Proportionate
A low-risk internal drafting assistant and a model making credit decisions do not warrant the same controls. Classification comes first, and it is done explicitly rather than assumed.
AI Governance & Compliance
Governance is not the brake on AI. It is what makes AI deployable.
A governance framework that arrives after deployment costs more, works worse and breeds the workaround behaviour that defeats it. Designed in from the start, it is an accelerant.
What is Cyberwisdom's AI governance and compliance capability?
Cyberwisdom Group delivers enterprise AI governance as a designed layer rather than a policy document, using <b>ComplyAI</b>, the group's enterprise AI management system (AIMS) compliance platform aligned to <b>ISO 42001</b>. The capability covers risk classification of AI use cases before deployment, matching proportionate controls to that classification, explicit human accountability at the point of consequence, traceability of every agent run, and continuous evaluation against a defined baseline. It is delivered together with the group's organisational transformation practice, so governance reflects how the work is actually performed rather than how the policy describes it.
The principle
Proportionate, evidenced, owned.
Governance that is uniform across every use case is either too heavy to be useful or too light to be defensible. The control set has to follow the risk.
Evidenced
The test of a control is whether you can show it was operating. Every control needs a record: what ran, who approved it, what changed, and when.
Owned
Every AI system in production has a named business owner accountable for its use, a named technical owner accountable for its operation, and a documented escalation path between them.
The control stack
Five layers, applied per use case.
01
Policy & accountability
Acceptable-use rules, decision rights, and the specific people accountable for each AI system's use and operation.
02
Risk classification
Each use case tiered before it goes live — determining which controls apply, and what evidence is required to operate it.
03
Controls & checkpoints
Human-in-the-loop approvals at consequential steps, policy checks at execution time, and hard boundaries on what the system may do alone.
04
Evidence & audit trail
Agent runs, inputs, context sources, tool calls, model versions and approvals recorded as a matter of design, not retrofitted for the audit.
05
Continuous evaluation
Accuracy, drift and cost monitored against baseline with thresholds that trigger review or rollback, not just dashboards that nobody reads.
Who it is for
Regulated environments first.
Cyberwisdom's governance practice comes from sectors where evidence has always been non-negotiable — banking, insurance and professional regulation.
Regulated financial services
AI governance aligned to existing operational risk, model risk and compliance frameworks rather than a parallel universe of process.
Enterprise AI in the EU and beyond
EU AI Act-oriented risk classification and control design, alongside enterprise AI management system expectations aligned to ISO 42001.
Professional and regulated bodies
Systems that inform regulated professional decisions carry the highest accountability requirements — designed for that from the start.
Internal governance maturity
For organisations already running AI in production, governance typically means closing the gap between what policy says and what the system actually does.
Common failures
Four ways governance programmes break.
What we find, and what we do about it
Most governance gaps are not malicious. They are structural — a control was written for a system that no longer exists, or evidence is produced but cannot be produced again.
- <b>The shadow estate.</b> AI tools in use that were never registered, because registration depended on a process designed before AI was common.
- <b>Policy without practice.</b> Controls written for an idealised workflow, while the actual workflow has been reconfigured by whoever built the pilot.
- <b>Evidence that cannot be reproduced.</b> Logs retained inconsistently, with no lineage from an output back to the context and version that produced it.
- <b>Accountability without authority.</b> Ownership assigned without the budget or the right to change the system, so nothing actually improves.
Working with ComplyAI
The group’s own governance platform.
Cyberwisdom holds itself to the standard it recommends, and builds the controls into tooling rather than spreadsheets.
- ComplyAI — the group's enterprise AI management system (AIMS) compliance platform, aligned to ISO 42001, used to manage the control set, its evidence and its exceptions
- Policy as configuration — acceptable-use rules, tiering and checkpoint requirements expressed so they can be enforced at runtime rather than only described
- Evidence as a by-product — run records produced automatically during operation, because reconstructing them later is both expensive and unreliable
- Exception management — a named, time-bounded, approved route for operating outside policy, rather than silent drift
- Readiness assessment — a structured view of which AI systems are actually deployable under your control environment today