Your teams already use AI, from Copilot to customer-facing agents. I help you put the right controls on each use: light where the risk is low, rigorous where AI makes decisions that matter.
Tier 1
Staff drafting emails and summaries with Copilot or ChatGPT
AI policy and approved tools, an AI register, risk and supplier checks, data rules, AI literacy
Tier 2
A chatbot answering customers from your knowledge base
Adds impact assessment, testing before release, monitoring and logs, internal audit
Tier 3
An agent that updates records in your ERP or CRM
Adds human approval before high-impact actions, fallback and recovery, technical documentation
Tier 4
AI that screens job applicants or scores credit
Adds the EU AI Act high-risk duties: quality management, conformity assessment and, where required, registration and a fundamental rights impact assessment
Most AI governance programmes go wrong in one of two ways. Some are a single policy that auditors won’t accept. Others apply the same heavy process to every tool, so teams work around it.
GovernAInce looks at each AI use case on its own and sets controls in proportion to its risk. You spend effort where it matters, and every decision is written down with its reasoning, ready for an auditor, a regulator or a customer’s security questionnaire.
A short questionnaire and call about your size, your AI use and the rules you answer to. You get a fixed quote.
We map your AI use across the sources we agree with you, including AI built into the software you already buy, and record what was covered.
Each use case gets its tier and its legal role under the EU AI Act, such as deployer or provider.
Your current controls are compared with the standards you choose. You can focus on one, such as only the EU AI Act.
A prioritised plan, with the reasoning and evidence behind every control kept for later reviews and audits.
Typically 2–4 weeks, fixed price
The starting point for most clients. You get:
Typically 6 weeks to 5 months, depending on your AI use and the rules you answer to
Policies, roles, processes and controls built to the tier of each use case: AI risk management, an AI register, data rules, human oversight, monitoring and incident handling.
AI security testing is available as a separate project, delivered by a dedicated testing team.
Five questions, about two minutes. You get an indicative view of your AI risk tiers, the rules that probably apply and the service that fits. Your answers stay in your browser; nothing is sent unless you choose to email them to me.
One control model, mapped to the frameworks your auditors and customers ask about, so you build once and show compliance many times.
Linked to your existing obligations under NIS2, DORA and GDPR where they apply, to the Cyber Resilience Act for products with digital elements, and to EIOPA’s expectations for insurers.
GovernAInce is run by Dmytro Sirosh, a CISM-certified security leader with more than 20 years in security operations, architecture and compliance across telecom, banking and IT services.
I work remotely with clients in the EU and the Gulf, and travel for workshops where being in the room helps.
We’ll go through where you use AI, what’s expected of you, and the two or three gaps to close first. No slides.