AI governance, risk and controls

AI governance, risk and controls, built into delivery

Tenhaw builds AI governance into delivery: inventories, decision owners, review gates and evidence produced during the work. This is not legal advice.

Controls agreed before access. BS7858 screening before access; client-approved tools and infrastructure. Read the security commitments.

Book a 30-minute call

30 minutes with James Rooney to discuss your team, workflow and first scope.

See the evidence and approach
The job to be done

What we can help you deliver

For leaders, risk owners and delivery teams who need to decide which AI systems to use, who may approve them and what evidence must exist before they act.

Know which systems need attention

Keep a proportionate inventory of AI systems, their owners and the decisions they support. Use consequence to decide where deeper review belongs.

Make approvals part of delivery

Name the decision owner and define review gates before building. Risk and compliance help design the workflow alongside product and engineering.

Keep evidence with the work

Produce evaluation results, access decisions and review records while the system is built. Your legal owner determines the applicable legal test; this is not legal advice.

Use a 30-minute call to discuss the outcome your team needs.

Book a 30-minute call
Working together

Build the capability around real work

  1. 01

    Inventory the work and its consequences

    Identify the AI systems, affected people and consequences of a wrong answer or action. Keep the initial inventory proportionate to the decisions it supports.

  2. 02

    Triage in two passes

    Consider consequence first, then ask counsel to apply the relevant legal test. A consequence assessment supports the discussion; it does not determine a legal classification.

  3. 03

    Build and review under agreed controls

    Use client-approved tools in client infrastructure, with scoped identity and human review. Retain evidence of checks and decisions as part of delivery.

Ask how this approach would fit your data, systems and team on a 30-minute call.

Book a 30-minute call
Evidence and approach

Read the evidence behind the approach

Security was part of the PPL working method

At PPL, a security review ran roughly every fifth prompt, with client-approved tools and client infrastructure. The greenfield build remained a working proof of concept: nothing moved into production and no regulatory or audit position changed.

Read the PPL operating-model case study

Book 30 minutes to ask James about the work and how it relates to your situation.

Book a 30-minute call
Scope and price

Choose a starting engagement

Agree the workflow, deliverables and team before work starts. These are the existing engagements this use case can sit within; prices exclude VAT.

AI Readiness Audit

Fixed price · £44,000

4 weeks

Find the AI workflows worth funding. Test them with your team.

See scope, team and terms

Agentic Proof of Concept

Fixed price · £20k–£55k

2–4 weeks

Build and test one AI workflow in your own tenancy.

See scope, team and terms

90-day outcome programme

Fixed price · £120k or £180k

90 days

One workflow in production and in use in 90 days.

See scope, team and terms

Use a 30-minute call to decide which scope is a sensible starting point.

Book a 30-minute call
Read further

Explore the method and related use cases

book a call

Talk through the work you want to change.

A 30-minute discovery call with James Rooney. Bring a workflow, product or team challenge and we will discuss a sensible first scope.

Book a 30-minute callRead the AI case studies first

most start with a fixed-price AI Readiness Audit · £44,000 · 4 weeks · working prototypes

// pick a slot · cal.com/tenhaw/professional-servicesLIVE CALENDAR

No time that suits? Email hello@tenhaw.com. Calendar not loading? Open it on cal.com.

Describe the work

Describe the work in a paragraph. James replies with a rough scope and budget range within two working days.

Send James a paragraph about the work

We use these details to respond to your enquiry. Read our privacy notice.

Frequently asked questions

What is secure AI adoption?

It means introducing AI under agreed access, data and review controls. Tenhaw works in client infrastructure, uses only AI tools approved by the client in writing and keeps security review inside the working method.

What does responsible AI mean in practice?

Keep a proportionate AI inventory, name the people responsible for decisions, set review gates by consequence and produce evidence during delivery. Risk and compliance participate in designing how the work runs. This is not legal advice.

Do we need ISO 42001 or the EU AI Act?

ISO/IEC 42001 is a certifiable AI management-system standard. The EU AI Act is legislation whose application depends on the system and its use, including placement on the EU market. Your legal owner determines the obligations; certification does not itself settle them. This is not legal advice.

How do you decide which AI systems count as high risk?

We use two passes: consider the consequences of the system first, then apply the legal test with counsel. A workflow with serious consequences deserves attention even before its legal classification is settled. This is not legal advice.

Which AI tools can a consultancy use on our data?

Only tools you have approved in writing for that engagement. Tenhaw’s published security commitments include zero-retention or enterprise model agreements, client infrastructure and identity, least privilege and no retention of client production data.

Should risk and compliance review AI systems or help design them?

Both. They belong in operating-model design so decision rights, escalation and evidence are agreed before implementation. Review gates then check the system against that agreed design. This is not legal advice.

What does AI governance cost?

Governance runs inside the £44,000 readiness audit, £20,000–£55,000 proof of concept and £120,000 or £180,000 90-day programme. Standalone governance is scoped at the published day rates: partner £1,560, senior practitioner £1,250 and associate £950, excluding VAT.

Is Tenhaw ISO 42001 certified?

No. The published position is “ISO/IEC 42001 (AI management systems), under assessment, and increasingly the one clients ask for”. Cyber Essentials Plus certification is in progress; ISO 27001 has a gap assessment complete, with certification targeted for 2027.