Consultancy

Make governance work in practice.

Build a governance model that helps people make sound decisions about AI, with clear accountability, usable controls and evidence that remains connected to the work.

Light falling through a pale stone architectural passage

In practice

Governance for the decisions already being made.

AI governance consultancy addresses the practical questions around adoption. Who owns the use case? Who can approve it? Where does oversight sit when a supplier provides the model but your organisation remains responsible? What evidence exists when a decision is challenged?

Those questions arise in ordinary work. An internal knowledge assistant may search sensitive material. Document summarisation may influence a legal or operational decision. A customer support tool may draft answers at volume, making its boundaries, escalation route and monitoring important before it goes live.

We connect those realities to a governance model people can use. We look at purpose, information, affected people, supplier, automation and consequences, then establish the ownership, review and evidence needed to proceed at a reasonable pace.

The problem

Where organisations get stuck

AI use cases proliferate beyond the register. A team starts with a permitted assistant, then adds a data source, user group or second purpose. Procurement records the supplier and security reviews the connection, but no one sees how the use is changing.

Ownership can be nominal rather than real. A policy names a committee while the person who understands the workflow cannot approve a change, and the person with authority does not see the evidence. Decisions then slow down or default to the loudest voice.

Governance becomes a document rather than a practice. Teams can point to a policy, but cannot say which route applies, what review has happened or what would require escalation. The document may be sound while decision-making remains invisible.

An annual cycle cannot keep pace with changing models, suppliers, data and users. Evidence arrives after the decision, assembled for an audit or incident from disconnected messages, tickets and spreadsheets. It is harder to trust and act on.

How we work

Three ways we work with you

Advisory →

Advisory helps decide where to begin. We build a grounded view of current and planned AI use, the decisions that matter, the obligations in scope and the control environment already operating around them. That may mean reviewing an existing register, tracing a use case through procurement and delivery, or working through a decision that has exposed a wider accountability question. We clarify who owns the outcome, who must contribute judgement and where authority sits. From there, we prioritise use cases according to consequence, urgency and readiness, rather than trying to assess everything at the same depth. The output is a practical starting point: a set of decisions, owners and next actions that gives leaders confidence and gives delivery teams a route forward.

Governance design →

Governance design connects oversight to specific decisions. We define the intake questions, assessment depth, approval authority and evidence that should remain with the decision. The design reflects information sensitivity, affected people, automation, reversibility, scale, supplier dependencies and relevant legal or contractual requirements. It also fits the sector and control environment already in place, strengthening risk, security, legal, procurement and assurance routes instead of competing with them. The result is proportionate review with clear thresholds, escalation and human responsibility.

Implementation →

Implementation turns agreed governance into roles, workflows and habits. We work with the people who will register, assess, approve, operate and review use cases, using real examples to test language and timing. That can include intake routes, decision templates, review forums, escalation paths, role descriptions, training and connections to change management or incident processes. We help the model go live in the organisation’s own operating rhythm, with clear hand-offs and evidence that can be maintained as work moves. Embedding matters because governance that depends on one specialist team or one annual meeting will fade. The aim is a way of working that teams can use themselves, with senior advisers available to resolve the harder questions and improve the model as adoption develops.

From advisory to a sustained way of working

RightTime Governance™ is the approach underlying our consultancy. It connects oversight to each AI use case, with review and evidence proportionate to context. Advisory work establishes the controls, responsibilities and routes that make a sound decision possible, then leaves the organisation able to use them without advisers in every room.

Citadel is the governance workspace that sustains that practice. It holds use cases, ownership, reviews, decisions and evidence in one place. AI compliance software alone will not fix your governance. It becomes useful when the organisation has decided what should be controlled, who is accountable and what evidence matters, then uses the workspace to keep those decisions current.

Together, they support governance at the speed of AI: clear responsibility, proportionate control and a record connected to the work.

What working with us looks like

Senior advisers work with the people who will own and use the model, staying close to the workflow, data, supplier, decision and person who must act.

Work is proportionate to context. A focused review may take weeks; a broader operating model needs more discovery and testing. We aim for useful deliverables in weeks rather than quarters.

The measure of a good engagement is what remains: clearer ownership, a route for review, evidence connected to decisions and confidence to keep improving governance.

Questions

Frequently asked questions

Do we need AI governance if we only use AI tools rather than build them?

Yes. Using a supplier's tool still creates decisions about data, access, purpose, human review, procurement and accountability. Governance should reflect the use and its consequences, not only who trained the model.

Where should we start?

Start with what is already being used and the decisions that matter most. A focused view of use cases, owners, affected people and existing controls usually shows where a small amount of work will remove the most uncertainty.

How is this different from a policy document?

A policy sets direction. Working governance connects that direction to a use case, a decision, a named owner, a review route and evidence that can be understood later. The test is whether people can use it when work is moving.

Do we need software as well as consultancy?

Not always. Consultancy can establish a workable operating model using existing tools. Where use cases and evidence are numerous or changing quickly, Citadel provides a shared workspace that helps keep ownership, reviews and decisions current.

How long does it take?

A focused advisory or design engagement can produce a useful starting point in weeks, with timing shaped by scope, access to stakeholders and the control environment already in place. Implementation then progresses through real use cases rather than waiting for a large programme to finish.

What does your governance need to do next?

Share the decision, use case or operating question you are working through. We will help you identify a useful starting point.

Start a conversation →

Direct: info@moraltoai.co.uk