AI governance & assurance · UK regulated firms
Where your AI exposure needs attention first.
Your teams are already using AI in day-to-day work. We find where it creates regulatory, client or operational exposure, establish the evidence, and tell you what needs attention now, and what can wait.
60–90 minutes. No fee. No obligation. You leave with a first readout.
- 01Independent human judgementA named person signs every readout.
- 02Evidence behind every findingEvery point traces back to something you recognise.
- 03No maturity scoreA clear order of what to do, not a number.
Sound familiar?
Nobody wakes up wanting AI governance. They wake up to a question they can’t answer yet.
Different teams are using five different AI tools, and nobody has the full list.
A client questionnaire has asked how you use AI, and nobody can answer it with confidence.
A board member has asked: “Do we know where AI is being used?”
A client wants evidence of how you control AI before they renew.
Someone has found client information going into an AI tool.
A team wants to use a new AI tool, and nobody knows who should sign it off.
Strict AI bans don’t stop AI use. They just stop you seeing it.
What changes when you work with us
Know where AI is actually being used.
Every workflow that uses AI, mapped: who uses what, with which data, and who checks it.
Know where you’re exposed.
Each exposure sorted by who can hold you to it: a regulator, a client contract, or your own business.
Know what to deal with first.
A signed readout of what needs attention now, what comes next, and what can safely wait.
Who can hold you to it
Every rule and requirement that applies to you is sorted by who can enforce it, so you know what to deal with now and what to plan for.
Enforceable now
UK GDPR, and your sector’s existing rules; in financial services, Consumer Duty and SM&CR already apply to AI. A regulator can act today, whether or not anything has gone wrong.
From a stated date
The EU AI Act. Parts already apply; high-risk obligations follow from December 2027 and August 2028, depending on the type of AI and how it’s used. We establish whether, and when, it applies to you.
Through contract
ISO/IEC 42001 and your clients’ own requirements. No fine, but it shows up in due-diligence questionnaires and tenders.
What you can’t yet see
Nobody enforces it, and nobody will ask. Client data in free AI tools, one supplier carrying critical work, nobody left who can do the job by hand.
Often the most expensive category, and the reason to use a person rather than a product.
A readout of where your attention belongs
After every engagement, starting with the free first session, you receive a signed readout: where your AI work sits, what’s open at each of the four levels, and where attention belongs first, next and later. Early sessions cover less ground; the readout grows as the work does.
Behind it sits a dated record of the evidence for every point, ready when a client or regulator asks.
Example readout
Where Contoso’s attention belongs
Two critical claims workflows act without a person. The regulated exposure is current, not future: focus there first, then on ownership and supplier continuity.
- Focus now Regulatory position
- Focus now Permissions and oversight
- Focus next Ownership, suppliers, culture
Engagement readout · Contoso Insurance
Where Contoso’s attention belongs
Contoso Insurance is an invented company.
Contoso’s AI use is concentrated in Claims, where two critical workflows act on the claims system without a person. The regulated exposure is current, not future: focus there first, then on ownership and supplier continuity.
Where the AI work sits
Two workflows act without a person. Both are critical.
- Claims triage (critical)ClaimsA person checks the AI's work: none.
- Fraud flagging (critical)ClaimsA person checks the AI's work: none.
- Claim lettersClaimsA person checks the AI's work: lightly.
- Chat repliesCustomer serviceA person checks the AI's work: lightly.
- Campaign copyMarketingA person checks the AI's work: lightly.
- Settlement offers (critical)ClaimsA person checks the AI's work: every time.
- Risk summariesUnderwritingA person checks the AI's work: every time.
- Policy wording draftsUnderwritingA person checks the AI's work: every time.
- Complaint responsesCustomer serviceA person checks the AI's work: every time.
Critical, as recorded
Not yet recorded: 1 claims workflow. Finance: no AI workflows recorded.
- 1Regulatory positionOpen controls: enforceable now 11 · from a stated date 4 · through contract 7 · what you can’t yet see 3Focus nowConsumer Duty applies today to two claims workflows.
- 2Permissions and oversightActs without a person 2 · checked lightly 3 · reviewed every time 4 · permissions agreed 3Focus nowThe two that act alone are both critical.
- 3OwnershipWorkflows: owner named 5 · no owner 3 · not recorded 2Focus nextTools are owned; the work they do is not.
- 4Supplier dependenceVendors 4 · due diligence submitted 1 · continuity submitted 0Focus nextOne supplier carries all claims drafting.
- 5DataAI steps touch personal, special category and commercial data · class not recorded 2Keep watchingNo attention suggested where recorded; two steps not yet classified.
- 6Culture and trustNo recorded facts. Judgement only.Focus nextStaff use AI openly; leadership hasn’t said what’s allowed.
It is a record, not a certificate. Ignivara iQ does not certify, audit or confirm compliance.
How we think
We do not score.
A score tells you how you compare. It doesn’t tell you what to do on Monday. We started with a scoring framework and replaced it: areas to examine rather than a rating.
Evidence and judgement.
Every finding traces back to evidence you recognise, and a named person signs and dates the judgement. You can challenge any of it.
What needs attention first.
Not a longer list. A clear order: what to deal with now, what comes next, and what can safely wait.
Case study · A UK language-services company
The company wanted to build its own agentic AI tools. We raised 28 items across today’s regulation, future obligations and client contracts, worked through each one, and set out a roadmap to close them.
Read the case study →Who it’s for
UK firms of 20–250 people where AI is in daily use and there’s no dedicated AI governance team: insurance brokers, law firms, financial services and specialist services firms. Usually it’s the managing partner, COO or compliance lead who has been asked about AI and needs a clear answer.
Sectors: financial services and insurance broking →Begin with a single workflow.
60–90 minutes on one piece of your own work, free. You leave knowing where to look first.
60–90 minutes. No fee. No obligation.