Artificial intelligence is moving faster than most organisations are prepared for. From generative tools reshaping workflows to predictive models influencing decision-making, the opportunities are vast, but so are the risks.

Risk leaders are finding that their traditional frameworks don’t fit neatly with the complexities of AI. Existing taxonomies, controls libraries, and model risk definitions often fall short. What’s needed is a structured way to bring AI into the enterprise risk conversation, making it auditable, transparent, and accountable.

Protecht’s new AI Governance solution gives organisations a structured and auditable way to capture, assess, and monitor every AI system they use (whether developed in-house or adopted from third parties), ensuring transparency, accountability, and regulatory readiness.

Watch our on-demand webinar to find out more about best practice in governing AI risks, including a demo of the AI Governance solution:

Why AI governance matters now

AI has already shown how quickly it can disrupt business operations. In 2018, Amazon abandoned an AI recruitment tool after it was found to systematically disadvantage female candidates. Trained on historical hiring data from a male-dominated industry, the model amplified bias instead of removing it, exposing the company to reputational damage and ethical criticism[1].

More recently, legal tech tools from companies like LexisNexis, Westlaw AI and Casetext that integrated LLMs have been found to "hallucinate" legal citations, with empirical evaluations revealing error rates between 17-33%: i.e., the tool confidently made up non-existent statutes or cases. These hallucinations could easily lead to incorrect compliance steps, audit failures or regulatory breaches[2].

These cases illustrate why AI governance is not optional. It’s about ensuring that systems are transparent, explainable, and aligned with ethical and regulatory expectations before incidents spiral into crises.

Introducing the AI Governance solution

Protecht’s new AI Governance solution, available via our Marketplace, has been designed to meet this challenge head on. It provides a centralised approach to data collection and assessment for every AI system where risk teams can capture and assess details about every AI system, whether developed internally, procured from vendors, or embedded within SaaS tools.

The solution reflects the lifecycle of AI, capturing relevant data at each stage from inception to deployment and beyond. It helps organisations:

• Centralise oversight of all AI systems in use
• Assess key risks such as bias, accountability, and fairness
• Demonstrate due diligence when adopting third-party tools
• Future-proof compliance by aligning with the EU AI Act and preparing for similar regulation globally

Key concepts built into the framework

The AI Governance form guides teams through the essential questions that define responsible AI:

• Auditability and accountability: What signoffs are in place? Who is responsible for outcomes?
• Bias and fairness: Has the system been assessed to ensure there are no unethical outcomes, or unfair impacts on stakeholders?
• Data privacy and security: What datasets were used, how were they created, and are your privacy and security obligations observed?
• Transparency and explainability: Can users understand and challenge AI-driven decisions?
• Responsible design: Does the system’s technical detail align with its intended use and include guardrails to prevent misuse?
• Third-party and generative AI: How do you ensure accountability when using external models?

These principles are embedded into the form’s tab-based structure, covering system details, datasets, development and performance, third-party involvement, and ongoing monitoring. The result is a centralised, auditable view of AI risk across the enterprise.

Who benefits from AI governance?

The AI Governance solution has been designed for multiple audiences:

• Risk managers and CROs who need oversight of AI risks in their enterprise risk frameworks and establish a cross-functional view
• CIOs, CISOs and Data Protection Officers who must manage AI risks and ensure compliance with data privacy, security, and ethical standards
• CTOs and Development teams looking for a structured approach to rolling out responsible AI development processes and policies
• Audit teams who require evidence of due diligence, transparency, and explainability

This is not limited to the EU or to technology-driven companies. Whether you are a bank adopting generative AI to streamline compliance tasks or a healthcare provider integrating AI into clinical workflows, the same needs apply: AI risk ownership, oversight, accountability, and control.

How Protecht puts governance into practice

At Protecht, we don’t just advise on governance, we apply it ourselves. Our Cognita AI features were developed using the framework behind the AI Governance solution from the ground up. Every stage of development and deployment was documented, audited, and reviewed, ensuring that Cognita is not only powerful but also trustworthy and compliant.

This dual approach, building governance into both our products and our client solutions, reflects our core belief: AI should be a driver of value, not a source of unmanaged risk.

Getting started with AI governance

For organisations seeking to embed AI oversight into their governance, risk and compliance processes, the path forward is clear:

1. Inventory your AI systems: Whether internal, third-party, or embedded in SaaS
2. Capture key details: Datasets, development processes, stakeholders, intended use
3. Establish accountability: Assign roles and responsibilities for AI decision-making.
4. Monitor continuously: Ensure ongoing checks for drift, bias, and performance issues
5. Report with confidence: Provide boards, regulators, and stakeholders with clear, auditable evidence.

Protecht’s AI Governance solution is designed to support each of these steps, making governance practical and scalable across industries.

Conclusions and next steps for your organisation

AI is transforming business, but unmanaged adoption carries unacceptable risks. Bias, hallucinations, supply chain vulnerabilities, and regulatory breaches are not theoretical problems: they are happening today. Risk managers, CIOs, CISOs, CTOs and audit teams need a way to bring AI under control, embedding it into existing governance and compliance frameworks.

With the AI Governance solution, Protecht provides a practical way to document, assess, and oversee AI systems across the enterprise.

Request a demo of the AI Governance solution to see how Protecht can help you govern AI with confidence, transparency, and accountability:

References

[1] Reuters, “Amazon scraps secret AI recruiting tool that showed bias against women” https://www.reuters.com/article/world/insight-amazon-scraps-secret-ai-recruiting-tool-that-showed-bias-against-women-idUSKCN1MK0AG/

[2] Arxiv, “Hallucination-Free? Assessing the Reliability of Leading AI Legal Research Tools” https://arxiv.org/abs/2405.20362