01 · Question
AI governance you can show, not just describe
Heedward helps companies whose product or operations rely on AI — whether they built it or bought it — build AI governance that holds up under the EU AI Act: an ISO/IEC 42001 management system and the evidence behind it, so you can show your work, not just describe it.
Questions worth asking yourself before someone else does
02 · The problem
Someone will ask how your AI decisions get made
AI-generated content
- What most teams have
- A line in a policy doc saying users are told.
- What actually answers it
- The specific screen, the specific release, and proof it shipped.
AI risk ownership
- What most teams have
- A name in a slide who "owns" it.
- What actually answers it
- A record of what that person actually decided, and when.
What gets logged
- What most teams have
- An assumption someone would notice if something went wrong.
- What actually answers it
- What was actually logged last month, not what would be logged in theory.
The question is whether you'll be describing it from memory, or showing them.
You don't have to have built it to be the one who answers for it
If your product or your operations use AI someone else built — a vendor's model, a plugin, an integrator's work — the questions still land on you. Not on them.
Quick self-check
Where do you stand today?
Five things worth knowing before someone asks. No score, no form — just a count, so you can see it for yourself.
03 · What we do
AI governance, and the evidence to show for it
AI governance is still a young field, with different starting points — the OECD AI Principles, NIST's AI RMF, ISO/IEC 42001. We build on ISO/IEC 42001 because it's the one with an actual management system behind it: audits, evidence, and a certification path, not just a set of principles. We help you build that system so it fits how your company actually works, and we assemble the evidence that a customer, a certification body or your own board can review.
Where a control matches something your systems already record (access, changes, model versions, monitoring), we draw the evidence from those records instead of asking someone to write it down. That is a method and a set of scripts, not a product, and it covers part of the standard, not all of it.
Three examples, from our own playbook
AI system inventory
- Usual evidence
- A spreadsheet somebody updates.
- What we produce instead
- Generated from the model registry or deployment pipeline.
Human oversight
- Usual evidence
- A policy saying a human reviews edge cases.
- What we produce instead
- Override rate, decisions reviewed, time-to-review — measured.
Output marking (Art. 50)
- Usual evidence
- "We mark our outputs."
- What we produce instead
- A repeatable test that marking survives export and re-encoding.
04 · How we work
Three steps, fixed in writing
Scope
We agree in writing what is in and what is out, before anything starts.
Build
We set up the system and gather the evidence with your team. You keep doing your work.
Hand over
You receive an evidence package that is ready for review, and a system your team can maintain.
Fixed fee. Fixed scope. Exclusions named up front.
05 · Offers
What you can buy
Trust Pack
One live questionnaire, answered and backed by evidence, in ten working days.
ISO/IEC 42001 AI management system
Two doors — ISO 27001 holders and the full programme — each starting with a fixed-fee gap phase.
Article 50 Transparency Check Providers only
Does your AI-generated output still carry its marking after export and re-encoding? Five working days, before 2 Dec 2026.
AI Literacy Day Add-on
One working day, by role, that ends with an AI inventory, named owners and your own questionnaire answers.
06 · Terms
Simple, predictable
Fixed fee per offer, agreed in writing before work starts.