AI governance
Inventories, risk tiers, accountability and oversight that line up with the EU AI Act and ISO/IEC 42001, sized to your organization.
AI & cybersecurity governance advisory
Your AI has a story. Let’s make sure it holds up.
We help organizations govern AI and secure it, then explain it clearly to boards, regulators and customers.
Fade in:
Int. Boardroom — Monday, 9:02 AM
The CEO slides a printout across the table. Twelve AI tools nobody approved.
CEO
(calmly, which is worse)
Who signed off on the chatbot?
Silence. Someone checks their phone. The customer data is in a prompt log.
Cut to: shpil.ai
Fluent in
- EU AI Act
- ISO/IEC 42001
- NIST AI RMF
- ISO/IEC 27001
- NIS2
- DORA
- GDPR
- OWASP LLM Top 10
What we do
The short spiel
AI is moving faster than most governance programs. We close that gap with practical controls, sensible policy and security that actually reaches your models. Then we help you tell that story with confidence, whether the audience is an auditor or your own board.
Cybersecurity governance
Board-level security programs, risk management and compliance across ISO/IEC 27001, NIS2 and DORA, without the shelfware.
Securing AI itself
Prompt injection, data leakage, model supply chain and shadow AI. The risks that sit between your AI team and your security team.
Who we are
Storytellers with a risk register
shpil.ai is a boutique advisory firm working where artificial intelligence, cybersecurity and regulation meet. We’ve sat on both sides of the table: building security programs and answering to auditors.
Most frameworks fail because nobody can explain them. We write governance people can read, controls teams can run, and board updates that fit on one page. We read the fine print so your story doesn’t end in it.
- Rule 1No jargon without a translation.
- Rule 2Plot before paperwork. Understand the business first.
- Rule 3Security is a main character, not a cameo.
Contact us
Tell us your story so far
A rough draft is fine. Share where you are with AI and security, and we’ll come back with how we’d write the next chapter.
Services
The full spiel, in four acts.
Each service stands on its own, and together they follow the arc of a real governance program: from first look to happily ever audit.
- Act IFind out what you have
- Act IIFind out what could go wrong
- Act IIIWrite the rules
- Act IVKeep the story straight
Want every scene, task and deliverable? Read the AI Gov Plan →
ActI
The Opening Line
AI governance readiness assessment
We map every AI system in use, including the ones nobody told IT about. Then we classify each one against EU AI Act risk tiers and benchmark your governance maturity against ISO/IEC 42001 and the NIST AI RMF.
Spoiler: shadow AI is already in the building.
- AI system register
- Risk-tier map with EU AI Act obligations
- Maturity scorecard
- 90-day roadmap
Runtime2–4 weeksBest forGetting started
ActII
Plot Holes
AI & cyber risk gap analysis
We threat-model your AI systems using the OWASP LLM Top 10 and MITRE ATLAS, and test your security controls against ISO/IEC 27001, NIS2 or DORA. Third-party and vendor AI risk is in scope too.
Every good story has holes. Better we find them than an attacker does.
- AI threat model per critical system
- Control gap assessment
- Prioritized risk register
- Remediation plan with owners
Runtime3–6 weeksBest forBefore launch or audit
ActIII
The Rulebook
Policy & framework design
We write the policies, roles and processes that make governance real: who approves new AI use cases, how models are monitored, and what happens when something goes wrong. Built to be audit-ready and readable.
Rules people actually read. Yes, really.
- AI acceptable-use policy
- Governance charter and RACI
- Model lifecycle controls
- AI incident response playbook
Runtime4–8 weeksBest forBuilding the program
ActIV
Sequel-Proof
Ongoing advisory & board briefings
A fractional AI governance and security lead on retainer. We review new AI use cases, track regulatory change, and brief your board each quarter, so the next chapter doesn’t come as a surprise.
No cliffhangers. Just happily ever audit.
- Monthly advisory hours
- Quarterly board briefing
- Regulatory watch summary
- New use-case reviews
RuntimeMonthly retainerBest forStaying ahead
Book a service
Pick your act. We’ll handle the script.
