AI Governance
AI governance that sits alongside your compliance platform
AI Governance
AI governance for regulated organizations — model risk, red teaming, ISO/IEC 42001, NIST AI RMF and EU AI Act readiness, from a HITRUST assessor.
Alongside the platform
The platform tracks the evidence. The work beside it is a person's.
Vanta and Drata are good at what they do. They automate evidence collection and control tracking, including for AI frameworks such as ISO/IEC 42001. TrustEdge works alongside those platforms.
A platform collects evidence. Someone still decides scope, reads the contract, tests the model, and judges what an assessor will accept.
ISO/IEC 42001 was published in December 2023. NIST AI RMF is a voluntary framework, not a certificate. The EU AI Act reached general application on August 2, 2026, and Regulation (EU) 2026/1744 deferred the high-risk obligations to December 2027 and August 2028.
The requirements are already arriving. Recent HITRUST CSF versions include AI security requirements a prior assessment may not have selected. AI clauses are also showing up in customer contracts and security agreements. A clause is not a control. Someone has to read it.
We do the scoping, the contract reading, the red-teaming, and the assessor judgment. We do that work alongside the platform.
Your AI is inside your existing certification boundary whether you planned it or not
If a team shipped a feature that touches PHI, it is in HIPAA scope, and inside the SOC 2 boundary if it runs on the system your report describes. Scope is the system you operate now. Someone has to decide that the feature moved the boundary.
Evidence tracking is not the whole of the work
Platforms automate evidence and control tracking for AI frameworks such as ISO/IEC 42001. Deciding which shipped features sit inside a certification boundary, reading contracts for AI clauses, red-teaming the model, and judging what an assessor will accept are a person's work. That work sits alongside the platform.
Red-teaming is not a checkbox
Someone has to actually try to break the model: prompt injection, jailbreaks, tool misuse, data exfiltration through the retrieval layer. OWASP now publishes a separate Top 10 for agentic applications precisely because the failure modes are different. That is adversarial work performed by a person, and no integration performs it.
Our parent company is the assessor
Jacobian Engineering is a HITRUST Authorized External Assessor with CCSFP assessors in house. That means we can tell you how an assessor will treat your AI controls. The credential is Jacobian's. It is not a certification of TrustEdge.
What we do
Governance services
Start with the assessment. Everything else follows from what it finds.
AI Governance Pre-Assessment
The starting point. What AI you actually have, what sits inside your certification boundary, what your contracts already commit you to, and a gap list against ISO/IEC 42001 and NIST AI RMF.
AI Red Teaming
Someone has to actually try to break the model. Prompt injection, jailbreaks, tool misuse, and exfiltration through the retrieval layer, tested against the OWASP Top 10 for LLM Applications and the 2026 agentic list.
ISO/IEC 42001
The AI management system standard, certifiable through accredited bodies. Worth asking whether you need it at all before you buy.
NIST AI RMF
Govern, Map, Measure, Manage. No US state grants a safe harbor for adopting it alone, and only Texas gives documented compliance conditional statutory weight; elsewhere, under an effect-based standard, it is the difference between a defensible position and an unexplained outcome.
EU AI Act Readiness
The timetable moved on July 27, 2026. High-risk obligations were deferred to December 2027 and August 2028, while transparency and GPAI enforcement went live. Scoping now is cheaper than scoping later.
Model Governance & Audit Trails
Model registry, versioning, lineage, explainability, bias testing, and the audit trail that turns "we think it works" into evidence someone else can check.
Compliance-First AI
Designing the system to survive the assessment, rather than retrofitting evidence afterward. HIPAA, SOC 2, PCI-DSS and framework-specific controls, built in from the first commit.
How governance is priced
Fixed fee, agreed up front.
Our agent work is priced against what it returns — you pay from the savings. Governance is not, and we will not pretend otherwise. A pre-assessment does not generate a savings stream to bill against, and inventing one would make the number meaningless.
So governance engagements are fixed fee, scoped and agreed before we start. No surprise fees, no hidden costs, no bait-and-switch. The price you discuss in consultation is the price you pay.
And if the assessment concludes you do not need the framework you came asking about, that is what it will say.
Questions
Frequently asked
Do we need ISO/IEC 42001, or just a policy and a control?
Very often the latter, and we will say so. ISO/IEC 42001 certification is worth pursuing when a customer contract demands it, when you are selling into the EU and want evidence that maps to AI Act conformity, or when AI is central enough to your product that a management system genuinely helps. If you have three AI features and no customer asking, an acceptable-use policy, a documented risk assessment, and an enforced technical control will do more for less. We would rather tell you that than sell you a certification.
Is this competing with our compliance automation platform?
No. Vanta and Drata are good at what they do. They automate evidence collection and control tracking, including for AI frameworks such as ISO/IEC 42001. Use the platform. We do the scoping, contract reading, red-teaming, and assessor judgment beside it, and we work alongside them.
What does a governance pre-assessment actually produce?
A document you can take to your board. It covers what AI you actually have (usually more than the inventory says), what falls inside your certification boundary, what your existing customer contracts already commit you to, a gap list against ISO/IEC 42001 and NIST AI RMF, and a scoping recommendation for red-teaming. It is deliberately small and concrete.
We are HITRUST certified. Does that already cover our AI?
Probably not, and this is worth checking carefully. HITRUST added AI-specific requirements in recent CSF versions, so a certified organization can be in scope for controls it was never assessed against. HITRUST also offers a dedicated AI Security Assessment layered onto an existing e1, i1 or r2. Note that only AI providers — platform providers and product providers — can obtain that certification; organizations that merely use someone else's AI system cannot certify it.
Has the EU AI Act deadline passed?
Partly, and the part most people were preparing for moved. On August 2, 2026 the Act reached general application: Article 50 transparency obligations apply and the Commission gained enforcement powers over general-purpose AI providers. But Regulation (EU) 2026/1744 — the Digital Omnibus, in force since July 27, 2026 — deferred the high-risk obligations to December 2, 2027 for Annex III systems and August 2, 2028 for Annex I. If your compliance calendar says high-risk landed in August 2026, it predates the amendment.
Why would we use a consultancy instead of a tool?
Compliance platforms now support AI frameworks such as ISO/IEC 42001 and automate evidence collection. Use one. A consultancy does the scoping, contract review, red-teaming, and assessor-level judgment a platform does not, and it works alongside the platform.
Technology Partners
Related reading
- The Work Beside an AI Compliance PlatformArticleVanta and Drata automate evidence for AI frameworks such as ISO 42001. Scoping, contract reading, red-teaming, and assessor judgment sit beside that work.
- Safe Scribe: A Clinical AI Scribe That Proves Who Saw WhatArticleProving which agents touched which patient fields, instead of asking an auditor to trust us.
- Provable Agent Access: An Architecture for Clinical AI That Can Prove Who Saw WhatWhitepaperThe architecture for clinical AI that can prove who saw what, with a production checklist and the prototype's limits stated.
- AI Governance & Compliance TemplatesTemplateFree EU AI Act, NIST AI RMF and ISO/IEC 42001 templates, readable on the page or as a Word download.
Not sure what is already inside your certification boundary?
A governance pre-assessment tells you what is in scope, what an assessor will accept, and what your platform is not covering.