Know which AI your company uses, what it does, and who watches it

Somewhere in your company, AI is already running. A colleague summarizes client calls with ChatGPT. The sales support team uses a tool that reads orders from PDFs. A chatbot on the website was switched on by a vendor years ago. Nobody knows exactly what data passes through, who checks the results, or what to say when a client or a regulator asks. AI governance answers those questions. You record what is running, agree who watches it, and test regularly whether it still does what you think.

Which AI is already running in your company

We start with an inventory. Not of what you have planned, but of what is in use today: separate subscriptions, features switched on in Exact or AFAS, scripts a developer once built, and tools that employees use privately for their work. In most companies with 10 to 100 people, we find more systems than management expects. For each system, we note what data goes in, where the model runs, who sees the result, and which decision depends on it.

This register is the basis of everything that follows. Without an overview, you cannot write rules or test anything. If you have just had an AI process scan, we use that process map as the starting point and add what it did not cover.

A register, rules, and someone who watches

Governance sounds like a policy binder that nobody reads. We keep it practical: a register you can maintain yourself, rules of a few pages at most, and one responsible person per AI system. The rules answer concrete questions. Which data may go to a model, and which may not? When must a person check the result before it goes to a client? What do you do when the model produces something wrong, and who do you tell?

We also set up the technology that makes the rules checkable: logging of what a model saw and answered, version control of prompts and models, and an isolated environment inside the EU for everything that processes personal data. If we build a solution ourselves through AI implementation, this is included as standard. For systems you already have, we add it.

An audit that looks at what the model really does

A model that worked well at delivery does not stay that way by itself. The input changes, a vendor quietly switches to a new model version, or employees start using the tool in ways nobody intended. So we test regularly, usually every quarter or half year. We take a sample of real input and output. We measure how often the model gets it wrong, whether those errors are more common for certain clients or documents, and whether anyone noticed.

The result is a short audit report in plain language: what works, what deviates, and what you need to change. If a model turns out to perform consistently worse on your kind of documents, fine-tuning on your own data is often the next step. If a tool turns out to send more data than you thought, we tell you right away and help you restrict or replace it.

What the EU AI Act asks of you, without panic

The EU AI Act sorts AI applications by risk. A tool that summarizes PDFs falls into a different class than a system that pre-selects job applicants or assesses creditworthiness. For most applications in a small or mid-sized company, the requirements are manageable: know what you use, be open about it with clients and employees, and make sure a person can step in. The higher risk classes add documentation, logging, and a risk assessment.

We classify every system in your register, record what you must arrange for each class, and make sure the documentation is ready before anyone asks for it. This builds on what you often already do for the GDPR, and for healthcare organizations on NEN 7510, the Dutch information security standard for healthcare. If you want a formal review or a certification, this fits with our GDPR compliance and ISO 27001 and NEN 7510 services. We make sure the AI side is right. You are, and stay, the owner of the register, the rules, and the reports, even if we never speak again.