EXPERTISE

AI Controls. Governed like any material risk.

AI brought inside the enterprise risk framework, with clear ownership, defined risk appetite and board-level oversight.

AI is now part of how institutions decide, serve and operate, and boards are accountable for it. We approach AI from the enterprise risk side, not the engineering side: the same disciplines of ownership, appetite, controls and monitoring that govern any material risk, applied to AI use across the institution. Model development and technical testing remain with your technical teams or specialist providers.

OwnershipInventoryRisk classificationAppetiteThird partiesBoard oversight

WHAT WE DO

Services in practice.

Four services, each aligned with a function of the NIST AI Risk Management Framework (AI RMF 1.0).

KEEL PRAGMA

AI inside the
enterprise risk framework

AI policy and governance

NIST AI RMF · GOVERN

AI policy inside the ERM and GRC framework

Clear ownership and accountability for each AI use

Committee mandates and escalation routes

Board oversight and reporting

AI inventory and risk classification

NIST AI RMF · MAP

Inventory of AI use across the institution

Context and intended purpose of each use

Risk tiering by impact on customers and operations

Benefits weighed against risks

AI within the risk appetite

NIST AI RMF · MEASURE

Appetite statements and limits for AI use

Key risk indicators and metrics

Monitoring and reporting against limits

Breach escalation and periodic review

Third-party and vendor AI

NIST AI RMF · MANAGE

Due diligence on AI in vendor products

Contract terms: transparency, data use, audit rights

Ongoing vendor monitoring

Incident response and exit plans

TYPICAL DELIVERABLES

What you receive.

AI policy aligned with the ERM framework
AI use-case inventory and classification method
AI statements within the risk appetite
Oversight and reporting arrangements for the board
Third-party AI due diligence checklist
Framework alignment with the NIST AI RMF

Discuss your risk and governance priorities.

A confidential conversation about where your framework stands and what would strengthen it.

Planning a training programme for your team? Ask about tailored workshops →