AI governance that helps you scale, not slow down
The companies getting the most from AI aren't the ones with the fewest rules. They're the ones with clear ownership, controls and oversight. We help you build that.
The problem
AI tools and agents are being deployed faster than anyone is governing them. Without an inventory, clear owners and controls on what agents are allowed to do, risk grows quietly and scaling stalls. Regulators are also moving: financial institutions, government entities and companies selling into Europe all face new expectations.
What the research says
of AI's financial returns are captured by just 20% of companies.
Source: PwC, AI Performance Study (2026)
AI leaders are 1.7x more likely to have a formal responsible AI framework.
Source: PwC, AI Performance Study (2026)
AI leaders are 1.5x more likely to have a cross-functional AI governance board.
Source: PwC, AI Performance Study (2026)
What the AI governance program covers
-
AI inventory and risk classification
A register of every AI system and agent in use, with risk levels and owners.
-
Policies
Acceptable use, data handling, model selection and human oversight policies written for how your teams actually work.
-
Governance structure
Roles, approval paths and a cross-functional oversight group.
-
Agent controls
Permission scoping, audit logs, human approval checkpoints and escalation rules for AI agents.
-
Regulatory mapping
Your controls mapped to the frameworks and regulations that apply to you.
-
Monitoring and audit trail
Evidence that controls are working, ready for internal audit or a regulator.
-
Shadow AI discovery
Find the AI tools and agents staff already use without approval, then bring them into the register or retire them.
-
AI literacy training
Role-based training so people understand the AI they use and oversee. Under the EU AI Act this has been a duty since 2 February 2025.
-
Impact and data protection assessments
AI impact assessments and data protection impact assessments for the systems that need them.
-
Vendor and third-party AI risk
Due diligence questions and contract terms for the AI built into the software you buy.
-
Fairness, transparency and human oversight
Checks for bias, clear disclosure when people are dealing with an AI, and named people who can override it.
-
AI incident response
A plan for when an AI system or agent gets it wrong: who is told, what is switched off, and what is recorded.
Deliverables
- AI system register with risk classification
- Policy set and governance charter
- Agent control design and implementation guidance
- Regulatory mapping document and gap list
Who it's for
- Banks, insurers and payment providers licensed by the Qatar Central Bank
- Companies deploying AI agents with access to real systems and data
- Companies selling AI products or services into the European Union
- Organizations preparing for ISO/IEC 42001
Frameworks and regulations
Qatar Central Bank AI Guideline
Applies to QCB-licensed entities. Requires a defined AI strategy, a dedicated function overseeing AI systems, risk assessment, and QCB approval before deploying certain AI systems, with stricter requirements for high-risk ones.
Qatar NCSA Guidelines for Secure Adoption and Usage of AI
Voluntary national guidance covering governance, controls and testing across the AI lifecycle.
EU AI Act
General-purpose AI model obligations have applied since August 2025. Following the Digital Omnibus, obligations for high-risk AI systems now apply from 2 December 2027 (standalone systems) and 2 August 2028 (systems embedded in regulated products).
NIST AI Risk Management Framework
ISO/IEC 42001
AI management systems.
EU AI Act: obligations already in force
Prohibited AI practices and the AI literacy duty have applied since 2 February 2025. Transparency duties, such as telling people they are interacting with an AI, apply from 2 August 2026.
NIST AI 600-1
The Generative AI Profile of the NIST AI Risk Management Framework.
Qatar Personal Data Privacy Protection Law
Law No. 13 of 2016, which governs the personal data your AI systems process in Qatar.
Qatar MCIT guidelines for ethical AI
National guidance on developing and deploying AI responsibly.
Saudi Arabia: SDAIA AI Ethics Principles and the PDPL
Principles for responsible AI and the Personal Data Protection Law that applies to the data behind it.
UAE Personal Data Protection Law
Federal Decree-Law No. 45 of 2021, for personal data used by AI systems in the UAE.
We prepare your organization, controls and documentation. We are not a law firm and do not issue certifications; we work alongside your legal counsel and certification body.
How we work
-
Scoping call
We learn how you use AI today and agree what matters most.
-
Fixed-scope assessment
A defined assessment with a clear deliverable, so you know the cost upfront.
-
Implementation
We fix what we find, alongside your team.
-
Ongoing support (optional)
Monitoring, reviews and retesting as your AI use grows.
AI governance and compliance questions
We're small. Do we need this?
If you use AI with customer data or let agents take actions, yes, in proportion. Governance for a 50-person company is a few clear policies and controls, not a bureaucracy.
Does this make us compliant?
It makes you ready. Compliance decisions involve your legal counsel and, where relevant, your regulator or certification body. We provide the controls, documentation and evidence they need.
Was the EU AI Act delayed?
Partly. High-risk system obligations moved to December 2027 and August 2028, but general-purpose AI obligations and most transparency obligations were not delayed.
How long does it take?
It depends on how many AI systems you run and which regulations apply. We confirm scope and timeline after a scoping call.
Does the EU AI Act apply to companies outside the EU?
It can. It covers companies that place AI systems on the EU market or whose AI output is used in the EU, wherever they are based. If you sell AI products or services to European customers, assume it applies until it has been checked.
What is shadow AI?
AI tools and agents that staff use without approval, often with company data pasted into them. It is usually the first risk an AI inventory finds.
What is ISO/IEC 42001?
The international standard for an AI management system, published in 2023. Certification is carried out by an accredited certification body; we prepare your policies, controls and evidence for that audit.
Ready to see where you stand?
Book a free scoping call. We'll tell you honestly whether this is a fit.