AI Governance Readiness Assessment
AI use-case inventory, risk tiering, a 26-control gap assessment against NIST AI RMF and ISO 42001, and a prioritized roadmap with an executive readout.
Learn more →Advisory for banks, fintechs, and regulated organizations adopting AI — led by a former Wells Fargo security governance leader with 21 years of regulated-industry control, audit, and examination experience.
Examiners, enterprise customers, and boards are asking AI questions that existing GRC programs were not designed to answer.
Bank and enterprise buyers are adding AI governance questions to vendor due diligence. Vague answers stall deals; inconsistent answers create contractual exposure.
Model risk, third-party risk, and data governance programs rarely cover generative AI, embedded vendor AI, or agents that take actions. The gap shows up at examination time.
Shadow AI and unclassified data flowing to third-party models are now the fastest-growing data exposure. Few organizations can say what reached an LLM last week.
Each engagement produces documented, evidence-ready deliverables mapped to the frameworks your auditors and customers use.
AI use-case inventory, risk tiering, a 26-control gap assessment against NIST AI RMF and ISO 42001, and a prioritized roadmap with an executive readout.
Learn more →Threat model and control review for an LLM application or AI agent: prompt injection, data exfiltration, tool permissions, and model supply chain.
Learn more →Classification with LLM handling rules, lineage for AI data flows, and approval and retention controls for the data that feeds models and prompts.
Learn more →For fintech and SaaS vendors selling to banks: an AI questionnaire answer library, policy set, and evidence binder your sales team can use immediately.
Learn more →Run the AI governance committee, use-case approvals, key risk indicator reporting, and examination preparation — without a full-time hire.
Learn more →Cryptographic inventory, quantum risk prioritization, vendor readiness, and a migration roadmap aligned to NIST's post-quantum standards and timelines.
Learn more →Already know the gaps and need it built? Secure AI Implementation — AI agents and automations with governance controls built in.
A 30-minute conversation about your AI footprint and obligations, followed by a one-page written readout.
A statement of work with deliverables, timeline, client responsibilities, and a fixed fee.
Weekly status, named owners for every gap, and deliverables formatted for auditors, examiners, and boards.
Optional fractional oversight keeps the program current as AI use, regulation, and vendors change.
comply is Automate 48's AI governance program platform: 26 controls across the NIST AI RMF Govern, Map, Measure, and Manage functions, crosswalked to ISO 42001, the EU AI Act, SOC 2, NIST CSF 2.0, and NIST SP 800-53.
Clients leave an engagement with a working program — policies, procedures, evidence checklists, and audit narratives — not a slide deck.
Explore the PlatformDave spent 21 years in information security at Wells Fargo, 19 of them as a Vice President, building governance and compliance programs from the ground up. He co-led remediation of a federal regulatory consent order to 100% closure across more than 550 deliverables, served as NIST and FedRAMP domain delegate, and led a 50-person organization to top-1% Gallup engagement company-wide.
Since 2022 he has built and operated production AI systems, including the comply governance platform, and publishes practitioner research on AI security and governance.
Full background →It's the gap in the one you already have — extending existing GRC to cover AI.
Architecting and assessing AI deployments against the adversarial AI kill chain.
Certificate governance and cryptographic inventory across hybrid environments.