OUR APPROACH
From principles
to working controls.
Good governance makes decisions clearer. We start with the use case, apply proportionate scrutiny and leave your team with an approach it can operate.
01 / DISCOVER
Understand the decision.
Establish the purpose, affected people, deployment setting, data flows and supplier dependencies. Agree who owns the business decision and what evidence exists.
02 / ASSESS
Make the risk explicit.
Separate inherent risk from the controls already in place. Record evidence quality, uncertainty and residual risk rather than treating a completed checklist as assurance.
03 / DESIGN
Assign practical controls.
Define the action, owner, frequency, evidence and escalation route for each priority control. Connect governance to product delivery, procurement and existing risk processes.
04 / EMBED
Test the process in practice.
For implementation engagements, run a pilot decision cycle, resolve workflow friction and hand over the materials. Define the changes that should trigger a fresh review.
ASSESSMENT LENSES
The questions behind the checklist.
Purpose & impact
- Is the intended use clear and bounded?
- Who could be affected by an error?
- What uses should be prohibited or escalated?
Data & suppliers
- What data enters, leaves or is retained?
- What evidence supports supplier claims?
- Who owns changes to models and services?
Performance & fairness
- What does acceptable performance mean here?
- Does testing reflect relevant user groups?
- Are known limitations visible to decision-makers?
Human oversight
- Can reviewers understand and challenge outputs?
- When must a human intervene?
- Can the system be paused or rolled back?
Generative & agentic AI
- Are sources and generated claims checked?
- Are tool permissions and actions bounded?
- How are injection risks and unsafe outputs assessed?
Monitoring & evidence
- What signals trigger investigation?
- Who responds to incidents and complaints?
- Can a decision be reconstructed from records?
EXAMPLE DELIVERABLE
An evidence trail for a real decision.
Illustrative example: a customer-support assistant. This is a sample of our working method, not a client case study.
Risk
An unsupported policy answer reaches a customer.
Control
Use approved sources; route defined sensitive queries to a human; test the escalation path before release.
Evidence
Source owner and version, evaluation results, escalation logs and a documented release decision.
Accountability: the product owner owns the decision; subject-matter experts approve source content; the operational lead owns escalation and review.
Framework-informed.
Context-specific.
Where relevant to the agreed scope, we map your governance approach to NIST AI RMF, ISO/IEC 42001 and applicable regulatory expectations. The starting point is your role, jurisdiction and intended use—not an assumption that every requirement applies to every system.
Legal interpretation is agreed with your legal advisers. Our evidence review does not replace specialist model evaluation, security testing or accredited certification. Those activities can be separately scoped where needed.
YOUR NEXT DECISION
Let’s make it a confident one.
Tell us what you are deploying, the decision ahead and your deadline. We will recommend the smallest useful engagement.
DataBloom Partners.
Practical AI governance.
Clear scope. Fixed fees.
AI Governance & Assurance
© 2026 DataBloom Partners. Fees in GBP, excluding VAT where applicable.
