Model and use-case inventory
What exists, who owns it, what data it touches, what decision it affects and when it was last reviewed.
AI Capabilities & Services
Data & AI Governance
Policies, lineage, and controls that keep your data and AI trustworthy and compliant.
The problem
AI arrives in an organisation faster than the controls around it. Within a year there are models in production nobody has inventoried, staff pasting confidential material into consumer tools because the approved path is slower, and no answer to the question a regulator or a customer will eventually ask: on what basis was this decision made, and who is accountable for it. Policy alone does not fix this — a rule that bans the only practical way to do the work gets routed around.
Who this is for
- Risk, compliance and auditAn inventory, a control set and evidence that both are real
- CIOs and data leadersA sanctioned path that is faster than the unsanctioned one
- Executive sponsors of AI programmesTo know the exposure before somebody else finds it
What people use it for
Risk tiering
Proportionate control: a drafting assistant and a credit decision should not carry the same process.
Data classification and permitted use
What may go where, with an approved route for the work people are already doing another way.
Audit readiness
Being able to reconstruct a decision — inputs, model version, approver and date — after it has been challenged.
What it needs to work
- Your existing policies, risk framework and approval routes
- An honest account of what is actually in use, including the unsanctioned
- The regulations that apply in each market you operate in
- Access to the teams building and using AI, not only to the policy owners
How it works
-
Discover what exists
Models, tools, assistants and spreadsheets doing model-like work — including the ones nobody registered.
-
Tier by risk
By what the output affects, not by how sophisticated the technology is. A simple model deciding eligibility outranks a complex one drafting text.
-
Define proportionate controls
Approval, testing, human review, logging and review frequency, scaled to the tier rather than applied uniformly.
-
Provide the sanctioned path
The approved tool, the approved data route, and the approval that takes days rather than quarters. Controls people can follow are the only ones that work.
-
Monitor and review
Scheduled review by tier, drift monitoring on live models, and a route for reporting a wrong output.
How we deliver it
-
Assessment
Current state against the regulations that apply to you, with the gaps ranked by exposure rather than by count.
-
Operating model
Who approves what, at which tier, and how quickly — designed so the sanctioned path is the path of least resistance.
-
Controls and inventory
The register, the control set, the templates and the evidence trail, populated with what you actually have.
-
Embed and train
Training the people who build and the people who approve, because a framework nobody was taught is a document.
Where it runs
- Aligned to your existing risk and change frameworks rather than parallel to them
- Tooling on your platforms, with the register wherever your controls already live
- Per-market variation where regulation differs
Security and governance
- Proportionality: the control matches the consequence
- A named accountable owner for every model in production
- Decisions affecting people are explainable and contestable
- Evidence generated by the process rather than assembled before an audit
Timeline
Discovery and risk tiering come first and move quickly, because the value is in finding what nobody had listed. The operating model takes as long as your approval culture takes to agree — and embedding it is continuous, not a phase. A framework delivered and not used is the most common outcome in this field, so the engagement is designed to end with people trained rather than a document delivered.
What you receive
- A model and use-case register, populated
- A risk-tiering method and the control set for each tier
- Data classification and a documented permitted-use route
- Approval workflow, templates and the evidence trail
- Training for builders, approvers and reviewers
What this does not do
This is not legal advice, and it does not certify you as compliant with anything — that determination belongs to your counsel and your regulator. It also cannot succeed as a policy alone: unless the sanctioned path is genuinely faster than the workaround, staff will keep using the workaround, and no amount of framework changes that.
Questions we are asked
Will this slow our AI programme down?
Tiering exists precisely to stop that. Most use cases are low-consequence and should pass through a light, fast route; the heavy process is reserved for the few decisions that warrant it.
Staff are already using consumer AI tools. What do we do?
Give them an approved alternative that does the job, then enforce. Enforcement without an alternative moves the behaviour out of sight rather than stopping it.
About the figures on this page
This page describes capability and method. It does not publish accuracy figures, throughput numbers or delivery dates, because those depend on your data, your systems and your scope — and a number published here would be wrong for most readers. You get them, in writing and against your own data, at scoping.
A first call is a technical conversation, not a pitch: what you have, what you need, and whether this is the right approach at all.
Built on the Unified Intelligence Layer
Every InsAI product runs on the same four-stage backbone.
- 1
Data Integration
ERP · IoT · BIM · CRM
- 2
AI Models & Predictive Engines
Forecasting, detection, optimization
- 3
Automation & AI Agents
Acting on predictions, end to end
- 4
Real-time Dashboards & Decision Systems
From the floor to the boardroom
Data & AI Governance
Policies, lineage, and controls that keep your data and AI trustworthy and compliant.