What AI Governance Consulting Should Deliver
Published . Updated .
AI means artificial intelligence. AI governance consulting helps a company decide which AI systems it runs, who owns each one, which rules apply and what evidence shows the rules work. A useful engagement ends with working controls and records inside the company's systems, not only a policy document.
Why are companies asking for AI governance help now?
Adoption has moved faster than oversight. In IBM's Cost of a Data Breach Report 2025, 63% of breached organisations either had no AI governance policy or were still developing one. Of the organisations with a policy, only 34% performed regular audits for unsanctioned AI. Among organisations that reported a breach of an AI model or application, 97% said they lacked proper AI access controls. IBM, July 2025
The same gap shows up among employees. In a global study of more than 48,000 people in 47 countries, led by the University of Melbourne with KPMG, 58% of employees said they intentionally use AI at work. Only 40% said their workplace has a policy or guidance on generative AI use. KPMG, April 2025
Most companies of 50 to 500 people have no governance office to close that gap, which is why they look for outside help.
Field guide. The Field Guide to AI Governance covers the published foundations, including the four NIST risk management functions, and how to test that controls work. Read the field guide.
What does AI governance consulting cover?
| Area | What it covers |
|---|---|
| Inventory | Every AI tool, model, agent and automation in use, with an owner, the data it uses and the actions it can take |
| Policy | Approved tools, data rules, approval steps and who decides exceptions |
| Risk assessment | Which systems could cause harm, and which rules apply to each one |
| Controls | Permissions, approval gates, logging and monitoring built into the systems |
| Evidence | Records that show the controls ran, ready for an auditor, a customer or the board |
| Review | A schedule for checking systems again as models, vendors and rules change |
Not sure which AI systems your company already runs? Talk to Chiri or see how Chiri Brain handles it.
What should the engagement deliver, step by step?
A planning aid. Stages can overlap; evidence should be produced from the first system onward.
The order matters. Inventory comes first, because a company cannot govern systems it cannot list. That includes tools staff signed up for themselves, which What Is Shadow AI? covers in more detail.
The policy comes second and should stay short: which tools are approved, which data may never go into them, and who to ask.
Controls come third, and this is where many engagements stop too early. A policy that says "a person approves every payment" is only true once the system enforces it and the agent cannot skip the step.
Evidence comes last: records that show each control ran, produced by the systems themselves rather than written up afterwards.
Which frameworks should the work map to?
Two published frameworks give the work a shared structure.
The AI Risk Management Framework from NIST, the US National Institute of Standards and Technology, was released on January 26, 2023. It organises the work into four functions: Govern, Map, Measure and Manage. NIST describes governance as the function that runs through the other three:
"Governance is designed to be a cross-cutting function to inform and be infused throughout the other three functions."
NIST, AI Risk Management Framework 1.0, January 2023
ISO/IEC 42001:2023, published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), specifies requirements for an AI management system. ISO describes it as the world's first AI management system standard. ISO A company can align its controls to it without committing to certification on day one. The mapping should belong to the company, so it can be reused when a customer or auditor asks.
How do you tell advice from working controls?
Advice describes what should happen. Working controls make it happen and leave a record. Four checks separate the two:
- Every system has a named owner. The inventory lists a person, not a department.
- A blocked action is actually blocked. Ask for a test that shows an unapproved action failing.
- Records come from the system. Audit logs are produced automatically, not assembled for the review.
- Someone runs the controls after handover. Either an internal team or a partner operates them, with the cost agreed.
For proposals in general, see Is AI Consulting Worth It?. For the controls that agents need, see What Real AI Agent Governance Looks Like in Practice.
What should you ask an AI governance partner?
- Will the inventory include tools that staff bought or signed up for themselves?
- Which deliverables are documents, and which are controls running in the systems?
- How will a control be tested, for example by showing an unapproved action being stopped?
- Which framework will the work map to, and does the company keep the mapping?
- Who operates the controls after the engagement ends?
- What happens to the company's data and records if the work stops?
How Chiri approaches this. Chiri builds, operates, and improves company-specific software as an AI managed service provider. Small teams of senior operators and engineers work with the customer. Login and roles, audit logging, data controls and checks that stop bad actions before they execute are part of the platform, so every application inherits them. See AI harness and governance
Want AI governance that runs in your systems, not only on paper? Talk to Chiri.
Questions and answers
What does an AI governance consultant do?
Lists the AI systems a company runs, assigns owners, writes the usage policy, sets the controls each system needs and sets up the records that show those controls work.
What should an AI governance engagement deliver?
An inventory with owners, a short policy, controls running in the systems and evidence that the controls ran. A policy document on its own is not enough.
Do we need ISO/IEC 42001 certification?
Not necessarily. The standard sets requirements for an AI management system. A company can align its controls to it first and decide on certification when customers or regulators ask for it.
What is the difference between AI governance and data governance?
Data governance covers how data is collected, stored and used. AI governance adds the AI systems themselves: which ones run, who owns them, what they may do and how their actions are checked.
Can a small company do AI governance without a full-time team?
Yes. Name one accountable owner, keep the policy short, put the controls into the systems and work with a partner that can operate them.