A policy states what should happen. Evidence shows what did. We design governance so the record is a by-product of the work rather than a project undertaken after somebody asks for it.
Governance frameworks are usually adopted whole and then quietly abandoned. These three questions decide whether yours will survive contact with delivery.
Anything reconstructed later is weaker evidence and more expensive to produce. The design question is what can be captured as a by-product.
A gate with no named person who can refuse is not a gate. Naming that person is frequently the most contested part of the engagement.
Most organisations are mapped against a framework somebody once chose rather than against the obligations that actually reach them.
A policy is not evidence that a decision was governed. Choose an obligation to see what a review actually asks for.
Six artefacts. Every obligation on this list draws on the same six, which is why preparing for one of them prepares you for most of the others.
Governance that produces no artefact is indistinguishable from no governance at all, from the outside. The whole design problem is making the record a by-product of the work rather than a project after it.
Four stages, every engagement. Hover a stage to see what happens in it.
Three moves. Two of them are ours, and the one in the middle deliberately is not.
We evaluate the system against what it was claimed to do and against the obligations that apply to you, and we record what the test showed — including where the answer was that no record exists.
Remediation is performed by whoever built or runs the system. We do not take the build work, because taking it would mean the next evaluation is us examining our own hands.
The system is re-examined against the same tests on a schedule, because an evaluation is a statement about a configuration on a date, and configurations move.
Three engagements inside this pillar. Start with the question you can name, or take the whole estate at once.
Governance that produces evidence, not a document describing an intention.
Testing a model or a system against what it was claimed to do.
The record, assembled before somebody asks for it rather than after.
Thirty minutes. Pick a system already in production and try to establish who approved it and on what basis.
Book a 30-minute scoping callORVIX · INDEPENDENT AI & TECHNOLOGY ASSURANCE · WE DISCLOSE EVERY COMMERCIAL RELATIONSHIP ON THE PAGE FOR THE SERVICE IT BELONGS TO. WHERE LICENSING IS REQUIRED, DELIVERY IS PERFORMED BY NAMED PARTNERS UNDER THEIR OWN LICENCE.