audit looks for. For the EU AI Act, we build the technical documentation and testing records, while your legal counsel confirms how the Act applies to each system.

AI red-teaming is structured adversarial testing that tries to make an AI system fail, for example by injecting instructions, extracting private data, bypassing its rules or triggering unsafe actions. We run it only under written authorization and an agreed scope, combining manual testing with tools such as garak, PyRIT and Promptfoo. Every finding comes with a severity, evidence and a fix to re-test.

An LLM evaluation set is a collection of real inputs with agreed good answers or behaviors, used to score an AI system the same way every time. We build ours with your subject experts, covering normal cases, edge cases and cases where the system should refuse or hand off. It turns "it seems fine" into a score you can track after every change.

Well-tuned guardrails add little delay and let normal requests through. We measure both sides on test traffic: how much harmful or off-policy input they catch, and how many legitimate requests they stop by mistake. Then we tune the thresholds until the balance fits each system's risk.

We map controls to the NIST AI Risk Management Framework, ISO/IEC 42001 and the EU AI Act, and test against the OWASP Top 10 for LLM Applications and MITRE ATLAS. You choose the frameworks that matter to your customers and regulators, and we keep one control set mapped to all of them, so each control is done once.

Yes, the inventory and risk register cover vendor tools too, such as Microsoft 365 Copilot or AI features inside your CRM. For bought tools, we review the vendor's documentation, data terms and settings, and test behavior where the vendor's terms and your written authorization allow it.

A list of the AI systems you know about, access to the ones in scope, and subject experts who can agree what good answers look like. We also need a sponsor, often from risk, security or legal, who signs the written authorization for red-teaming and owns the register after handover.