Skip to content
Book a call

Service · AI governance

AI governance consultancy for UK enterprises

Know what AI you run, what the law asks of each system, and how you will prove the controls work.

Last reviewed: .

An AI governance engagement with Comonad produces an inventory of AI systems and agents, their EU AI Act and UK regulatory classification, testable controls and the evidence an auditor can follow.

Our AI governance consultancy helps large UK organisations govern AI that is in production or about to be, and AI agents in particular. For each agent, we set how it is identified and authenticated, what it may do and on whose delegated authority, how it is managed at scale, who is accountable for it, and how its actions are audited and secured. For every AI system, we state what it may and may not do and write controls your engineers can implement and your risk team can evidence.

Each control names an owner, a test and the record it produces, so it runs in the pipeline as well as in the policy.

Tell us which AI systems or agents need governing and which frameworks your risk team works to.

Discuss your AI governance
  • Risk and compliance leads
  • Security and IAM leads
  • CTOs and engineering leads
On this page

What you get

At the end of an engagement, these sit with your teams.

  1. An inventory of AI systems and agents, including AI inside bought software.
  2. A classification record for each: EU AI Act role and risk tier where the Act applies, and the UK rules that touch it.
  3. A written control set, each control with an owner, a test and the record it produces.
  4. An evaluation plan showing how each control is checked in the running system.
  5. A gap list from a review of the running system, owned and ranked.
  6. A review cycle your teams run after hand-over.

What is AI governance in practice?

AI governance is the set of decisions and controls that say what an AI system is allowed to do, how you know it is doing that, and who is accountable when it does not. In production that means evaluation, access control, audit trails, human oversight and a tested way to stop the feature.

The engineering side, for teams writing code with assistants, is the AI-enabled SDLC consultancy. The document that policy usually starts from is the AI coding assistant policy.

We work through four stages:

  • Inventory and classification: a list of AI systems, what each does, who it affects and how it is classified. Output: a classification record per system.
  • Controls: what each system must and must not do, and how that is enforced. Output: a written control set.
  • Evidence: how you show each control is working. Output: an evaluation plan and a list of the logs and records each control produces.
  • Review: whether the running system matches the control set. Output: a review with the gaps listed.

AI and data governance

We treat the data with the system. For each one we record what it was trained on, what it retrieves and what it sends out, including the source, the lawful basis, the quality checks and who may see it.

UK regulators

The UK has no AI-specific legislation covering AI as a technology. AI is governed by existing law and by regulators within their own powers. We map your controls to the ones that apply to you. Our guide AI regulation in the UK sets this out in full.

  • ICO: UK GDPR and its guidance on AI and data protection, wherever personal data is involved.
  • FCA: the Consumer Duty and the Senior Managers and Certification Regime, for financial services firms.
  • CMA: competition and consumer law, where AI shapes what customers see or pay.
  • Ofcom: online services and communications.
  • Ofgem: its guidance on ethical AI use in the energy sector.
  • The ICO, FCA, CMA and Ofcom coordinate through the Digital Regulation Cooperation Forum (opens in new tab).

What an engagement covers

Governing AI agents: the six-layer framework

Agents act as well as answer, so we govern them through our six-layer framework for governing AI agents, which starts from identity and delegated authority. Each agent has its own registered identity and short-lived credentials, and when it acts for a person it may do only what both the person and the agent are allowed, checked at every tool call. A single control plane manages every agent across teams and vendors, with a named owner for each agent and each class of decision, and one switch to suspend it. Every action leaves a tamper-evident trace, and each agent runs in an environment contained against hostile input such as prompt injection.

Identity, access control, audit trails and retention

We set who and what may invoke each model and tool, and on what terms. Every agent and service gets its own identity, authenticated with short-lived credentials in place of shared accounts or long-lived keys, and holds only the permissions its task needs, with a policy check at every tool call as well as at sign-in. We define what is logged, how the audit trail is made tamper-evident (for example with append-only or hash-chained storage), how long records are kept and how they are reviewed. The aim is a trail that an auditor or incident reviewer can follow without asking the engineering team to reconstruct it.

