AI no one has inventoried
Use cases spring up in business areas and at suppliers before going through any risk assessment.
Consulting
AI Governance
Innovation with AI, without losing control.
We help your company use artificial intelligence safely, transparently and in compliance, without holding back innovation. We connect strategy, controls and evidence across the whole lifecycle of AI systems.
- ISO/IEC 42001
- ISO/IEC 23894
- ISO/IEC TR 24368
- NIST AI RMF
- EU AI Act
- LGPD and GDPR
The challenge
Innovation with AI, without losing control.
Regulation on the move
The EU AI Act is already in force and Brazilian regulation is advancing. Knowing what applies is the first step.
Risks that are not only technical
Bias, explainability, privacy and impact on rights call for method, accountable owners and human oversight.
A portfolio designed to be
Modular
Hire a single workstream or the complete program.
Integrated
Assessment, governance, risk, the AI Act, third parties and culture all connect.
Practical
Processes, documents, templates and routines that work in real life.
Ready for the future
Aligned with the EU AI Act, ISO/IEC standards, NIST and upcoming Brazilian AI regulation.
How we help
Workstreams
Compliance Assessment and Mapping
Goal
Find out where and how AI is already used in the company and its current level of compliance with the EU AI Act, ISO/IEC standards, NIST, the GDPR, the LGPD and market best practices.
What we do
Assessment
- Inventory of AI systems and use cases (internal and third party).
- Risk classification of systems, inspired by the AI Act and by business impact.
- Assessment of governance, processes, data, security, privacy and transparency.
- Adherence map against the AI Act, ISO/IEC 42001, ISO/IEC 23894 and the NIST AI RMF.
- Identification of priority gaps and risks.
AI Risk Management
Goal
Create a structured, recurring process to identify, assess, treat and monitor AI risks, integrated with enterprise risk management.
What we do
Method and operation
- Design of the AI risk methodology (risk types, criteria and scales).
- Forms, checklists and matrices for assessing risk system by system.
- Risk analysis: bias, discrimination, privacy, security, explainability, performance and impact on rights.
- Definition of treatment strategies and action plans.
- Structuring of AI risk metrics and reports.
Governance and AI Management System
Goal
Move beyond the assessment and actually build the company’s AI Governance, with formal roles, policies, standards and processes aligned with ISO/IEC 42001 (AIMS).
What we do
Structure and management system
- Design of the AI governance structure (committees, roles and responsibilities).
- Responsible AI Policy and operating standards (use case approval, model lifecycle, human oversight and third parties).
- AI Management System (AIMS): scope, processes, records and metrics.
- AI lifecycle flow, from idea to decommissioning.
- Assisted rollout in pilot cases.
AI Due Diligence and Third Parties
Goal
Assess and monitor suppliers and partners that offer or use AI, reducing risk in the AI supply chain (APIs, platforms, BPOs and integrators).
What we do
AI supply chain
- AI due diligence framework for third parties.
- Questionnaires and checklists specific to AI suppliers.
- Risk criteria and minimum requirements by supplier type.
- Integration of AI review into the procurement and contracting process.
- Pilot application with critical suppliers, with opinions and recommendations.
AI Training and Culture
Goal
Develop leaders, technical teams and employees so that responsible AI does not stay on paper but becomes part of the company’s culture and routine.
What we do
Tailored programs
- Senior management and the board: strategic view and decisions on AI.
- Legal, Risk, Compliance, Privacy and Information Security.
- Technical teams: data, AI and ML, IT, product and MLOps.
- All employees: awareness.
Learning paths and culture
- Structured learning paths: fundamentals, risks, the AI Act, governance, AI lifecycle, responsible MLOps, documentation and compliance.
- Culture initiatives: internal campaigns, short content and communication materials.
AI Act Compliance
Goal
Support companies that develop, provide or use AI systems in a European context in meeting the requirements of the AI Act, with a focus on high risk systems.
What we do
Regulatory compliance
- Regulatory scoping: whether and how the AI Act applies to the company and its products.
- Risk classification of systems under the AI Act categories.
- Gap analysis against the obligations of providers and developers of AI systems.
- Design and implementation of the required controls: risk management, data governance, technical documentation, logs, human oversight, robustness and cybersecurity.
- Support in structuring the quality management system and the conformity files.
References
Standards, laws and frameworks that guide the work and the evidence.
- ISO/IEC 42001
- Requirements for an AI Management System (AIMS). Certifiable.
- ISO/IEC 23894
- Guidance on AI risk management, based on ISO 31000.
- ISO/IEC TR 24368
- Overview of the ethical and societal concerns of AI.
- NIST AI RMF
- AI risk framework with the Govern, Map, Measure and Manage functions.
- EU AI Act
- Regulation (EU) 2024/1689, with obligations by risk level.
- LGPD and GDPR
- Protection of personal data processed by AI systems.
Related training
For the team that will run the program once the project ends.
In Galáxia
The Galáxia systems that sustain this work after the engagement, with the same method.
Request a proposal
Shall we map how your company uses AI?
Start with a compliance assessment or tell us about a specific workstream. We will reply with the scope that best fits where you are now.
cyber@cyberconsulting.com.br