Explore our range of services designed to help you govern AI with confidence.
What We Offer
AI Governance Services: Nine Services across Four Tiers
Farman AI Governance is an independent AI governance consultancy that enables companies and organisations to adopt AI at scale, safely, defensibly, and without the harms, risks and losses that poor governance produces. We build AI Management Systems aligned with ISO/IEC 42001 (the international standard for AI Management Systems), the EU AI Act, and UK sector regulator expectations.
Our services are organised into four tiers, reflecting where each engagement sits in a typical AI governance journey. Each service can be scoped as standalone or as part of a wider programme. Every engagement is grounded in the ISO/IEC 42001 clause structure and controls, the AI risk management methodology of ISO/IEC 23894 (the international standard for AI Risk Management), and a working understanding of how AI systems are built, deployed, and operated in practice.
-
Short, fixed-price engagements for organisations beginning their AI governance journey or scoping a wider programme.
-
Milestone-based engagements delivering the AI Management System from design through operation. Each service can be scoped stand-alone or as part of a wider programme.
-
Independent engagements supporting ISO/IEC 42001 audit preparation and internal audit obligations.
-
Recurring engagement for organisations operating an AI Management System that has passed initial implementation.
Entry engagements
These entry engagements give you a clear read on where you stand and what to do next. Both are fixed-price and delivered within four to six weeks.
-
A structured decision-support session for boards and executive leadership teams navigating AI governance, risk and regulatory questions. Delivered on-site or remotely in half-day or full-day formats, each session is tailored to the organisation’s AI exposure, strategic priorities and regulatory context.
Going beyond the general training and awareness, the briefing equips leaders to exercise informed oversight of AI. Sessions typically address the evolving AI regulatory landscape; the organisation’s role, obligations and exposure; options for governance structures and accountability; and the questions leaders should ask of executive teams, technology suppliers and other relevant stakeholders.
-
A scoped, time-bounded diagnostic engagement that establishes the organisation’s current AI governance position against the relevant requirements and controls of ISO/IEC 42001 and the AI risk-management guidance in ISO/IEC 23894. It identifies priority gaps, maps the capability and roles required to address them, and sets out a phased AI governance roadmap. Typically delivered over four to six weeks.
Deliverables include a current-state gap analysis mapped to the relevant ISO/IEC 42001 clauses and controls; a target operating-model, capability and role map; and a phased roadmap with sequencing, dependencies and indicative effort. Where relevant, the same output includes an assessment of applicable EU AI Act obligations.
Core implementation
Milestone-based engagements that design, implement and operationalise the AI Management System. Each service can be scoped as a standalone engagement or as part of a wider programme.
AIMS Design & Implementation
End-to-end design and implementation of an AI Management System, delivered against agreed milestones. Engagements are normally scoped from the Gap Assessment and typically run from three to nine months, depending on organisational complexity, AI exposure and existing management-system maturity.
The work can include AI strategy and policy refinement; governance-framework design; procedures and risk-management processes; control selection and implementation; documentation aligned with ISO/IEC 42001; role and accountability design; and internal training and awareness sessions. Delivery is structured to support ongoing operation, independent internal audit and, where pursued by the client, external certification.
AI Risk & Impact Assessment
A structured assessment of AI-related risks and impacts across the organisation’s AI estate, including internally developed systems, third-party AI services and unmanaged AI use. The output informs the AI risk register, risk-treatment decisions and control selection within the AI Management System.
Assessments are structured around the AI risk-management requirements of ISO/IEC 42001 and informed by the AI-specific risk-management guidance in ISO/IEC 23894. Impact assessment is tailored to the organisation’s role, intended use, affected stakeholders and operating context. Third-party and supplier AI risk is considered as an integral component, recognising that a significant part of an organisation’s AI exposure may typically arise through vendors and supply chains. The service can be delivered as part of AIMS Design & Implementation or as a standalone engagement for organisations that have established an AIMS but need to resource and operationalise it.
AI Governance Operating Model & Role Design
Design of the roles, decision rights, responsibilities, accountabilities and capabilities required to operate the AI Management System sustainably. The engagement addresses the questions often left unresolved by the implementation programmes: who performs the work day to day, who makes which decisions, and how AI governance responsibilities should be embedded within the organisation’s existing roles and structures.
Deliverables can include an AI governance operating-model diagram, RACI matrix, role definitions, decision-rights framework, capability-gap analysis, and recommendations for role changes, hiring or reassignment. The service can be delivered as part of AIMS Design & Implementation or as a standalone engagement for organisations that have established an AIMS but need to resource and operationalise it.
EU AI Act Readiness
Practical support for organisations assessing and preparing for applicable obligations under the EU AI Act (Regulation (EU) 2024/1689). The engagement considers the organisation’s role in the AI value chain, the types of AI systems it develops, provides, deploys or uses, and the obligations and implementation timetable relevant to those activities.
Work can include AI system classification, high-risk use-case assessment, conformity-assessment planning, governance and documentation readiness, and prioritised implementation planning. The service can be delivered as a standalone engagement where the EU AI Act is the primary driver, or alongside AIMS Design & Implementation where an organisation is building broader AI governance capability.
Assurance
Engagements supporting ISO/IEC 42001 audit readiness and, where Farman has had no role in designing or implementing the AIMS, independent internal audit.
ISO/IEC 42001 Audit Preparation
A fixed-price pre-certification readiness engagement delivered before an external certification audit. It can include a mock audit against relevant ISO/IEC 42001 requirements and applicable controls, interview preparation, evidence and documentation review, identification of remaining gaps, and a prioritised remediation plan.
The service can be delivered as a continuation of AIMS Design & Implementation or as a standalone engagement for organisations preparing for certification. It supports audit readiness; it is not an external certification audit or a legal opinion on compliance.
Independent Internal Audit
An independent internal audit of an existing AI Management System, conducted against agreed audit criteria and with reference to ISO/IEC 42001 internal-audit requirements and ISO 19011 auditing guidance.
Farman does not conduct internal audits of AI Management Systems that it has designed or implemented. This protects the objectivity and impartiality expected of credible internal-audit activity. The service is available only where Farman has had no role in designing or implementing the AIMS under review.
Ongoing advisory
Recurring advisory support for organisations operating and continually improving an AI Management System after the initial implementation.
AI Governance, AI Risk Posture Review & Horizon Scanning
A monthly advisory retainer supporting the ongoing operation and continual improvement of an AI Management System. It combines periodic AI risk‑posture review, governance advice and tailored horizon scanning across relevant UK and European regulatory, standards and policy developments.
The engagement typically includes a scheduled monthly review of governance actions, changes in AI use, risk posture and emerging issues; ad‑hoc advisory support between reviews, including guidance on AI incidents, control failures and regulatory queries; input preparation and recommendations to support periodic management review of the AIMS; and quarterly summary reporting with recommended updates to the AIMS, risk treatment and governance priorities.
The service can be delivered as a light‑touch continuation following an intensive Farman engagement, or as a standalone advisory arrangement for organisations whose AIMS was implemented by another party.
Let’s Work TogetherTo discuss whether any of these services fit your organisation, or to book an initial conversation, please get in touch.