AI governance and compliance
Before anything is bought or built, we write down what data AI may use, who signs off, and what it may never do.
What a Charter settles.
Four decisions, agreed once, in language your team can read.
What stays with a person, and what can be automated.
How each use is risk-classified.
Following the risk tiers the EU AI Act sets out.
Who signs off, and when a person stays in the loop.
How data is handled, and where it lives.
How a Charter is written.
Listen
We sit with your leadership, your compliance team and the people doing the work. The risks named are yours, not a template’s.
Draft
The four decisions written in plain language, reviewed by the people they bind.
- The risks named are
probably fine, we assumeyours, not a template’s - Every output is signed off by
the modela named person - Data lives
wherever the vendor puts itwhere we agreed it lives
Who marks it up
- Leadership Owns the decisions the Charter makes, and signs it.
- Compliance Checks it against the obligations you already carry.
- The people doing the work Say where a rule would stop them doing their job.
Nothing is adopted until every mark is resolved.
Adopt
Agreed at the top, briefed to everyone, and revisited as the rules or the tools change.
The four risk tiers.
The EU AI Act sorts AI uses into four tiers of risk. The Charter classifies yours against them, so the rules that apply are known before anything is bought or built.
-
Prohibited
Practices the Act bans outright. The Charter rules them out in writing.
-
High risk
Uses the Act holds to strict controls: documentation, human oversight, a named person accountable. The Charter sets those controls down.
-
Limited risk
Uses that carry transparency duties, like telling people when they are talking to a machine. The Charter writes the disclosures.
-
Minimal risk
Everything else. The Charter still records what data each use may touch.
We align your uses to the tiers and close the gaps against the requirements that apply. OpenKit is not an EU AI Act notified body.
The approved tools list.
One part of what the Charter fixes is which AI tools your company may use and which it may not, with the reason written against each. The list below is an example of the shape it takes. Yours is settled with your compliance team and revisited when the terms or the tools change.
Approved
A business tier with an agreement behind it, and an admin who can see who is using it.
- ChatGPT Enterprise Business tier with a data processing agreement, and prompts that are not used to train the model.
- Microsoft 365 Copilot Runs inside your own tenant and inherits the permissions your files already carry.
- Claude for Work Enterprise tier with single sign-on and an admin log of who used it.
- A model you host yourself Nothing leaves your own infrastructure.
Not approved
No agreement behind it, or no way to say where the data goes.
- Free and personal accounts No agreement behind them, and inputs that may be used to improve the model.
- Tools with no admin controls No way to add or remove people, and no record of who used what.
- Browser extensions with broad page access An extension that can read every page can read client data you never meant to send.
- Anything not yet reviewed New tools go through the review before they are bought, not after.
The list is settled during the audit and adopted with the rest of the Charter.
It runs beneath the whole engagement.
The Charter runs under everything we do with you. It begins in the first audit, where the rules are written down alongside the roadmap. One Charter, agreed once, governs every system we build with you and every one your team runs after we have gone.
Our success stories.
“Their team quickly understood the unique challenges of our business … and delivered a thorough, evidence-based strategy.”
“Professional, yet friendly, Reuben & Ibrahim made sure to fully understand our situation and business objectives before providing advice and proposing solutions rooted in the most recent AI and prompt-engineering research.”
Your compliance team is welcome at the first call. Get in touch
FAQ
Is this a policy PDF?
No. A Charter is four decisions with names against them, short enough that people actually read it.
Does the EU AI Act apply to UK companies?
If you sell into the EU or process EU citizens’ data, parts of it will. The Charter classifies your uses against its tiers either way, so you are not retrofitting later.
We already have an IT security policy.
Good: the Charter sits beside it. Security policy says how systems are protected; the Charter says what AI may and may not do.
Who maintains it after adoption?
Your team. It is written to be run without us, and revisited when the rules or the tools change.
Can you bring our compliance team into the room?
Yes, bring them to the first call. It goes faster with them in from the start.
Not ready to talk? The free AI readiness check scores where you stand in about five minutes.
Find your first workflow.
We start with a conversation, audit where AI actually pays back, and build the first automation into how your team already works.
We reply within one working day.