Governance that goes beyond compliance

A triage-style 90-minute assessment of the prerequisites for agentic AI, giving you a complete and systematic view of your firm’s readiness, its strengths, and weaknesses – strategic, technical and operational, and organisational. A written report follows within 48 hours, ready to share with your line manager, Head of AI, or CRO. This independent, cross-platform, and risk-led diagnostic will let you set evidence-based and achievable goals for your agentic transformation.

A structured 7-step workflow-level risk assessment that ensures you embed your necessary risk controls into your agentic workflow. Delivered using Gerido©, this service will identify the agentic risks in a planned workflow, design risk treatment plans, and map the necessary agentic KRIs. Culminating in a CRO-ready risk report, you will avoid post-deployment remediation costs, speed up your build cycle, and gain a defensible answer to a regulator’s question, “How did you select the controls for your agentic workflow?”

A facilitated working session of up to 8 hours for function leaders, followed by a written programme initiation plan that converts agentic AI from a technical topic into a clearly defined organisational transformation. In one day, you will build a shared understanding of how AI agents behave and the risks they introduce, define your corporate vision for agentic AI, see your readiness measured against it, develop an evidence-based, achievable strategy for governing agentic AI and record the rationale for it, align on a practical implementation roadmap, and commit to the immediate next steps. On completion, we will consolidate and strengthen your contributions into a transformation plan with workstream milestones, dependencies, and owners.

A structured engagement that identifies, evaluates, and sequences the agentic AI use cases that will deliver the greatest value for your organisation. We arrive with a curated library of agentic use cases and capabilities relevant to your business and work with your stakeholders to identify those with the highest potential. We then submit up to two shortlisted capabilities to our Pre-Deployment Agentic Risk Assessment. This produces the controls, effort estimates, and risk profiles you need to prioritise your investment decisions: business impact, feasibility, and expected ROI. The result is an execution-ready plan that tells you exactly which workflows to build, in what order, what each will cost, and what needs to be in place before you start.

For the first time, a worker that cannot bear legal liability can feature on your org chart. At task level for one or two of your agentic workflows, we will map the tasks the workflows create and remove, link every non-human worker to an accountable human, and write a Span of Agency for each agent: the discretion it holds without returning for authorisation, what rests with people, and who approved the split. You will discover where your role descriptions and statements of responsibility misalign with the new workflow and you will decide how to separate accountability for designing the agent’s decision boundary from accountability for outcomes within it.

A structured project that specifies the controls your AI agents need: which agentic risks apply to you, why / why not, the control outside the model or human procedure that treats each risk, the evidence it produces, the risk owner and control owner(s), and the monitoring mechanisms. It is built around a facilitated workshop, with material pre-work: a customised agent risk tiering, statement of applicability, and detailed control log, for your colleagues’ and your approval. We then use the workshop to practice applying the control framework to different use cases and developing workstream-level implementation plans.

A structured review of agentic workflows that are already live. Using our proprietary, systematic, and verifiable agentic risk flags, we will determine whether your workflow is sufficiently controlled, e.g. ownership, behaviour boundaries, and stop authority. Delivered using Gerido©, it produces audit-ready findings and a prioritised risk treatment plan – giving risk managers a fast, defensible basis for action.

A focused 2-day diagnostic that scores your firm’s operational data against the six characteristics of good training data – Structured, Current, Authoritative, Rich, Verifiable, and Symmetrical (SCARVeS©) – producing a readiness scoresheet, top 3–5 risks identified, and indicative regulatory exposure under Consumer Duty, EU AI Act Article 10, and PRA SS1/23. The Diagnostic is structured to answer one question: “do we have the data we need for our planned agent?” If material risks are identified, the Deep Dive will then scope how to mitigate them defensibly. 50% of the Diagnostic fee is credited toward the Deep Dive if booked within 90 days.