Choose one or more services and tell us a bit about your situation. We’ll reply with a proposed scope and timeline.
AI Gov Plan · our playbook
The whole script, not just the trailer.
This is how we run an AI governance engagement, from the first inventory to audit-ready evidence. It works the same whether you run on AWS, Azure, Google Cloud, OpenAI, Anthropic, open-source models or all of them at once.
Protect the data.Limit who, and what, can act.Watch what actually happens.Prove the controls work.
Scene 1
Why AI changes the plot
AI rarely creates a brand-new risk. It speeds up the ones you already have. Access that was always too broad becomes easy to exploit, because an assistant can search, summarize and act on it in seconds.
Before AI
An employee could open an overshared file, but they would probably never find it.
With AI
Assistants and agents find, combine, draft and call tools on the user’s behalf. Whatever access exists today now moves much faster.
Five exposures we look for first
Oversharing
Files, sites and mailboxes that too many people can reach, now surfaced by search and chat.
Sensitive data
Personal, financial or confidential data pasted into prompts, or exposed in generated answers.
Agent authority
Agents and connected tools that can send, change or delete things with a user’s permissions.
Public AI
Personal accounts, browser extensions and free chatbots used outside any agreement or control.
Weak evidence
Logs nobody reviews and alerts nobody owns, so nobody can show that a control works.
Our first move is to find the control that failed. Buying another product comes later, if at all.
Scene 2
The framework, four layers deep
Principles are only useful if something puts them into practice. Each layer below turns the layer above it into practice, all the way down to the tools you actually run. The links between layers are many-to-many. One control can serve several principles.
Layer 1Principles
Layer 2Governance pillars
Layer 3Capability families
Layer 4Your stack, whatever it is
Layer 3 is where most of the work happens, and it’s what the four acts below deliver. Layer 4 changes from client to client. We map each capability to the controls your own platforms offer, so the plan never depends on one vendor.
Your provider runs
The platform
- Service boundaries
- Platform security
- Contractual protections
You configure
The controls
- Identity and permissions
- Data labels and loss prevention
- Sharing settings
- AI feature settings
You operate
The governance
- Risk decisions and approvals
- Training
- Incident response
- Evidence
Secure by design doesn’t make you secure by configuration. Neither one makes you secure in operation. We work on all three.
Scene 3
The playbook, act by act
The same four acts as our services, now with the detail: what each act sets out to do, the capability families it covers, the tasks we carry out with your team, what you receive, and how we know the act is finished.
Know what AI you have, who owns it, what data it can reach and which rules apply.
What we do
- Agree the charter. Mandate, scope, executive sponsor and the roles who will make decisions.
- Find all the AI in use. Approved tools, AI features inside your SaaS, internal models, agents and MCP servers, plus shadow AI: personal accounts, browser extensions and public chatbots.
- Register every system, model and agent with a named owner and a stated purpose.
- Assign a risk tier based on impact and likelihood, and note the EU AI Act category where it applies.
- Map what AI can reach. Effective permissions on repositories, sites and mailboxes, and where oversharing is concentrated.
- Build the obligations inventory. Regulations, contracts and sector rules, plus the anchor framework: ISO/IEC 42001, NIST AI RMF, or both.
- Score maturity for each of the 10 capability families on a 0–3 scale.
What you get
- AI system register
- Risk-tier map
- Data exposure heat map
- Obligations inventory
- Maturity scorecard
- 90-day roadmap
Curtain call
Every AI system has an owner and a tier, and leadership has agreed on the top five gaps.
Find where AI could leak data, act beyond its authority or fail an audit, before someone else does.
What we do
- Set the risk taxonomy and rate each tiered system for inherent risk, control strength and residual risk.
- Threat-model the high-tier systems. Attack surface, abuse cases, prompt injection and jailbreak paths, data poisoning and model theft.
- Review identity and authority. Human access, agent and service identities, credentials, tool and MCP permissions, and privileged access.
- Trace the sensitive-data path. What goes into prompts, what comes back out, and where outputs are stored and shared.
- Assess AI vendors. Due diligence, data-use and training rights, audit rights, breach terms, and where models and APIs come from.
