Bespoke AI governance, with method and evidence.

VGrid is a consultancy in AI governance. The work covers gap analysis against ISO/IEC 42001, maturity diagnosis, drafting of AI use policies, implementation of the AI management system (AIMS), integration with ISO/IEC 27001, ISO/IEC 27701 and data protection law, survey of applicable regulatory requirements, mapping of ungoverned AI use, security applied to AI systems and autonomous agents, internal audit and continuous operation of governance.

It is the structure of policies, roles, responsibilities, controls, risk assessment, records and periodic review that allows an organisation to describe, justify and verify its use of artificial intelligence. Usual references are ISO/IEC 42001, the NIST AI RMF and the legislation applicable to each case.

They are references of different natures, used together. ISO/IEC 42001 is the international AI management system standard, certifiable by an accredited body. The NIST AI RMF is a voluntary risk management framework, with no certification, organised in the Govern, Map, Measure and Manage functions. The EU AI Act is a European Union regulation that applies according to the organisation's role, the use and the classification of each system. In practice, the management system organises policies and evidence, the framework structures risk assessment, and the regulatory assessment defines obligations. Implementing the standard does not by itself guarantee compliance with legal requirements.

No. Certification is issued exclusively by an accredited certification body. VGrid works on readiness assessment, gap analysis, implementation of the management system and internal audit, with formal separation between who implements and who audits.

Implementation is building the management system: inventory, policies, roles, controls and records. Readiness is the assessment against the requirements of the standard before an external audit. Internal audit is the periodic verification required by the standard itself, conducted independently from execution.

It is the use of AI tools without prior technology, security, privacy or compliance assessment. It happens, for example, when business units contract AI services on their own or process corporate data in external tools without a recorded authorisation criterion.

Yes, in the sense of surveying applicable requirements, applicability matrix, documentation and controls. The EU AI Act is Regulation (EU) 2024/1689, with subsequent amendments. In Brazil, PL 2338/2023 is a bill in progress, approved by the Senate and under analysis in the Chamber of Deputies. Informative content does not replace legal analysis of the specific case. Cut-off date: 2 August 2026.

No. VGrid structures criteria, documentation and shared routines so that those functions can decide on AI use from the same information base.

Yes. Training tracks on AI governance and risk for leadership, technical teams and legal, privacy and compliance functions, plus content on acceptable use and data protection in AI tools.

With an initial assessment that identifies AI systems in use, owners, relevant risks, documentary gaps and priorities. From there it is possible to define scope, sequence and contracting format.