AI system inventory & risk tiering
A complete register of AI systems — built, bought and embedded — classified by consequence, autonomy and affected population, with proportionate controls per tier.
Loading page content
Executive summary
AI reached production faster than governance moved with it. Most organisations cannot produce a complete list of the AI systems operating inside their business, let alone say which make consequential decisions about people. This engagement builds an AI management system aligned to ISO 42001 and the EU AI Act: inventoried, risk-tiered, evaluated, and evidenced well enough to survive a conformity assessment.
AI has moved from experiment to production faster than governance has moved with it. Most organisations we meet cannot produce a complete list of the AI systems and third-party models operating inside their business, let alone say which of them make consequential decisions about people.
That is the exposure. Not the technology itself, but the absence of any structure for deciding what is acceptable, who signed off, what the system was tested against, and what happens when it behaves unexpectedly in production.
DATATrust India builds AI governance that engineers can live with. Risk-tiered so low-stakes use cases are not smothered in process. Evidence-generating so an ISO 42001 audit or an EU AI Act conformity assessment is a reporting exercise rather than a research project. And technically grounded — we assess models, not just policies.
The AI accountability gap
Each capability below is a discrete workstream with its own owner, deliverables and definition of done.
A complete register of AI systems — built, bought and embedded — classified by consequence, autonomy and affected population, with proportionate controls per tier.
Full AIMS implementation: policy, objectives, roles, impact assessment, lifecycle controls and internal audit, sequenced toward certification.
Role determination, prohibited-practice screening, high-risk classification, technical documentation, transparency obligations and conformity assessment preparation.
Structured testing for accuracy, robustness, bias across protected attributes, prompt injection, data leakage and jailbreak resistance — with results recorded as evidence.
Oversight that functions: reviewer capacity modelling, meaningful override authority, escalation paths, and monitoring for automation bias.
Due diligence for foundation-model providers and AI-enabled SaaS, covering training data, retention, sub-processors, evaluation evidence and exit options.
Each benefit is stated with the commercial consequence attached, because a capability without a consequence is a feature list.
A complete inventory of built, bought and embedded systems, risk-tiered by consequence and autonomy with named owners.
Enterprise estates typically surface dozens of previously unknown AI tools once inventoried — a meaningful share of which should simply be switched off.
Model version, feature values and thresholds recorded per decision, so any historical outcome can be explained.
Answers the supervisory question that most model-driven businesses currently cannot.
Risk tiering so a low-stakes internal tool passes a fifteen-minute self-assessment while a credit model gets full impact assessment.
Prevents the uniform-process failure where teams route around governance entirely.
ISO 42001 management system cross-mapped explicitly to EU AI Act deployer and provider duties.
Removes a tranche of bespoke due diligence from enterprise and public-sector procurement.
Phases overlap deliberately — design begins before assessment closes, so the programme does not stall waiting for a document to be signed off.
Weeks 1–3
Find every AI system in use — including embedded vendor features and unsanctioned tools — through interviews, procurement review and network telemetry.
Weeks 3–5
Tier each system by consequence and autonomy, screen against EU AI Act categories, and assign accountable owners.
Weeks 5–12
Stand up the AI management system: policy, review board, impact assessment process and lifecycle gates proportionate to tier.
Weeks 12–24
Evaluate and red-team the high-tier systems, implement monitoring, and generate the technical documentation that certification requires.
Ongoing
Continuous monitoring for drift and incidents, periodic re-evaluation, and horizon scanning as AI regulation develops.
Named artefacts, listed in the statement of work. If it is not on this list, we will tell you before you sign rather than after.
Sector constraints change the delivery approach more than they change the obligations. These are the sectors this methodology is built around.
Fixed fee for defined scopes, retainer for ongoing services. We do not price advisory work on time and materials, because that misaligns our incentive with your outcome.
3–5 weeks
Organisations that cannot yet list their AI systems
Commercial basis: Fixed fee
12–24 weeks
Organisations building governance toward ISO 42001
Commercial basis: Fixed fee
Per system or rolling
Organisations needing independent evaluation of specific models
Commercial basis: Fixed fee per system
Every proposal states what is included, what is not, and what would trigger a change request. If the scope we recommend is smaller than the one you asked for, we will say so.
One implementation, cross-mapped. Each framework below links to its own obligations and control domains.
Specific answers about scope, timeline and what we will and will not do.
Ask a practitioner directly. First responses come from the person who would run your engagement, within one business day.
Ask a questionTurn data protection law into working product behaviour.
We map where personal data actually lives, rebuild consent and rights flows into your product, and leave you with a privacy programme that survives an audit and a board question.
Explore capabilityDefensible security, built around how your business actually loses money.
Threat-led security strategy, architecture and control design that prioritises the handful of scenarios that would genuinely hurt you — not a generic checklist of 300 controls.
Explore capabilityOne operating model for privacy, security, risk and AI accountability.
We design the committees, policies, decision rights and reporting lines that let trust obligations be managed as one programme instead of four competing ones.
Explore capabilityCombining capabilities reduces cost — the second framework typically lands at about half the price of the first.