Getting AI governance in order before anyone asks for it

For a regulated firm, AI governance and compliance have to be sorted before AI goes anywhere near client work, which makes them part of the groundwork of every implementation. That groundwork also has to adapt as regulation changes, so the firm always knows which of its solutions to review and improve. Laura Pappi and Hilary Roberts, two of the co-founders of Veritas Fox, an AI governance consultancy in London, set out the same view in two conversations with us this autumn.

Laura is the chief executive and a certified ISO/IEC 42001 Lead Implementer, with years of leadership in technology and a long stretch in financial services. Hilary is the chief technology officer and has written code for some of London's best-loved software companies. Veritas Fox helps smaller businesses get their AI governance in order.

Governance means a written record, kept from the first solution

The EU AI Act, Hilary explained, applies if you do business in the EU, and for the uses it counts as high risk "you have to keep a register of your models and what the risks are and what the controls are." ISO 42001 asks for that across everything: "it doesn't really tell you what you can or can't do with AI, but it just tells you you have to write down a bunch of stuff for all of your AI systems, including what the risks are." The record also has to answer a question Hilary put simply: "Who is in charge of each system?"

That record is the firm's answer when a client, its insurer or a regulator asks how it uses AI, and it is far easier to keep from the start. Laura expects firms that already hold ISO 27001 to look at ISO 42001 "in the next year or two", and "if they start doing the work now, it's a lot less work later." Pieced together afterwards, the record falls on the partners and managers who know what each tool does, and none of those hours are chargeable.

So governance and compliance are checked before any solution goes on the roadmap, risks are designed out before each one is implemented, and the firm's AI policy addresses the regulators that apply to it. Every solution belongs to the named person whose work it supports, and as it goes live it enters a register of what kind of solution it is, who owns it and how to turn it off. Some risks only appear once people start using a solution.

A tool's risk is set by how people use it

For anyone working in the EU, Laura pointed out, "any HR or any tools that are considered to help decision-making in terms of employees could go into that category", meaning high risk, and the intention doesn't settle it: "even if you haven't built it for that reason, if your customer uses it for the reason of potentially making HR decisions, it's classified as high risk."

A solution set up to help a manager with routine work can move into a higher risk class if someone starts using it to judge staff, and the firm carries that exposure whether it meant to or not. Laura's suggestion was a disclaimer in the solution saying it isn't intended as an HR tool, so any solution near decisions about staff says so. It is one more risk we design out before going live, which depends on knowing how the work happens day to day.

A firm can only govern the AI it knows about

Laura named a limit in Veritas Fox's own work: "we have to trust what the client says to us." A question the team is asked quite often, "How do I use AI with my customer service? Where does the data go?", is hard to answer, she said, "if they don't tell you all the case scenarios."

We have the same limit, so we ask leadership, each department head and each person in the team what data they work with, which AI tools they use and whether client data goes into them, because what leadership thinks happens and what happens day to day can differ.

The answer to "where does the data go?" decides how each solution is implemented. It runs on the AI provider's own cloud only when nothing sensitive is involved, on the firm's own server where the provider never trains on what it sends, or on a machine in the office where the data never leaves the building. The tools people already use are brought inside the AI policy, and a named person checks outputs before anything reaches a client.

To see where client data goes in your own firm today, the quiz below takes a few minutes.

The groundwork has to change as the rules do

"More regulations will come because that's the trend," Laura said. Hilary named two things to have in place now: AI literacy training for everyone, which Hilary described as an EU obligation, and an AI policy: "you need to have one. You need to have management sign it off."

Each new rule leaves a regulated firm with a question to answer quickly: which of its AI solutions does this touch? Without a record, the firm has to go back through all of them, taking its most senior people away from client work. A register of every solution, the data it touches and who owns it shows which ones a change affects, and those are reviewed and improved first, with the AI policy updated alongside them. Each solution is also checked and tweaked as the models change, and because the firm owns its knowledge and isn't tied to one AI vendor, it can move a solution to another model, its own server or a machine in the office when a rule requires it.

If your firm is about to write that policy, we've laid out what a CPA firm's AI policy should say, from approved tools and client data to billing and who signs it off.

What firm leaders should do now

Put together, these points set out the order a regulated firm needs to follow, whoever does the work.

Start with the firm's own work, broken down into the individual tasks and processes that create value for its clients: who does each one, how long it takes, what data it uses and who signs it off.

Before any solution, check the layers those tasks sit on: the business and each department, the tech stack, the quality, completeness and security of the data, compliance and governance, and the people who will work alongside the AI. Where a layer isn't ready, fixing it comes first.

Then set out a roadmap of solutions, each fully costed with the hours it frees up, what it costs to implement, its first-year return and what it does to the recovery rate, the share of recorded time the firm bills, on the jobs it touches.

Implement the solutions one by one, in the roadmap's order, each run where its data allows, with its risks designed out, covered by the AI policy, entered in the register and owned by a named person who checks its output before it reaches a client. Once they are live, keep managing them as the models and the rules change, with the firm owning its knowledge and renting the AI.

Done in that order, the firm gets more capacity from the same team in a way that is compliant, keeps client data secure and gives it a clear answer whenever a client, its insurer or a regulator asks how it uses AI.

See where your firm stands

Our quiz asks which AI your team uses, where client data goes, what your clients have been told and who checks the work. Your report shows where your firm stands today and gives you a 30-day plan to make its AI safe with client data.

If you want our support putting it in place, book a free call.