Use AI with confidence, not guesswork.
Know every AI system in use, classify its risk, put the right controls and owners in place, and prove it to your board, customers and regulators, using ISO/IEC 42001, the NIST AI RMF and the EU AI Act.
Risk tiers follow the EU AI Act. Illustrative examples.
AI is already in your business. Is it governed?
Most organisations use far more AI than they realise: assistants built into everyday software, tools staff adopt themselves, and models inside supplier products. Without ownership and approval routes, sensitive data leaks, biased decisions go unchecked and regulatory duties are missed.
Good AI governance is not a brake on innovation. It gives teams a fast, clear route to approval, and gives leaders evidence that risks are understood and managed.
Tools adopted without approval, often fed with sensitive data.
Hiring, credit and access decisions need human oversight.
Models inside the products you buy, with their own terms.
EU AI Act, UK GDPR and sector regulators all apply.
Classify an AI use case
Pick a use case to see its indicative EU AI Act risk tier and the governance it needs. Indicative only, not legal advice.
CV screening and shortlisting
AI used to recruit or select people, or to filter applications, is listed as high risk under the EU AI Act.
Governance actions
- Human review of every shortlisting decision
- Bias and accuracy testing before and after go-live
- Data protection impact assessment under UK GDPR
- Clear information for candidates
- Logging, supplier evidence and a named owner
Credit scoring of individuals
Assessing the creditworthiness of individuals is a high-risk use case under the EU AI Act.
Governance actions
- Risk management and data quality controls
- Explainability for decisions that affect people
- Human oversight and a route to challenge outcomes
- Model monitoring for drift and bias
- Alignment with FCA Consumer Duty expectations
Customer service chatbot
People must be told when they are interacting with an AI system rather than a person.
Governance actions
- Tell users they are talking to AI
- Easy escalation to a human
- Guardrails on what the bot can say and do
- Controls on what customer data it can access
- Monitoring of answers for accuracy
Generating marketing images and video
AI-generated or manipulated content, including deepfakes, must be clearly labelled as such.
Governance actions
- Label AI-generated content
- Check rights and licences for training and outputs
- Brand and legal review before publishing
- Approved tools only
- Record which assets were AI-generated
AI coding assistant for developers
Most productivity uses carry no specific obligations under the EU AI Act, but security and IP risks remain.
Governance actions
- Approved tools with enterprise data terms
- Block secrets and proprietary code leaving the business
- Secure code review of AI-written code
- Licence and IP checks
- Usage monitoring
Email spam and phishing filtering
Spam filters are a common example of minimal-risk AI with no specific obligations under the Act.
Governance actions
- Record it in the AI inventory
- Supplier assurance
- Normal security monitoring
Emotion recognition of staff at work
Inferring the emotions of people in the workplace is a prohibited practice, except for medical or safety reasons.
Governance actions
- Do not deploy
- Remove or redesign existing uses
- Brief HR, procurement and suppliers
- Add it to your acceptable use policy as banned
Social scoring of people
Scoring people on social behaviour or personal characteristics in ways that lead to unfair treatment is prohibited.
Governance actions
- Do not deploy
- Check supplier products for this capability
- Make it an explicit prohibited use in policy
One programme, every framework
Build governance once and map it to the standards, laws and principles that apply to you.
ISO/IEC 42001
The international standard for an AI management system. It sets out how to govern AI responsibly across policy, risk, impact assessment, data and suppliers, and it can be independently certified.
What it asks of you
- AI policy and defined roles
- AI risk assessment and treatment
- AI system impact assessments
- Controls for data, suppliers and the AI lifecycle
- Internal audit and management review
How Cybergen helps
Gap analysis, implementation support and internal audits, aligned with ISO 27001 where you already have it, through to certification readiness.
ISO ConsultancyNIST AI RMF
The US National Institute of Standards and Technology AI Risk Management Framework. Widely used internationally to structure AI risk work around four functions.
What it asks of you
- Govern: culture, policy and accountability
- Map: understand context and impacts
- Measure: assess and track risks
- Manage: prioritise and act on risks
How Cybergen helps
We use the four functions to structure your AI risk register and reporting, so it maps cleanly onto ISO/IEC 42001 and regulation.
NIST AdvisoryEU AI Act
EU regulation that classifies AI systems by risk. It applies to UK organisations that place AI systems on the EU market or whose AI outputs are used in the EU. Obligations phase in over several years, starting with prohibited practices in February 2025.
What it asks of you
- Ban prohibited practices
- Meet transparency duties for chatbots and generated content
- Strict requirements for high-risk systems
- AI literacy for staff who use AI
- Obligations for general-purpose AI providers
How Cybergen helps
We help you work out whether the Act applies, classify your use cases and build a practical compliance plan with your legal advisers.
UK principles
The UK applies five cross-sector principles through existing regulators rather than a single AI law, alongside UK GDPR and the ICO's guidance on AI and data protection.
What it asks of you
- Safety, security and robustness
- Transparency and explainability
- Fairness
- Accountability and governance
- Contestability and redress
How Cybergen helps
We translate the principles and ICO expectations into concrete controls, DPIAs and evidence for your sector regulator.
GDPR & Data ProtectionGovernance at every stage
A light, repeatable route that every AI use case follows, from first idea to retirement.
How governed is your AI?
Tick what is true today. Nothing is sent or stored.
From inventory to assurance
AI inventory and discovery
Find approved, shadow and embedded AI across the business, with owners, purposes and data flows.
Policy and acceptable use
A practical AI policy, acceptable use rules and an approval route people will actually follow.
Risk and impact assessment
Assess use cases for bias, accuracy, security, privacy and legal risk, including DPIAs.
Supplier and model assurance
Review AI suppliers' data handling, model terms, security and change notifications.
Human oversight design
Define where people review AI decisions, how they challenge them and when to escalate.
Framework alignment and audit
Map controls to ISO/IEC 42001, NIST AI RMF and the EU AI Act, and run internal audits.
Built for the people accountable for AI
How is AI governance different from AI security?
AI security protects AI tools and the data flowing through them from misuse and attack. AI governance decides which AI uses are allowed, who owns them, how risks are assessed and how you prove it. Most organisations need both.
Does the EU AI Act apply to UK organisations?
It can. It applies if you place AI systems on the EU market or if the outputs of your AI systems are used in the EU. We help you work out whether and how it applies, alongside your legal advisers.
Do we need to build our own models for this to matter?
No. Most risk comes from AI you buy or that staff adopt themselves, including assistants built into everyday software. Governance covers all of it.
Can we get certified?
Yes. ISO/IEC 42001 is a certifiable AI management system standard. We help you implement it and prepare for an accredited certification body's audit.
How long does an AI governance assessment take?
It depends on your size and how much AI is in use. We agree scope and timings with you up front, and most organisations have a prioritised plan within weeks.
Govern AI with confidence.
Tell us where AI is used in your organisation and what worries you most. We will recommend a proportionate first step.
Thanks, we've received your enquiry
A member of our team will be in touch shortly.