WHAT OUR WORK COVERS
Privacy and AI governance,
explained and put into practice
Buyers and customers increasingly ask about both at once. Here's what the work covers, in plain terms.
| A data map is the foundation of every privacy answer. | |
|---|---|
| Almost every privacy question comes back to one record: | |
| ✓ | What data you collect |
| ✓ | Where it lives and how it moves |
| ✓ | Which vendors receive it |
| ✓ | How long you keep it |
| AI governance is simpler than it sounds. | |
|---|---|
| For each AI system you build or use: | |
| ✓ | A named owner |
| ✓ | A documented purpose |
| ✓ | A review step matched to its risk |
| ✓ | A record that the review happened |
| Aligned to the NIST AI Risk Management Framework and ISO 42001, sized to your stage. | |
Aligned to frameworks people recognize.
-
SOC 2
How your controls perform over time.
-
ISO 27001, 27701, & 42001
Security, privacy, and AI management systems.
-
NIST CSF & AI RMF
US frameworks for cyber and AI risk.
-
HIPAA
Protecting health information.
-
GDPR & CCPA/CPRA
Personal data in the EU and California.
-
Cyber Essentials & PCI DSS
UK baseline security and cardholder data.
Find out which of these may apply to you.
Data Privacy & AI Governance FAQs
-
A record of what personal data you collect, where it lives, how it moves, which vendors receive it, and how long you keep it.
-
For each AI system: a named owner, a documented purpose, a review step matched to its risk, and a record that the review happened.
-
Customers increasingly ask about internal AI use too, such as what data goes into those tools. A simple owner and review step usually covers it.
