Enterprise AI Governance & Compliance

01 The position

A policy nobody can enforce is a liability, not a control.

Every company we talk to has an AI usage policy. Almost none can answer the question that follows: show me. Show me a prompt that was blocked. Show me the team that hit its cap. Show me where customer data was sent last Tuesday, and which model saw it.

If the answer lives in a Confluence page and a training slide, you do not have a control — you have a document that will be read aloud during the incident review. Governance that works is a property of the infrastructure, and the gateway is where it goes.

WHAT "WE HAVE A POLICY" LOOKS LIKE WHEN IT IS REAL

Classification drives the route

What a request contains decides where it is allowed to go, how long it is kept and who can see it — enforced in infrastructure, not remembered by people. Budgets alert or stop spending outright, and they apply to the intern's script as much as to production.

How the gateway enforces this

02 The controls

Budget enforcement

Per team, per project, per key, per person. Soft caps alert; hard caps stop spending. Enforced at the gateway, which means it applies to the intern's script as much as to the production service.

Data-class routing

Each class of data is routed only to the destinations your policy allows, with the handling it requires. The rule is in infrastructure, so there is nothing to remember and nothing to forget.

Residency

EU prompts answered on EU hardware. Mainland China prompts answered inside the mainland, which is a solved problem here rather than a new one. Documented per route, with the reason attached, in a form that survives a DPIA.

Audit trail

Every call recorded with who, what, when and how much — and the content where policy requires it. Retained to your schedule, delivered into your existing security tooling, tamper-evident where that matters. This is the artefact that answers "show me".

Human in the loop

Approval gates on outputs that reach customers, move money, change records or carry regulatory weight — with every decision and its reason on the record. We have built exactly this before.

Access lifecycle

Model access tied to your corporate identity, so it is granted and revoked with everything else. When someone leaves on Friday, their model access leaves on Friday.

Egress control

Network policy that makes "no data leaves" a firewall rule rather than a promise. If a service is not supposed to reach the public internet, it cannot.

Post-quantum transport

Where the threat model includes harvest-now-decrypt-later, we add a PQC layer to model API transport through our partner QuReady. Relevant for long-lived confidential data; overkill for most. We will say which you are.

03 Frameworks

We build the evidence. Your counsel makes the argument.

We are engineers, not a law firm, and we will not pretend a Terraform module makes you compliant with anything. What we do is produce the technical evidence your legal and compliance people need: the logs, the controls, the architecture diagrams, the retention configuration and the routing rules, documented in a form that maps onto what they are being asked.

In practice that has meant EU AI Act transparency and record-keeping obligations, GDPR data-flow documentation, ISO 27001 control evidence, SOC 2 audit support, and sector rules in finance and healthcare that predate any of this and are not going to bend for it.

USUALLY BOUGHT AS

An add-on to the retainer

Most governance work lands on top of an existing stack — the controls need somewhere to live. Typical implementation is €4k–€12k, then it becomes part of the monthly operation.

AI Ops Retainer

ALSO AVAILABLE AS

A standalone review

Two weeks, fixed fee, written findings: what your current AI usage exposes you to, what is enforceable today, and what to fix in what order. No obligation to have us do the fixing.

Book a review

04 Questions

Will this make us compliant with the EU AI Act?

No infrastructure makes you compliant on its own, and we will not pretend otherwise. What we produce is the technical evidence your legal and compliance people need — records, controls, retention and routing — documented in a form that maps onto the record-keeping and transparency obligations they are being asked about.

Can we buy governance without the rest?

Yes. A standalone review is two weeks, fixed fee, with written findings — what your current AI usage exposes you to, what is enforceable today, and what to fix in what order. There is no obligation to have us do the fixing.

Where do the controls live?

In infrastructure you own, enforced at the point every AI request already passes through — so they apply to the intern's script as much as to the production service, and do not depend on anyone remembering a policy.

AI Governance