- Test the systems. Evaluation criteria and benchmarks, robustness and adversarial testing, and bias testing wherever decisions affect people.
- Crosswalk the findings to your obligations and to the standards in Scene 5.
What you get
- Threat models for high-tier systems
- Risk register with residual ratings
- Identity & tool-authority review
- Vendor risk assessments
- Test report
- Prioritized remediation plan with owners
Curtain call
Every high-tier risk has an owner, a target control and a due date.
Turn the findings into policies people follow and controls that actually run.
What we do
- Write the policy set. AI acceptable use, a standard for building and buying AI, and an exceptions process.
- Set decision rights. Governance body, RACI, approval gates for each risk tier, and an escalation path.
- Fix data access before expanding AI. Clean up oversharing, apply sensitivity labels, add loss prevention and masking, and set retention rules.
- Constrain identities and agents. Least privilege for people and agents, an agent registry, credential rotation, tool allow-lists with scopes, limits on autonomy, and human approval for high-impact actions.
- Put runtime guardrails in place. Input checks for personal data and prompt injection, output checks for leakage and harmful content, quotas and budgets, a tested kill switch, and a human review queue.
- Update vendor contracts. Data rights, audit rights, breach notification, and exit and migration terms.
- Write the AI incident playbook and run one tabletop exercise.
- Train people by role: users, builders and approvers.
What you get
- AI policy set
- Governance charter & RACI
- Tiered approval workflow
- Control and guardrail design
- AI incident response playbook
- Role-based training
Curtain call
Controls are configured, owners have signed off, and the first new use cases have gone through the approval gates.
Show the controls work in practice, and keep them working as your AI changes.
What we do
- Log what matters. Prompts, tool calls and decisions for high-tier systems, kept for as long as your obligations require.
- Track telemetry and KRIs. Usage, cost, guardrail hits, blocked actions and incidents, with thresholds that trigger action.
- Keep it traceable. Model and prompt versions, data lineage and a change log.
- Tune the guardrails based on what they catch and what gets through.
- Recertify systems on a schedule, and retire the ones you no longer need.
- Watch vendors and regulators. Vendor posture, change alerts and incidents, plus a horizon scan of new rules and case law.
- Run independent reviews of high-tier systems, with documented challenge and sign-off.
- Assemble audit packs and brief the board every quarter.
What you get
- KRI dashboard
- Audit-ready evidence packs
- Recertification log
- Regulatory watch summary
- Quarterly board report
Steady state
The program produces evidence as it runs. Nobody has to assemble it in a rush the week before an audit.
Scene 4
The full cast: 10 capability families
These are the building blocks behind every act. Each family breaks down into five control areas. This is the reference we use to scope work, score maturity and track progress. It’s a representative set, not an exhaustive control list.
I Lead act
II Also covered
III Not in this act
01Governance workflow
IIIIIIIVWho decides, by what rules, and how the decision is recorded.
- Program charter
- Mandate · scope · roles
- Policies & standards
- Policy set · standards · exceptions
- Decision rights
- RACI · approval gates · escalation
- Issue management
- Intake · triage · remediation
- Assurance evidence
- Attestations · records · audit trail
02Third-party assurance
IIIIIIIVThe AI you buy carries risks you don’t directly control.
- Due diligence
- Questionnaires · security review · privacy review
- Contracts
- Data rights · audit rights · breach terms
- Provenance
- Model source · API inventory · data origin
- Monitoring
- Posture · change alerts · incidents
- Exit
- Continuity · migration · offboarding
03Asset inventory
IIIIIIIVYou can’t govern AI you haven’t found.
- Intake
- Use-case request · owner · purpose
- Registration
- Systems · models · agents
- Risk tiering
- Impact · likelihood · tier
- Tier-based detail
- Tier controls · data map · dependencies
- Lifecycle
- Change log · recertification · retirement
04Risk & compliance
IIIIIIIVKnow which risks matter, which rules apply and when they change.
- Risk taxonomy
- Categories · scenarios · materiality
- Assessment
- Inherent · control · residual
- Obligations
- Regulatory inventory · crosswalk · case law
- Key risk indicators
- Metrics · thresholds · triggers
- Regulatory change
- Horizon scanning · litigation · updates
05Data & privacy
IIIIIIIVFix data access before AI makes exposure easier.
