Standards and assurance

The framework US clients name when they ask how you govern AI. What it is, its four functions, what the generative AI profile adds and how a business of 50 to 500 people can line up with it accurately.

Most AI governance frameworks are written for enterprises. The six parts a business of 50 to 500 people needs, what changes between 50 and 500, how they map to NIST and ISO 42001 and a first 90 days.

AI governance platforms record AI use, run risk assessments and map controls to frameworks. What they do, who they are built for, what a business of 50 to 500 people can do with tools it already has and the signs it has outgrown them.

Most AI security writing is for the people who build models. For a business that uses AI tools, the risks sit in accounts, access, connections and payments. The six places AI changes your security and what to do first in each.

Your suppliers may be putting your data and your clients' data into AI tools. Which suppliers to ask first, eight questions to ask, what a good answer looks like, what belongs in the contract and how to keep it proportionate.

Data protection law did not change because AI arrived, and several of its questions are harder to answer for an AI tool. Eight checks before personal data goes in, what changed in 2026, and what belongs in the policy.

AI arrives in hiring through a feature in your recruitment system or a recruiter pasting applications into a chat tool. Why hiring is different, what regulators have found, seven checks before a tool screens candidates and where AI helps safely.

While an assistant answers and leaves the decision to you, an agent acts: it sends, updates, books and moves things. What that changes about permissions, errors and who can give it instructions, five questions before one goes live and where to start.

What AI literacy means for a business that uses AI tools, what each group of people needs to know, what the EU duty asks since its 2026 amendment and the record that shows it.