AI system inventory and classification

We record what each model or agent does, who is affected, and what a failure costs. Where the EU AI Act applies, we set out your role for each system (for example provider or deployer) and its risk category, so that the obligations that follow are clear.

Evaluation and reliability

We define how each system is evaluated before and after release, and when it must refuse, escalate or hand over to a person. Human oversight is designed with the people who will do it: who can intervene, how, and with what information in front of them.

Model and vendor risk

We document what you send to each model provider, what the provider retains, and how a change of model or provider is assessed and approved. Contract terms and data-processing terms are part of this review; legal interpretation stays with your counsel.

Framework mapping

We map each control to the EU AI Act, UK regulatory guidance, ISO/IEC 42001 and the NIST AI RMF, only where they apply to your systems. For systems in scope of the EU AI Act's high-risk requirements, agent audit trails and oversight controls support the record-keeping duties in Article 12 and the human oversight duties in Article 14. The same control is then cited from each framework that applies.

The control set and a check against the running system

The main output is a written control set that your engineering team can implement, followed by a review of whether the live system matches it. Where it does not, the gaps are listed with owners.

What you keep

  • Classification record

    A classification record for each AI system and agent in scope.

  • Written control set

    Controls mapped to the frameworks that apply, each with an owner and a test.

  • Evaluation plan

    How you show each control is working, and the records it produces.

  • Gap list

    A review of the running system, with the gaps listed and owned.

How an engagement runs

If you need the controls built, that is scoped separately as an agent harness, an AI-enabled SDLC engagement, or an AI operations engagement that takes one function from people-run to agent-run.

The frameworks, briefly

EU AI Act compliance for UK organisations

The EU AI Act is Regulation (EU) 2024/1689 (opens in new tab). It applies to UK organisations that place AI systems or general-purpose AI models on the EU market, put AI systems into service in the EU, or provide or deploy AI systems whose output is used in the EU. Prohibited practices have applied since 2 February 2025, general-purpose AI model obligations since 2 August 2025, and most other provisions, including the Article 50 transparency duties, from 2 August 2026. Generative systems placed on the market before 2 August 2026 have until 2 December 2026 to mark their output. The Digital Omnibus on AI (Regulation (EU) 2026/1744 (opens in new tab), in force since 27 July 2026) set the high-risk dates at 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. Our EU AI Act compliance service does this mapping. Does the EU AI Act apply to UK companies?

UK regulatory guidance

The UK has no AI-specific legislation covering AI as a technology. AI is regulated where it is used, through existing law and sector regulators. Relevant sources include the ICO's guidance on AI and data protection, sector guidance such as Ofgem's "Ethical AI use in the energy sector" (updated May 2026), and the Department for Science, Innovation and Technology's AI Risk Management Toolkit, published in September 2026 for anyone designing, procuring or delivering an AI product. Work in that sector is covered in AI for regulated energy and utility companies.

ISO/IEC 42001 readiness

ISO/IEC 42001:2023 is an international management-system standard for AI, published in December 2023. It sets requirements for establishing, implementing, maintaining and continually improving an AI management system: the policies, roles, risk processes and controls an organisation uses to govern its AI. Mapping your controls to ISO/IEC 42001 is not certification. The certificate comes from a certification body. In the UK, UKAS accredits certification bodies for this standard. We prepare you; we do not certify. See ISO/IEC 42001 readiness.

NIST AI RMF

The NIST AI Risk Management Framework (AI RMF 1.0, January 2023) is a voluntary framework from the US National Institute of Standards and Technology. It is organised around four functions: Govern, Map, Measure and Manage. NIST has also published a Generative AI Profile (NIST AI 600-1, July 2024). We use the AI RMF as a shared vocabulary for risk treatment and monitoring, often alongside ISO/IEC 42001.

