Fractional AI Governance
AI adoption is moving faster than most organizations' ability to govern it — tools get adopted department by department, with no consistent policy, no risk review, and no one accountable for what happens when a model gets something wrong. I build AI governance programs that keep pace: policy, risk criteria, and the training that makes both actually get followed, not just filed. I built Autodesk's third-party AI risk criteria and 3-year AI risk strategy — this isn't a framework borrowed from a webinar, it's been run inside a real third-party risk program at scale.
What this covers
AI use policy development
Clear, enforceable policy on what AI tools are approved, what data can touch them, and who signs off — written to actually be followed, not shelfware.
More on this →AI risk criteria & model risk assessment
Structured criteria for evaluating AI tools and vendors before they're adopted, the same discipline behind Autodesk's third-party AI risk program.
AI governance program design
Intake, approval workflows, and ongoing oversight — the operating structure a policy needs to actually function day to day.
Training & enablement
Getting policy out of a document and into how people actually use AI day to day, sized to the organization, not a generic compliance video.
Vendor & third-party AI risk
Evaluating AI capabilities embedded in vendor products, not just the tools the organization adopts directly.
More on this →Executive & board reporting on AI risk
Translating AI adoption and risk posture into language leadership can act on, as regulatory and customer expectations around AI governance keep rising.
Who this is for
Organizations adopting AI faster than they're governing it — where different teams are already using AI tools without a consistent policy, no one owns AI risk review, or a customer or vendor security questionnaire just asked an AI governance question nobody had an answer for. Especially relevant for organizations that already have, or are building, a broader GRC program and need AI treated as a first-class risk category within it, not bolted on separately.
Take the AI Readiness Assessment
A free, ten-question self-assessment covering process discovery, security maturity, and AI strategy — a useful starting point before scoping a full governance program.
Take the AI Readiness Assessment →Let's talk about ai policy, program & training
I take on a limited number of clients at a time so every engagement gets real attention. Reach out to discuss scope, cadence, and fit.
Book an introductory call