AI governance
Context
Organisations are adopting AI tools faster than they are documenting how they use them. Customers, funders and regulators are beginning to ask. The EU AI Act applies to UK organisations placing AI systems on the EU market or whose outputs are used there, with obligations phased in through 2026 and 2027. The ICO expects AI processing of personal data to be covered by a DPIA. Procurement questionnaires increasingly include AI questions.
AI governance review
A fixed-scope assessment producing an inventory of the AI systems you use or build, classified by risk including EU AI Act category where relevant; an acceptable use policy written for staff to follow; DPIAs where personal data meets a model; due diligence on your AI suppliers; and a short board or trustee briefing. One report, one fee.
Scope
AI use policy
What staff may and may not enter into which tools, and on what basis.
AI inventory and risk classification
A register of AI systems used or built, classified by risk (including EU AI Act category where relevant), with owner, purpose and data involved.
DPIAs for AI processing
Where personal data is processed by a model, the assessment the ICO expects.
Vendor due diligence
Assessment of AI suppliers: training on customer data, residency, sub-processors, retention.
Governance for organisations building with AI
Documentation, human oversight, logging, transparency obligations and testing evidence, proportionate to the system.
Board briefing
A session for trustees or directors on what AI adoption means for their responsibilities.
Delivery
The AI register, DPIA records and policy library are maintained in the Xelvio Toolkit alongside the data protection framework. Xelvio uses AI in its own delivery: the Toolkit’s document generator produces first drafts of policies and assessments, which are then reviewed by a practitioner. This is stated openly.
Terms
| Organisation size | Fee |
|---|---|
| Up to 25 staff | £1,500 |
| 26 to 100 staff | £2,750 |
| 101 to 250 staff | £4,500 |
Combined with the data protection review at 85% of the two fees added together. Ongoing AI governance is covered by the fractional compliance officer retainer.
All fees exclude VAT.