AI governance, from a blank page.

Why this matters now

AI quietly entered your business. The questions are about to arrive.

AI adoption in most SMEs hasn't been planned — it's happened. Marketing started using ChatGPT to draft copy. Engineering wired an LLM into the codebase. Finance is feeding customer data into a tool no one formally approved. Every team has its own pattern of use, and no one has a complete picture of what's running, on whose data, with what oversight.

That ambiguity is fine until something arrives that demands clarity. Increasingly, those things are arriving. Below are the most common moments that bring SMEs to me.

• An enterprise customer's security questionnaire A new section on AI use, training data, model providers, and human-in-the-loop controls. The contract depends on the answer being credible.
• The board reads about the EU AI Act The CEO or chair forwards an article and asks a version of "are we ready?" — knowing they need a defensible answer rather than a defensive one.
• An auditor adds AI to the scope ISO 27001 surveillance audits, SOC 2 examinations, and FCA-driven reviews are increasingly asking pointed questions about AI risk, oversight, and controls.
• An incident, a near-miss, or a regulator's letter A model produces something embarrassing or non-compliant. A staff member pastes confidential data into a public LLM. The ICO writes to ask about a complaint. The absence of a programme becomes obvious.
• Cyber insurance renewal Insurers are adding AI risk management to their underwriting questionnaires. Without a programme, premiums rise, exclusions widen, or cover narrows.
• You sell into the EU, or process EU users' data The EU AI Act applies extraterritorially. UK-based businesses serving EU customers are within scope, regardless of UK government policy.

What AI governance involves

Eight things every AI governance programme needs.

AI governance is not a single document or a single tool. It's a programme — comparable in shape to an information security programme — built from a small number of distinct components, each of which has to work together. When SMEs come to me with no programme in place, this is the structure we build out.

Why me

The CISO who can also stand up your AI governance.

AI governance sits at the intersection of cybersecurity, data protection, risk management, and emerging regulation. Very few practitioners cover all of those credibly. Most consultancies offer one specialism — privacy lawyers who don't understand the technical risk, data scientists who don't understand the regulatory machinery, generalist consultants who haven't built either type of programme from scratch.

I'm one of a small number of UK practitioners certified by the International Association of Privacy Professionals as an AI Governance Professional (AIGP), alongside CISSP, CCSP, CISM, and GDPR DPO certifications. That combination matters: AI governance has to be built on top of — and integrated with — the security and data protection programmes that already exist in your business. I've spent fifteen-plus years building those programmes, most recently as Head of Information Security at IFX Payments and before that as CISO at Allica Bank.

For SMEs that need AI governance built from scratch, that combination is rare and useful: the regulatory understanding to know what good looks like, the security and risk experience to integrate it without creating parallel bureaucracy, and the practical bias of someone who's actually delivered governance programmes that hold up to audit.

AI governance also rarely sits cleanly within one jurisdiction. The EU AI Act applies extraterritorially. Multinationals need a consistent approach across UK, EU, and global operations. Customer due-diligence questions cut across whichever regulatory context applies to the questioner, not just to you. I work primarily with clients across the UK and Europe, and selectively with international firms where AI governance crosses borders and that combined regulatory fluency is the work.

How engagements work

Three ways to start.

Discovery and baseline assessment

A short, fixed-scope engagement — typically two to five days — to give you a clear picture of where you are. AI inventory, risk-classification snapshot, regulatory exposure analysis, and a prioritised roadmap. Useful when you know AI governance is on the horizon but don't yet know what you're committing to.

Programme delivery

End-to-end build of an AI governance programme over three to six months: inventory, policies, controls, governance structure, training, and documentation. Sized to your business, integrated with your existing security and data protection work, and handed over with the people and processes to keep it running.

Fractional oversight

Ongoing AI governance leadership at a few days a month — for businesses that have stood up the basics but need senior accountability for risk decisions, board reporting, and continuous review. Often combined with broader Fractional CISO engagements where security and AI governance share the same advisor.

Day rate is £750–£1,250 depending on scope and engagement model. Most engagements operate outside IR35.

Get in touch

Start with a thirty-minute call.

The best place to begin is a conversation. No pitch, no obligation — just an honest discussion about where your business is on AI, what's driving the question, and whether I'm the right person to help.