Legal will not approve AI until someone explains the risk.
What it costsEvery AI project stalls at the last step.
What changesAn AI policy, risk tiers and approval rules agreed with legal before the first build.
Agentic OS · AgentsAI Transformation · Security, Privacy and AI Governance
AI your legal, risk and audit teams can sign off.
AI touches personal data, makes decisions and acts in your systems. We build the privacy programme, security controls and AI governance that let your General Counsel, Chief Risk Officer and Head of Internal Audit say yes, and give them the evidence to prove it later.
Five areas, one control set
- PrivacyGDPR, CCPA, DPDP and more
- ConsentCaptured, honoured, provable
- SecurityVAPT for web and mobile
- IdentityAccess and Microsoft 365 hardening
- AI governancePolicy, tiers and ISO 42001
- EvidenceReady for audit and regulators
Mapped to the laws in the markets you operate in
Written for
General Counsel, Chief Risk and Compliance Officers, Heads of Internal Audit, DPOs and CISOs
The question you came with
What do we need in place before we let AI act on our data and our customers?
Part of Enterprise AI Transformation
What gets it signed off. The policy, risk tiers, consent checks and evidence that let legal, risk and audit approve each agent.
See the whole programmeWhat is blocking sign-off
If two of these are true, the rest of this page is about you.
New data protection deadlines are coming.
What it costsGDPR, US state laws, India's DPDP and others all differ, and new deadlines keep arriving.
What changesOne programme mapped to GDPR, US state laws, DPDP, PDPL and others, with owners and dates.
Agentic OS · ContextNobody can show which AI tools touch customer data.
What it costsShadow AI, and no answer when the regulator asks.
What changesAn inventory of every model, agent and tool, with its data, owner and risk tier.
Agentic OS · PulseSecurity testing happens once, before launch.
What it costsVulnerabilities appear with every release.
What changesSecurity built into delivery, with testing on a schedule and before every major release.
Agentic OS · LoopThe control set for AI in production
What we put in place, and who signs each part.
- Control 01 · Inventory
Every model and agent registered
Owner, purpose, data used, systems touched and risk tier, kept up to date. Signed by the CIO.
- Control 02 · Policy and tiers
What agents may do alone
Permissions written as testable limits, with approval required above each tier. Signed by legal and risk.
- Control 03 · Data and consent
Personal data used lawfully
Purpose, consent and retention checked before an agent reads personal data. Signed by the DPO.
- Control 04 · Evidence
An audit trail auditors accept
Every action logged with input, policy version and approver, retained with the record. Agreed with internal audit.
- Control 05 · Off switch
Tested before go-live
A named person can pause any agent quickly, with a plan for work in progress. Tested and timed.
What we build
The capability on the left, what your team would notice on the right.
- Privacy
Data protection compliance programme
Gap assessment, records of processing, notices, rights handling and breach procedures for GDPR, US state laws, LGPD, POPIA, DPDP, PDPL and others.
- Consent
Consent management and privacy engineering
Consent captured, stored and checked in every system, including by agents, before data is used.
- Testing
Application security testing
Vulnerability assessment and penetration testing for web and mobile apps, with fixes verified.
- Identity
Identity and Microsoft 365 hardening
Access, conditional access and data loss prevention set up before Copilot or agents reach your files.
- Delivery
Secure SDLC and threat modelling
Security and privacy impact assessments built into how products and agents are designed and released.
- AI governance
AI policy and ISO/IEC 42001 readiness
Agent inventory, risk tiers, approvals, audit trails and model evaluation, aligned to ISO 42001 and the EU AI Act.
What stays yours
We build and hand over
- Policies, registers and procedures
- Test reports and remediation evidence
- Control mappings to each law and standard
You keep and control
- Your data and your systems
- Your certification and audit relationships
- Admin access, in your name
How an engagement runs
The same four steps whatever we build. The first one is small, fixed-fee and useful on its own.
Fixed-scope offers
Fixed scope, a set timeline and a deliverable you keep. The quickest way to start.
Assess
AI Governance and ISO 42001 Readiness
A signed AI policy, an agent inventory with risk tiers, and a plan to ISO/IEC 42001 readiness
- Time
- 4 weeks
- Price
- Fixed fee, agreed on a call
- For
- General Counsel, Chief Risk and Compliance Officers, Heads of Internal Audit and DPOs
The problem. AI projects stall at sign-off because there is no agreed policy, no inventory and no evidence model.
What happens, week by week
- Week 1Inventory and gap assessment
Every model, agent and AI tool in use, its data and owner, and a gap assessment against ISO 42001 and the laws in your markets.
- Week 2Policy and risk tiers
A draft AI policy with permission levels, approval thresholds and a three-tier risk model, workshopped with legal and risk.
- Week 3Evidence and controls
The audit trail, evaluation and off-switch controls each tier needs, agreed with internal audit.
- Week 4Plan to readiness
A dated plan to ISO 42001 readiness and to the deadlines that apply to you, such as DPDP and the EU AI Act.
You get
- AI inventory with owners and risk tiers
- Draft AI policy and approval model
- Control and evidence matrix
- Dated readiness plan
Who signs off
General Counsel, Chief Risk or Compliance Officer, Head of Internal Audit, and the CIO or CISO
What we need from you
A sponsor in legal or risk, and a list of AI tools and projects in use
Pilot
Microsoft 365 Copilot Rollout
Copilot rolled out safely: permissions fixed first, then adoption by role
- Time
- 6 to 8 weeks
- Price
- Fixed fee, agreed on a call
- For
- CIOs, CISOs and heads of digital workplace
The problem. Copilot can see everything a user can see. Overshared files and loose permissions become a data leak the day it is switched on.
What happens, week by week
- Weeks 1 to 2Readiness and oversharing review
Permissions, sharing links, labels and data loss prevention reviewed across SharePoint, OneDrive and Teams.
- Weeks 3 to 4Harden
Oversharing fixed, sensitivity labels and access policies applied, and Copilot settings configured.
- Weeks 5 to 6Pilot by role
A pilot group per role, with prompts and use cases built for their actual work.
- Weeks 7 to 8Roll out and measure
Wider rollout with recorded training, and adoption measured by team.
You get
- Oversharing and permissions review
- Labels, DLP and access policies applied
- Role-based use cases and training
- Adoption report by team
Who signs off
CISO for security settings, CIO for rollout, and the DPO for personal data
What we need from you
Admin access to Microsoft 365, and a pilot group from each role
Not sure where to start? Begin with the AI Transformation Review: two to three weeks, $1,500, credited to month one.
Questions
Are you a law firm?
No. We build the programme, controls and evidence, and work alongside your legal team or external counsel, who give the legal advice.
Which laws and standards do you cover?
GDPR, US state privacy laws, LGPD, POPIA, India's DPDP Act and Saudi and UAE PDPL, plus ISO/IEC 42001, the NIST AI RMF and the EU AI Act.
Can you get us ISO 42001 certified?
We prepare you for certification: the management system, controls and evidence. The audit itself is done by an accredited certification body.
Where should we start?
With the AI Governance and ISO 42001 Readiness offer. It gives you a gap assessment, a draft policy and a plan in a few weeks.
Keep going
Where Security, Privacy and AI Governance fits your industry, what to read next, and the tools involved.
Industries we do this in
Playbooks
Tools we review for this
AI transformation for the agentic engine era
Start with a fixed-fee AI transformation review. We map your systems, data and teams against the six layers of Pegasus Agentic OS and name the first workflows to hand to agents. You keep the findings whether or not you work with us.