Skip to content

AI Governance & Risk

Independent, senior-level advice to help boards and leadership teams use artificial intelligence responsibly, with clear accountability, proportionate controls and effective oversight.

Book a ConsultationHow We Can Help
AI Governance & Risk

Governing AI as a Business Risk

South Africa & United Kingdom

Artificial intelligence is now part of how many organisations operate, from everyday productivity tools to systems that support decisions about customers, employees and transactions.

Used well, it can improve efficiency and insight. Without clear governance, it can introduce risks the board may not see: inaccurate or biased outputs, misuse of personal or confidential information, reliance on third-party providers and decisions that are difficult to explain.

Widbrook Consulting helps organisations bring their use of AI within their existing risk management and governance arrangements, so that it is understood, proportionately controlled and overseen at the right level.

How We Can Help

How We Can Help

AI Governance Frameworks

Establishing policies, roles and accountabilities for the use of AI, including an inventory of where AI is used and its integration with your Risk Management Framework and risk appetite.

AI Risk Assessments

Assessing governance, operational and regulatory risks associated with specific uses of AI, including considerations relating to accuracy, fairness, transparency, data protection and security, and recommending proportionate controls.

Board & Executive Advisory

Helping boards and leadership teams understand where AI is used, what could go wrong and the questions to ask, supported by reporting that enables effective oversight.

Third-Party & Vendor AI

Due diligence questions, contractual considerations and ongoing oversight for AI-enabled products and services provided by third parties.

Independent AI Governance Reviews

Assessing existing arrangements against recognised frameworks and good practice, such as ISO/IEC 42001 and the NIST AI Risk Management Framework, with prioritised recommendations.

AI in Financial Crime Compliance

For accountable institutions using automated screening, monitoring or verification tools, helping ensure their use is reflected in the RMCP, overseen by management and supported by appropriate records.

Regulatory Context

A Changing Regulatory Landscape

AI regulation is developing at different speeds in different jurisdictions. Organisations operating in, or serving, more than one market need to understand which expectations apply to them.

South Africa

There is no AI-specific legislation yet, but existing obligations apply. Section 71 of the Protection of Personal Information Act restricts certain solely automated decisions that have legal or similarly significant effects, and the King V Code expects governing bodies to oversee the ethical and accountable use of AI. A national AI policy is being redrafted.

United Kingdom

The UK relies on existing law and regulators rather than a single AI statute. Data protection law applies to AI that uses personal data, and financial services firms remain accountable for AI under existing frameworks, including the Consumer Duty and the Senior Managers and Certification Regime.

European Union

The EU AI Act can apply to organisations outside the EU where their AI systems, or the outputs of those systems, are used in the EU. Requirements are being phased in, with obligations for high-risk systems due to apply from December 2027 and August 2028.

Position as at October 2026. This is general information, not legal advice.

Working With Us

Working With Widbrook on AI

AI Governance & Risk Advisory

South Africa & United Kingdom

Who We Work With

Boards, executive teams, risk and compliance functions and business owners in organisations that are using, buying or planning to use AI, whether or not they operate in a regulated sector.

Our Approach

Our approach is practical and proportionate. We focus on governance, risk and accountability rather than technical development, and wherever possible our work builds on your existing risk management, data protection and compliance arrangements, so that AI is governed in the same way as other significant risks.

Where specialist technical, legal or data science input is needed, we will say so.

What You Can Expect

Depending on the agreed scope, deliverables may include an AI policy and governance framework, an inventory of AI use, risk assessments for priority use cases, board reporting and a prioritised implementation plan.

Engagements are individually scoped, with deliverables, timelines and fees agreed in writing before work begins.

Book an Initial Consultation
In Practice

Five Questions Boards Should Be Asking About AI

A starting point for a board or leadership discussion.

01

Where are we using AI today, including within the tools and services we buy?

02

Who is accountable for each use of AI, and for its outcomes?

03

How do we know the outputs are accurate, fair and explainable?

04

How is personal and confidential information protected?

05

How would we know if something went wrong, and what would we do?

Next Step

Let’s Discuss Your Requirements

Whether you are beginning to use AI or want an independent view of your existing arrangements, the first step is a conversation.

We offer a complimentary 30-minute initial consultation to understand your requirements and explore how Widbrook Consulting may be able to assist.

Book a Consultation