Governance that scales
with your AI adoption
AI governance is the set of policies, roles, risk management and controls that ensure models, agents and LLMs are used responsibly, auditably and in compliance. Berghem builds that program — from an inventory of AI systems to impact assessment — aligned with ISO/IEC 42001, the EU AI Act and Brazil's LGPD.
ISO 42001 consulting and certification readiness
ISO/IEC 42001 is the certifiable AI management system (AIMS). Berghem runs the gap analysis, AIMS design, Annex A mapping and internal audit that ready your organization for the Stage 1 and Stage 2 audits.
One governance program
Multiple regulatory regimes
We map controls once and each framework gets its evidence package automatically. No rework, no duplication.
ISO/IEC 42001 — AIMS
First international standard for an AI management system. Plan-Do-Check-Act, with specific clauses for risk, transparency, and continuous improvement. Third-party certifiable.
NIST AI RMF 1.0
Voluntary framework organized in four functions — Govern, Map, Measure, Manage. Adopted by US federal agencies and increasingly as a baseline for B2B contracts.
EU AI Act
Mandatory regulation with a risk pyramid. High-risk systems require conformity assessment, technical documentation, human oversight, and post-market monitoring. Fines up to €35M or 7% of revenue.
PL 2338 / 2023 (BR)
Brazilian regulatory framework in progress. Risk-based categorization, rights of the affected person, and ANPD oversight. We track the text in real time and adjust your program.
A complete program across 5 fronts
Policy & strategy
AI acceptable-use policy, ethical principles, risk appetite definition, and regulatory roadmap aligned with the business plan.
Organizational structure
AI committee, RACI per system, AI Officer role, integration with Risk, Compliance, Privacy, and Information Security.
Processes & controls
Algorithmic impact assessment, approval gate for new systems, change process, retraining, and controlled decommissioning.
Documentation & evidence
Model cards, system cards, decision logs, audit trail, and automatic evidence package per regulatory framework.
Training & culture
Executive enablement, hands-on engineering training, leadership incident simulations, and communication to employees and customers.
One control
Multiple evidences
Each control maps simultaneously to ISO 42001, NIST AI RMF, and EU AI Act — implement once, satisfy all three.
Data governance
Lineage, quality, bias, LGPD/GDPR compliance, PII redaction, and validation of training/RAG data.
Human oversight
Intervention points, override controls, mandatory review for high-impact decisions, and adherence metrics.
Transparency & explanation
User disclosure, public model cards, per-decision explanations, and appeal channels for affected individuals.
Continuous risk management
Per-system risk assessment, post-deploy monitoring, drift metrics, and periodic review process.
Incident management
Definition of what an AI incident is, notification process to authorities, communication to affected parties, and lessons learned.
Vendor management
Due diligence, AI contractual clauses, multi-tenant isolation, and documented shared responsibility.
Related frameworks and services
AI governance organizes the controls you already have and the ones you are missing. Start with the concept guide, move to certification, and connect governance to the testing that validates it in practice.
What is AI governance
The full concept guide: principles, roles, risks and how to build the program from scratch.
ISO/IEC 42001
Readiness for the AI management system (AIMS) certification: gap analysis, risk and internal audit.
ISO 27001
The information-security management system AI governance builds upon.
Compliance & Audit
IT audit, GRC, gap analysis and regulatory testing for the main frameworks.
AI agent security
Controls and testing for autonomous agents — the operational risk governance must cover.
AI Red Team
Adversarial attack on AI models and agents to validate governance controls in practice.
Frequently asked questions about AI governance
What is AI governance?
What is the difference between AI governance and AI security?
Is AI governance mandatory?
Where do I start an AI governance program?
Does AI governance connect to ISO 27001?
AI governance and compliance
From certification to the operational security of AI systems.
Is your AI governance ready for 2026?
Start with a regulatory-readiness assessment — leave with gap analysis, prioritization, and an implementation plan for the frameworks that matter to your business.
Assess readiness