do you implement the audit logging or just specify it?

specify it. implementation belongs in a build or embedded engagement alongside the governance work. many clients commission both in sequence — policy first, build second.

what regulations does the framework cover?

we write against the obligations relevant to your business: gdpr, eu ai act, fca guidance, hipaa, uk dpa 2018, sector-specific codes. we are not a law firm — the document is built to be actionable by your counsel.

can this run in parallel with an active build?

yes, and often it should. governance that trails the build creates risk. we feed governance requirements directly into the technical design.

govern

policyand auditbefore the model runs.

ai governance and policy design as a standalone engagement. written policy framework, audit-log architecture, incident-response procedure, rollback plan.

book a 30-min call

what you get

3–4

weeks scope, draft, review, deliver

written framework your legal team can sign off on

law-firm fees — we write to be actionable by your counsel

what we ship

01
map
one week. interview legal, compliance, it, ops. map data flows, in-scope systems, regulatory obligations.
02
draft
one to two weeks. first draft of policy framework, audit-log spec, incident-response procedure.
03
review
up to two structured review rounds. we incorporate feedback; we push back where a change would create a compliance gap.
04
deliver
complete written deliverable. readout with leadership, legal, compliance. optional annual review retainer.

what it costs

discovery call

30 minutes. bring the regulatory or board requirement. scope on the call.

faq

a few common questions.

sag uns, was dugeliefert brauchst.

30-min-call buchen

policyand auditbefore the model runs.

map

draft

review

deliver

a few common questions.

sag uns, was dugeliefert brauchst.