AI Governance & ISO/IEC 42001
AI management system: scope, AI inventory, policies, roles, risk matrix, controls, evidence, indicators and management review. Led by an ISO/IEC 42001 Lead Implementer and Lead Auditor.
Corporate AI Governance
Your company already uses AI. The question is whether it governs that use.
VGrid is a boutique consultancy that turns AI governance into an operating structure: policies, roles, risk criteria, controls, evidence and continuous improvement — aligned with ISO/IEC 42001, NIST AI RMF and the EU AI Act.
What is corporate AI governance?
Corporate AI governance is the structure of policies, roles, responsibilities, risk criteria, controls, evidence and continuous improvement that lets an organisation use artificial intelligence in a safe, traceable and business-aligned way. In practice it combines ISO/IEC 42001 (AI management system), NIST AI RMF (risk function), the EU AI Act (regulatory obligations by risk tier) and data protection law such as GDPR.
Four pillars
One thesis: governance first. Everything else supports it.
AI Compliance & Regulation
Reading of regulatory impact, risk classification, documentation and technical evidence for the EU AI Act, NIST AI RMF, sector rules and privacy law. Preventive alignment, not certification promises.
AI Risk, Ethics & FATE
Fairness, Accountability, Transparency and Ethics translated into testable criteria: bias testing, human oversight, model documentation, incident handling and algorithmic bias forensics.
AI Security & Shadow AI
Visibility over unsanctioned AI use, LLM and agent attack surface, prompt injection, data leakage through AI tools, agentic AI security and control of AI gateways.
The VGrid method
Five stages, from diagnosis to a governance programme that runs on its own.
- 01
Read
Map real AI use, tools, data, vendors, exposure and regulatory obligations that already apply.
- 02
Prioritise
Classify use cases by risk and business impact, and define what has to be treated first.
- 03
Implement
Deploy policies, controls, approval flows, documentation and technical safeguards.
- 04
Govern
Operate the committee, indicators, evidence, incident handling and internal audit routine.
- 05
Evolve
Adjust the programme as regulation, models, agents and the company's AI footprint change.
Where we are usually called in
Board and executive pressure
The board asks who is accountable for AI decisions and no one has a documented answer.
Client or investor due diligence
A contract, tender or funding round requires evidence of AI governance and risk controls.
EU market exposure
Products or services reach the European market and the AI Act obligations now apply by risk tier.
Shadow AI incident
Confidential data has been pasted into public AI tools and the organisation has no visibility or policy.
Frequently asked questions
Does VGrid implement ISO/IEC 42001?
Yes. We structure and implement controls, policies, AI inventory, risk matrix, responsibilities, evidence, indicators and continuous improvement aligned with ISO/IEC 42001, with technical leadership from an ISO/IEC 42001 Lead Implementer.
Does VGrid issue ISO 42001 certification?
No. We run internal audit, readiness assessment and gap analysis against ISO/IEC 42001 with technical leadership from a Lead Auditor. Official certification is issued only by an accredited independent certification body.
What is Shadow AI?
Shadow AI is the use of AI tools outside the organisation's knowledge or control — public LLMs, copilots, plugins, agents and external platforms adopted by employees or business units without formal review by IT, security, privacy or compliance.
Does VGrid work with companies outside Brazil?
Yes. We deliver engagements in English and Spanish for organisations in Latin America, Europe and the United States, anchored on ISO/IEC 42001, NIST AI RMF and the EU AI Act.
Start with an AI governance assessment
A structured diagnosis of your current AI use, risks, tools, data, gaps and priorities — and the roadmap that follows from it.