What we do not do

  • We do not give legal advice. Legal sign-off stays with your counsel.
  • We do not issue ISO/IEC 42001 certification. Certification is carried out by certification bodies. In the UK, UKAS accredits them. We help you prepare.

Who it is for

  • Leaders who already have, or are about to ship, an AI feature in a system customers depend on.
  • Risk, legal and compliance teams asked to map the EU AI Act, UK regulatory guidance, ISO/IEC 42001 or the NIST AI RMF onto an actual system.
  • Engineering, security and identity and access management (IAM) leads who need a written control set they can implement, including for AI agents.

Our founder spent almost seven years as co-founder and CTO of Cloud KB, building software for the UK energy market. Read his profile.

Alex Vakhitov, founder of Comonad Limited

Alex Vakhitov

Founder, Comonad · AI and software architect, London

Alex Vakhitov founded Comonad in 2024. An AI and software architect, he was co-founder and CTO of Cloud KB, UK energy-market software, from August 2015 to March 2022.

Read Alex Vakhitov's profile

Questions about AI governance

Does the EU AI Act apply to us if we are UK-based?

Often, yes. The EU AI Act applies to UK organisations that place AI systems or general-purpose AI models on the EU market, put AI systems into service in the EU, or provide or deploy AI systems whose output is used in the EU. Our guide "Does the EU AI Act apply to UK companies?" sets out the tests.

When do the high-risk obligations apply?

After the Digital Omnibus on AI (Regulation (EU) 2026/1744), obligations for high-risk AI systems apply from 2 December 2027 for systems listed in Annex III, and from 2 August 2028 for AI in products covered by the EU legislation in Annex I. Prohibited practices, general-purpose AI model obligations and most transparency duties already apply, on earlier dates.

Can you get us ISO/IEC 42001 certified?

We help you prepare: the AI management system's policies, roles, risk processes and controls, mapped to ISO/IEC 42001. The certificate itself comes from an accredited certification body.

How is AI regulated in the UK?

There is no single UK AI law. AI is regulated where it is used: through existing law such as UK GDPR, and by regulators such as the ICO, FCA, CMA and Ofcom applying the government's AI principles within their own powers. Our guide AI regulation in the UK sets out what applies.

Does ISO/IEC 42001 certification make us EU AI Act compliant?

Not on its own. ISO/IEC 42001 is not a harmonised standard under Article 40 of the Act. We map one control set to both. See our ISO/IEC 42001 readiness service.

Do you give legal advice?

No. We work alongside your counsel, who decides how the law applies to you. We turn that into controls and evidence.

Is AI literacy now a legal duty?

Under the EU AI Act, yes, in a softened form. Since the Digital Omnibus, Article 4 asks providers and deployers to take measures to support the AI literacy of their staff and others operating AI on their behalf, without guaranteeing any particular level. The regulation text is in Regulation (EU) 2026/1744 (opens in new tab).

What evidence will an auditor or regulator expect?

Evidence that each control works in the running system, as well as on paper: the logs and records each control produces, tied back to the classification and control set. The records we prepare are listed under "What you keep". Your auditors and counsel decide what is sufficient for your case.

How do you govern AI agents as well as models?

Through our six-layer framework for governing AI agents: identity and authentication, authorisation and delegated authority, control plane and lifecycle, accountability, auditability and evidence, and runtime security. For any action an agent takes, you should be able to say who acted, on whose behalf, under which policy and with what result, and be able to stop it.

Do we need a separate AI policy if we already have ISO 27001?

Usually you can build on it. ISO/IEC 27001 covers information security, and many of its controls (access, logging, supplier management) carry over. It does not cover AI-specific questions such as how a system is classified, how it is evaluated, when a person must intervene, or what a model provider retains. We extend your existing controls to cover those, so there is one control set.

Related

Discuss your AI governance

Tell us which AI systems or agents need governing and which frameworks your risk team works to.

Discuss your AI governance