- Data quality
- Completeness · accuracy · timeliness
- Lineage
- Source · flow · transformation
- Classification
- Labels · sensitivity · handling rules
- Protection
- Encryption · masking · loss prevention
- Privacy
- Consent · minimization · retention
06Identity & access
IIIIIIIVLimit what users, agents and tools are allowed to do.
- Human identity
- Provisioning · authentication · leavers
- Agent identity
- Agent registry · credentials · rotation
- Authorization
- Role-based · attribute-based · least privilege
- Tool & MCP authority
- Allow-lists · scopes · approvals
- Privileged access
- Just-in-time · session control · reviews
07Model, system & agent security
IIIIIIIVDefend the AI itself, not just the network around it.
- System & use case
- Attack surface · abuse cases · boundaries
- Prompt defense
- Injection · jailbreaks · isolation
- Model integrity
- Poisoning · theft · watermarking
- Agent controls
- Bounds · tools · autonomy
- Supply chain
- Provenance · dependencies · AI bill of materials
08Testing & validation
IIIIIIIVTesting, evaluation, validation and verification: confirm the AI does what it should, and nothing it shouldn’t.
- Evaluation
- Criteria · test data · benchmarks
- Bias testing
- Subgroups · disparity · remediation
- Robustness
- Stress · drift · adversarial
- Explainability
- Rationale · limits · documentation
- Independent review
- Challenge · sign-off · defects
09Runtime protection
IIIIIIIVControls that act in the moment: on the prompt, the response and the action.
- Input guardrails
- Policy · personal data · injection shields
- Output guardrails
- Harmful content · leakage · format
- Rate & cost
- Quotas · throttling · budgets
- Kill switch
- Trigger · disable · restore
- Escalation
- Queue · human review · decision
10Observability & evidence
IIIIIIIVShow how controls are configured and how the AI really behaves.
- Logging
- Prompts · tool calls · decisions
- Telemetry
- Usage · latency · cost
- Traceability
- Lineage · versions · trail
- Dashboards
- KRIs · trends · heat maps
- Audit packs
- Export · validation · retention
Scene 5
Source material: the standards we map to
No single framework covers everything. Management-system standards are strong on governance and weak on runtime attacks. Security catalogs are the reverse. We combine them so each capability rests on the reference that covers it best.
Primary reference
Supporting reference
— Little or no coverage
| Capability family | ISO/IEC 42001 & 27001 | NIST AI RMF & CSF | EU AI Act | OWASP LLM, Agentic & MCP | MITRE ATLAS |
|---|---|---|---|---|---|
| 1 Governance workflow | — | ||||
| 2 Third-party assurance | |||||
| 3 Asset inventory | |||||
| 4 Risk & compliance | — | ||||
| 5 Data & privacy | |||||
| 6 Identity & access | — | ||||
| 7 Model, system & agent security | |||||
| 8 Testing & validation | |||||
| 9 Runtime protection | — | ||||
| 10 Observability & evidence |
This is our working view of where each reference is strongest. For a regulated client we add sector rules, such as DORA, NIS2 or HIPAA, to the obligations inventory in Act I.
Scene 6
The paper trail: how we prove it
Every control we put in follows the same five-part thread. That lets anyone, whether an auditor, a regulator or your board, follow a risk all the way to the evidence that it’s handled. Here is a real-world example.
1 · Risk
What could go wrong
A sales assistant can read the CRM and send email. It could send a customer list to an outside address.
2 · Capability
Where it’s controlled
Identity & access (tool authority) and runtime protection (output guardrails).
3 · Owner
Who answers for it
Head of Sales Operations owns the use case. IT security owns the control.
4 · Test
How we check it
In a test environment, we prompt the agent to forward customer records to an external address. It should be blocked and logged.
5 · Evidence
What we keep
The blocked-action log entry, the quarterly tool-permission review and the signed test record.
Risk → capability → owner → test → evidence. If one link is missing, the control isn’t finished.