AI governance framework

Your AI moves at machine speed. Your AI governance can too.

Cleared to act. Ready to prove it.

CRISAM® AI Governed Autonomy is an AI governance framework for organisations that let AI make material decisions. People set the purpose, the boundaries and who can stop a system. Within those boundaries, AI works at its own speed, and the evidence builds up as it runs.

Get the whitepapers Find your route

Credit pre-approvalOwner: Head of Lending, within risk appetite

Cleared

Claims triageThreshold crossed, escalated to the claims director

Held

Fraud screeningModel updated, evidence refreshed

Cleared

Example values

Find your route

Three roles. One framework.

Which one describes you? Start where you stand.

Consulting partners01

“I advise organisations on risk and AI.”

Turn AI governance into a practice

Brokers and MGAs02

“I broker or underwrite risk.”

Make AI risk insurable with evidence

Risk, compliance and AI leaders03

“I’m responsible for AI risk in my organisation.”

See how the framework works

Why AI governance needs a new model

AI decides in milliseconds. AI governance still meets once a quarter.

Credit, fraud, pricing, claims, complaints: AI now makes or prepares decisions that matter. Thousands happen between two board meetings. The accountability stays with the board.

AI decisionsContinuous, at machine speed

GovernanceReports at the reporting date

Banning AI is not realistic. Letting it run without adapted governance isn’t either. The question is how you stay in control without slowing AI down to human speed.

What governed autonomy changes

One question decides trust in AI. Governed autonomy answers it.

“Can this organisation show that its AI was under control, yesterday and today?”Boards ask it. Advisers ask it. Insurers ask it.

Without a framework: evidence is reconstructed after the factWith governed autonomy: the evidence is already there

Before a board meeting or an audit

Evidence is pieced together from screenshots, emails and spreadsheets.

The evidence has built up while the AI ran. It is ready to show.

A model is updated

Last quarter’s test no longer describes the model that is live today.

The change is linked to its risks and controls, and fresh evidence follows.

A threshold is crossed

Nobody is sure who is allowed to stop the system.

A named owner holds it, within boundaries agreed in advance.

Human authority, not human approval: that is governed autonomy.

Four building blocks

An AI governance framework that works at machine speed

The CRISAM® AI Governed Autonomy framework keeps organisations in control of AI without slowing it down. People set purpose, permission, boundaries, intervention and accountability. AI acts within those boundaries. Every material AI decision is linked to its risks, obligations, controls and evidence, and that evidence is produced in operation, not only at the reporting date.

Five decisions always stay with people

Human authority

The AI may make the decision. A person owns the authority under which it is made.

The result: It is always clear who decides, and who can stop a system.

More oversight where more is at stake

Proportionate oversight

Not every AI use case needs the same oversight. Materiality decides: impact, reversibility, uncertainty, velocity and scale.

The result: Close oversight where a lot is at stake, speed where it is safe.

One model around each decision

Connected control

The parts of governance usually exist. What is missing is the connection. The anchor is the decision, not the technology.

The result: One answer for the board instead of five separate reports.

Evidence built while AI runs

Continuous assurance

Yesterday’s test doesn’t describe today’s model. Evidence is produced in a loop, every time something changes.

The result: Proof that is current, not reconstructed the night before.

What does the framework mean in your role?

Consulting partners Brokers and MGAs Risk, compliance and AI leaders

The pace of AI adoption

Use is growing faster than governance

AI is already part of everyday operations. Governance and access controls often follow later.

0%

of organisations regularly use AI in at least one function

McKinsey, The state of AI in 2025

0%

are experimenting with or scaling AI agents

McKinsey, The state of AI in 2025

0%

of breached organisations had no AI governance policy, or one still in development

IBM, Cost of a Data Breach Report 2025

0%

of AI-related incidents involved systems without appropriate access controls

IBM, Cost of a Data Breach Report 2025

Whitepaper series

Three board level thought papers on AI Governed Autonomy

The Machine Speed Governance series asks how a board stays in control when AI decides faster than any person can follow, and answers it in three steps.

Cover of Paper One in the CRISAM® AI Governed Autonomy whitepaper series: The Control Question Facing Every Board — Paper OneThe Control Question Facing Every Board

Cover of Paper Two in the CRISAM® AI Governed Autonomy whitepaper series: Governed Autonomy: The Control System for the Machine Speed Enterprise — Paper TwoGoverned Autonomy

Cover of Paper Three in the CRISAM® AI Governed Autonomy whitepaper series: Continuous Assurance for the Machine Speed Enterprise — Paper ThreeContinuous Assurance for the Machine Speed Enterprise

01Why oversight falls behind adoption, and the board control test
02Five non-delegable decisions and the GRC control plane
03The half life of assurance and a ninety day route to continuous assurance

Get all three papers

Fill in the form. All three PDFs open straight away, and we send the links to your inbox.

Questions

AI governance framework: common questions

Your question isn’t here? Talk to us

What is CRISAM® AI Governed Autonomy?

CRISAM® AI Governed Autonomy is an AI governance framework for organisations that let AI make material decisions. People set the purpose, the boundaries and who can stop a system. Within those boundaries, AI works at its own speed, and the evidence builds up as it runs.

Who is the framework for?

For organisations that let AI make or prepare material decisions, and for the consultants, brokers and MGAs who advise, cover or assess them. Each group has its own route into the framework.

What is an AI governance framework?

An AI governance framework sets out how an organisation stays in control of AI across all systems and regulations. The CRISAM® framework is built on governed autonomy: people set purpose, permission, boundaries, intervention and accountability, AI acts within those boundaries, and evidence is produced continuously while it runs.

How does the framework relate to the EU AI Act?

The EU AI Act sets out what has to be done for each AI system. The framework sets out how an organisation stays in control across all AI systems and all regulations, including DORA, NIS2 and the GDPR. Each new obligation is attached to existing records instead of starting a new project.

Does every AI decision need human approval?

No. When AI makes thousands of decisions a day, approving each one creates delay, not control. The framework requires that every material AI system has a named owner who sets its boundaries and can intervene, and that the form of oversight matches what is at stake.

Does an organisation have to replace the tools it already uses?

No. AI models, data platforms, monitoring and ticketing stay in place. CRISAM® connects their signals with purpose, risks, obligations, controls, evidence and the person who can intervene.

How does an organisation get started?

With three to five material AI decisions, not every use case at once. In 90 days they are identified, connected to their risks, obligations and controls, monitored and tested, and summarised in a first board report.