Our clients
Would you like to join the companies leading the way in putting AI to work?
SECURE YOUR CONTINUITY
AI GOVERNANCE
Astu Labs helps you build an AI governance model for your organisation: clear ground rules on who may use AI, for what, with what responsibilities, and how the risks are managed. We consult on AI governance to match your needs and level of maturity — from lighter set-ups through to a management system built to the ISO 42001 standard. The work typically begins by defining where you want to be, followed by a gap analysis: it shows where you are now and what it will take to get there. The investment for a gap analysis is between €5,000 and €15,000, depending on the scope of the project.
Why does AI need governance?
Good governance doesn't slow AI adoption down — it speeds it up. Without ground rules, every AI decision becomes a case-by-case negotiation: may we use this tool, may we feed customer data into it, who answers if an agent gets it wrong?
Uncertainty leads to two poor outcomes: the cautious don't use AI at all, and the bold use it with no limits whatsoever.
Uncertainty leads to two poor outcomes: the cautious don't use AI at all, and the bold use it with no limits whatsoever.
Krista Karusalmi
Suomen Ekonomit
Chief Information Officer
“I was extremely satisfied with the final deliverable. It was clear, well-reasoned, and structured exactly in the way our organization needed. Working with Astu was smooth and professional, and the dialogue remained open and constructive throughout the entire engagement. I can confidently recommend Astu for similar assignments, particularly when seeking expert guidance in building an AI roadmap and governance model in a structured and practical way.”
Building an AI governance model
There are two reasons to build AI governance. First, shared ways of working and clear roles and responsibilities are what let the benefits of AI spread across the organisation. Second, putting real effort into governance strengthens leadership's ownership and makes sure day-to-day practice actually changes.
A governance model is not a technical project. Above all, it is a description of how your company works.
A governance model can, for example, be built on three levels:
- Policy A statement of intent from leadership. It sets out why AI is used, what the company commits to, and on what terms. Covers the principles and values for AI use, the scope and its boundaries, the acceptable level of risk, decision-making structures and responsibilities, and a commitment to keep improving.
- Procedures Process-level descriptions of how the policy is put into practice: how risks are assessed, how a new AI solution is approved for use, how impacts are evaluated, how deviations are handled, how suppliers are managed, and how audits are carried out. The lifecycle of an agent is one procedure — but not the only one.
- Work Instructions Concrete technical and operational instructions: which tools may be used, what data may go into which tool, how an agent is configured and tested, how logging and monitoring are handled, plus checklists for rollout.
- a view on which of your business processes stand to benefit from AI
- information about your current policies (information security, data protection, risk management, quality)
- a contact person who knows how decisions get made inside your organisation
- short workshops with the key people involved
1. Agreeing where you want to be
A decision on what is actually being done. Based on the big-picture goal, Astu Labs can draft a proposal for what the governance model should look like — for example:
- the structure and content of the policy
- how agents and skills are governed
- the practical arrangements — which roles and responsibilities the whole involves
- which documents and instructions are needed to run a management system in line with the policy
- the decision-making model
- how use cases are managed
2. Gap analysis
Setting out where you are now versus where you want to be
3. Project plan
What gets done, how, and in what order, so that the goal is reached
4. Implementation
5. Upkeep and further development
FAQ – Frequently asked questions
An AI governance model is worth putting in place when at least one of these is true:
- AI tools are already in use, but no one has decided what may be fed into them and what may not.
- The EU AI Act applies to your business and you want to know what it requires of you in practice.
- Your customers, owners or board are asking how AI risks are managed — and the answer is not yet down on paper.
- You are about to introduce AI agents that carry out steps of the work on their own.
- You are aiming for ISO 42001 certification, or readiness for it — for example because a customer or a tender requires it.
For most organisations a lighter governance model is enough, especially in the early days of using AI. An AI management system built to the ISO 42001 standard makes sense if AI sits at the core of your business or you operate in a heavily regulated field. On the other hand, ISO 42001 is lighter to implement if you already work to standards such as ISO 9001 or ISO 27001.
The investment depends on both where you are starting from and where you want to end up. That is why the work always begins with a gap analysis, priced between €5,000 and €15,000. After that, you get a more precise estimate of what the implementation itself would mean for you as an investment. On the cost side, the gap analysis also tells you what is not worth doing — a direct saving in both time and money. This is why a straight answer on the cost of building and maintaining the governance model itself cannot be given up front.
