Governance & Compliance
A defensible answer, and the documents behind it.
When an insurer, an enterprise customer or a regulator asks how you govern AI, "we're careful" is not an answer. We assess your AI use against NIST AI RMF 1.0 and produce the evidence set that withstands the follow-up question.
The AI Governance Audit
Four phases. The output is an evidence set, not a slide deck.
Scoping and estate discovery
We establish your tier floor from your exposure triggers, then inventory every AI system actually in use — including the ones nobody approved. Most organizations discover their estate is larger than they thought, and that discovery is usually the most valuable hour of the engagement.
Evidence capture
A structured interview across your AI estate, data classification, vendor contracts and oversight practices, using a purpose-built capture instrument. Every response is recorded against a named control, and everything we couldn't confirm on the day is logged as an open item rather than quietly assumed. This is the part most "AI readiness assessments" skip.
Artifact production
We write your governance documents from the captured evidence — not templates for you to fill in, but populated artifacts with real owners, real evidence locations and real review dates baked in.
Audit matrix and findings
A control-by-control matrix showing your position against every applicable NIST AI RMF focus area, with gaps prioritized by exposure rather than by ease.
What you receive
A tier placement
With the exposure reasoning behind it, so you can show your working to anyone who asks.
A control-level gap matrix
Your position against every applicable focus area of NIST AI RMF 1.0.
Up to 24 governance artifacts
Organization-level documents covering policy, estate register, data classification, risk scales and vendor oversight, plus per-system documents for each AI system in scope.
A register of open items
Every unconfirmed answer, with a named owner against it. Nothing quietly assumed.
A prioritized remediation sequence
Ordered by exposure, so the first thing you fix is the thing most likely to hurt you.
Artifacts are delivered as Markdown. They're portable, diff-able, and yours — they'll open in anything and outlive any tool.
Scope scales with tier. A Tier 1 baseline engagement is a fraction of the work of a Tier 3 assurance engagement. We size to your calculated floor, not to our capacity. The scoping call establishes which.
Governance training
Most workplace AI training is a one-hour all-staff session on prompt writing. It's useful, and it's worth nothing to an auditor. GOVERN 2.2 requires training that is role-specific and recorded. The person approving a high-stakes output needs different training from the person drafting with a copilot, who needs different training again from the executive carrying accountability for the whole estate. A single undifferentiated session evidences none of it.
| Program | Audience | Closes |
|---|---|---|
| Executive accountability briefing | CEO, board, partners | GOVERN 2.3 — leadership owns AI risk decisions |
| Acceptable use induction | All staff | GOVERN 1.2 — policy issued, understood, acknowledged |
| Role-specific risk training | Each function touching AI | GOVERN 2.2 — role-differentiated and recorded |
| Practitioner proficiency | Daily AI users in consequential workflows | MAP 3.4 and MEASURE 1.1 — proficiency standards, output verification |
| Oversight and review training | Reviewers and approvers | MANAGE 2.4 — meaningful human oversight |
The oversight problem, called out
Human-in-the-loop only works if the human can actually catch the error. A reviewer who approves every output because they have never been shown a plausible-looking wrong one provides no oversight at all — but the sign-off record says they did, which is worse than having no control. Our oversight training uses realistic failure cases from your own domain, and measures whether reviewers catch them.
Training can be bought on its own. But without an audit first you are guessing at which roles need what, and guessing is the thing GOVERN 2.2 exists to prevent. Most clients audit, then train against the findings.
Ongoing assurance
An audit is a photograph. Your AI estate is not a still subject — staff adopt new tools, vendors change their models, and the open items on your register either close or don't. Ongoing assurance keeps the evidence set current, so the next questionnaire doesn't start from scratch.
Monthly
For organizations at Tier 3, or in active remediation. Estate changes reviewed, open items chased, artifacts versioned.
Quarterly
The common cadence at Tier 2. Enough to catch new systems before they become findings, without becoming a standing meeting nobody wants.
Annual
A full re-audit and tier re-check. Appropriate at Tier 1, or where exposure is stable and the estate rarely changes.
What this is not
This is not certification. Akkuitt is not an accreditation body, and no audit we perform makes you "ISO 42001 certified" or "NIST compliant" — NIST AI RMF 1.0 is a voluntary framework, not a certifiable standard. What we provide is a documented, evidence-based assessment against it, and the artifacts required to withstand scrutiny from a customer, insurer or regulator. If your contracts mandate accredited ISO/IEC 42001 certification, we prepare you for the certification body's audit; we don't replace it.
Start with thirty minutes.
We'll walk your exposure triggers, confirm the floor, and tell you honestly whether you need an engagement.