Case study
AI governance case study: an AI inventory, approval process and evidence pack for a software company
ResultProduct features and internal AI tools were brought into one register, with named owners, change approvals and evidence for customer security reviews.
- Client
- A US software company (anonymised)
- Industry
- Software (B2B SaaS)
- Service
- AI governance: an inventory, approvals, decision logs and a gap list
- Type
- Governance controls for AI in a product and across teams
- Status
- Delivered
We set up AI governance for a software company whose customers were asking how its AI features handled their data. The engagement covered both product features and tools used internally. We delivered a system inventory, data flow maps, approval rules and review evidence that the company could maintain through its existing processes.
The starting point
AI had entered the business through product development and tools adopted by individual teams. There was no shared inventory, and answers about model providers, data retention and access depended on individual engineers. Code review alone did not document the implications of a prompt, model or vendor change.
What we delivered
We mapped the data each system reads and writes, assigned an owner and documented provider selection and retention requirements. For product features, we added release checks covering prompt injection, tool authorisation, data egress, retention and audit completeness. The control documents and gap list became the evidence pack used in security reviews.
Rollout and handover
We built the inventory from product code, sign-in records and software purchasing records. Product features that handle customer data came first, followed by internal tools prioritised according to the data they could access. We placed change approvals in the existing ticketing workflow and handed responsibility for the gap list to the security team.
Where people remain in control
| Decision | Who makes it |
|---|---|
| A new AI system going live, built or bought | An AI review group: the CTO, the head of security and counsel |
| A change to a model, a prompt or a vendor | The system's owner, once the change passes its test cases; a new vendor needs the head of security too |
| A drafted reply reaching an end customer | The support agent using the product, who sends it, edits it or discards it |
| A gap against the framework | The head of security, who owns the gap list and a date for each gap |
| Retention and deletion | The data owner for each system, on the schedule counsel signed |
| Answering a customer's AI questions | The security team, from the gate reports and the data flow maps |
Project outcome
The company received a common record of its AI systems and a documented route for approving changes. Security reviewers can trace a feature to its data flow, owner and release evidence. Open gaps have an accountable owner rather than being left as general policy statements.
How performance is evaluated
| Measure | How it is measured | Comparison point |
|---|---|---|
| AI systems on one list, each with a named owner | Systems with an owner, over all the systems the inventory finds | Taken when the inventory starts |
| Days to approve a change to a model, a prompt or a vendor | From the request to the decision, in the change log | The quarter before the work |
| Days to answer the AI questions in a security questionnaire | From the questionnaire arriving to the answer going back | The quarter before the work |
| Runs with a retrievable trace | Runs logged with inputs, tool calls, sources and model version, over all runs | Not recorded before the project |
| Gaps on the gap list | Gaps still open, and the share closed by their dates | The first mapping |
Technologies and tools
- An AI system register
- Approvals in the existing ticketing tool
- Run logs in the company's own cloud
- Test cases for each feature
- Gate reports and data flow maps
More case studies
All case studies- Case studyTaking an order entry pilot into production for a manufacturerAn order entry pilot became a production workflow with its own ERP identity, tested exception handling and an operational handover to IT.
- Case studyMigrating SQL Server reporting to SnowflakeA SQL Server reporting warehouse was migrated to Snowflake through parallel running, reconciliation and report-owner sign-off.
Bring us the AI systems your reviewers need to understand
Tell us which AI systems you run, who owns each one and what reviewers need to know. An engineer replies within two business days with which controls already have supporting evidence and where documentation is still needed.