Most AI governance is a policy document that no deployed system references. Governance that works is enforced in the architecture: what a system may do, who reviews it, and what happens when it is wrong.
A written AI policy is necessary and insufficient. It states that systems must be fair, explainable and overseen. It does not stop a team wiring an agent to a production database with write access, because nothing in the deployment path checks the policy.
Governance that survives contact with delivery has three properties. It is enforced where systems are built and deployed, not only in a document. It is proportionate to risk, so a marketing copy assistant is not subjected to the controls a credit decision needs. And it produces evidence as a by-product of operating, rather than requiring a scramble whenever an auditor asks.
The technical controls above overlap substantially with what the Act asks of high-risk systems — risk management, data governance, logging, human oversight, accuracy and robustness. Building them because they make systems work well reduces the engineering gap. It does not remove the legal obligations that sit alongside them — conformity assessment, registration, post-market monitoring, and the provider/deployer distinction — which are for your legal function to own. Our EU AI Act page covers the obligations and timelines. This is not legal advice.
Yes, which is why tiering matters. A tool that drafts internal meeting summaries should carry almost no governance overhead. Applying uniform controls is the fastest way to make governance unpopular and therefore routed around. The point of tiering is to spend the oversight budget where the exposure actually is.
A named individual with authority over the release process — in practice usually a head of engineering, a CISO, or a dedicated AI lead in larger organisations. What does not work is a committee that meets monthly and has no gate in the deployment pipeline. The ownership has to sit where the release decision sits.
We implement the technical components — inventory tooling, evaluation harnesses, trace logging, release gates — and work alongside your risk or legal function on policy. We are engineers rather than a compliance consultancy: our contribution is making the controls real in the systems, not drafting the framework document.
If your AI policy and your deployed systems have never met, that is the gap to close.
30-minute technical call · no deck
What we built, what stage it is at, and a link to the live thing wherever there is one.
yourOS is an operating system with an AI at its heart. You talk to it like a person, out loud or typed. It makes your calls, plans your days and works on your projects with a crew of agents, on your own private server. Our own product, built from the first commit; the waitlist is open.
Website, backend and app assets for Sonora, a free AI sound-therapy app on iOS and Android published by Cognitive AI.
Brand, website, prototype, apps on five platforms, the AI backend and the algorithm-intelligence pipeline for Podswap, a social growth engine that runs without a human in the loop.
In closed beta: Roxy, a private AI assistant with permanent memory running on infrastructure the user owns. Brand, site, product, backend and conversational design.
Live at coherence.com: brand identity generated with AI agents we directed, the motion system and website for the group behind Sonora, AboutAI, WakeUp and MudShadows. Agent work remains in build.
Live at domainbooth.com for DomainBooth, a premium domain brokerage: a new animated mark, every page redesigned and rebuilt with designed mobile layouts, and a custom CMS for its sales record, featured names, press and enquiries.
Apps, platforms and campaigns for these teams, long before the AI work. Every one is written up on the work page — what we did, and where our part ended.