A focused two-day diagnostic that scores one function against the four measures beyond conventional span of control: agent-to-agent handoffs per supervisor, review depth against review volume, the exception-to-routine ratio once agents absorb the routine work, and peak-load headroom. It answers one question: is anyone in this function reviewing more agent output than they can meaningfully assess? If the answer is yes, the full Oversight Capacity Measurement will size the problem more broadly and set defensible limits.

Independent expert agentic AI governance advice – without the cost of a full-time hire, and with continuity that one-off engagements cannot match. Participation in your Agentic AI Steering Committee (or equivalent) with a monthly briefing on agentic AI developments, their impact on your firm, and proposed responses. At least 4 hours of advisory support each month: risks and issues, project support such as weekly meetings, governance questions, deployment and autonomy decisions, and board or regulator preparation.

A structured per-use-case audit of the operational data your AI agents will rely on at runtime – covering accuracy, completeness, recency, relevance, and accessibility – producing a defensibility map showing where your data is, where the agent(s) need it to be, and which gaps create exposure under Consumer Duty, EU AI Act Chapter III, and PRA SS1/23. Because errors in operational agentic data will not stop at a single misclassification – they propagate – this independent diagnostic ensures your data compounds accuracy, not inaccuracy, as autonomous workflows scale. Typically follows the Agentic AI Data Readiness Diagnostic, with 50% of the Diagnostic fee (£2,000) credited toward the Deep Dive when booked within 90 days.

Conventional measures mask underlying change: staff numbers, costs, and span of control indicate stability while, underneath, supervisory work has multiplied. We will measure dimensions beyond span of control – agent-to-agent handoffs per supervisor, review quality alongside volume, and the shift in the mix of work once agents absorb the routine tasks that provide vital variety and recovery within the working day. On completion, we will have defined and measured your oversight capacity, recommended hard limits on how much agent output one person can meaningfully review, and stress-tested those limits – because peak load determines capacity. Typically follows the Agentic Oversight Capacity Diagnostic, which tests a single function and answers whether a firm-wide measurement is warranted. 50% of the Diagnostic fee (£2,500) is credited toward this service when booked within 90 days.

A non-agentic incident management procedure will not protect you in an agentic environment. Agentic incidents can be autonomous, gradual, cross-system, and invisible to conventional alerting – leaving your detection, containment, and evidence capabilities configured for human-initiated failures when they need to respond to autonomous ones. This three-stage service will upgrade your current incident management procedure to ensure it is fit-for-purpose for agentic AI. It does this by 1) identifying gaps in your current procedure, 2) defining your upgrade requirements customised to the level of risk your agents will take, and 3) providing a prioritised project plan to close the gaps.

A design and implementation service for organisations that want support with deploying a specific agentic workflow. Our dedicated experts will ensure you navigate the process from design, risk assessment, and platform selection, to build, testing and deployment. Working either alongside your technology team or independently, we will deliver an agentic workflow and organisational capability that is structured, governed, and audit-ready from day one.

Agents absorb the routine work that formed the apprenticeships through which people historically built professional judgement. For a few years, a firm can hire experienced practitioners; over the longer term, it will need to develop them internally. Our programme builds the delegation and judgement you will need from agent supervisors who may still be early in their careers. We achieve this by developing the practical and professional judgement that ‘on-the-job’ routine work once provided, adding agent-supervision skills as a distinct entry on your skills framework set alongside technical skill, and building the new management layer whose subordinates mainly supervise non-human workers. Delivered over two facilitated days per cohort, by an Investment Association approved trainer on agentic AI, and experienced, award-winning leaders.

A structured programme to return a paused or flagged agentic workflow to safe, controlled operation. Where a workflow has been halted or identified as inadequately controlled – whether following incident management, an audit finding, a regulatory challenge, or a proactive controls review – we diagnose the root cause, redesign and implement the controls that failed or were absent, retrain the agent where required, and produce the documented evidence that the remediated workflow is fit to relaunch or continue safely.