Security and AI governance
Clear boundaries.
Accountable AI.
Agree the information, access, permitted actions and production evidence for your workflow. Review the controls that apply to the actual service.
THE DEPLOYMENT CONVERSATION
Make the operating
responsibilities explicit.
Define the information boundary.
Map sources, hosting locations, support access and subprocessors. Agree retention, deletion, permitted model use and the arrangements needed for data access and transfers. Document the actual architecture.
Set access and approval rules.
Specify customer separation, staff permissions and the actions that require a reviewer. Test the agreed boundaries and define who resolves conflicting evidence, uncertain outputs and operational exceptions.
Evaluate before release.
Agree representative cases, failure scenarios and acceptance criteria. Define how source, model and business-rule changes are checked. The production plan should identify incident handling, recovery and support responsibilities.
Review relevant assurance evidence.
Discuss the evidence your procurement team needs. Any certificate, independent report or assessment shared must match the entity, service, scope and dates under review. Availability is confirmed during diligence.
Assess the intended deployment.
Review the relevant AI, privacy, cyber and maritime requirements for the use case. Onboard and safety-related functions require separate assessment with the customer’s responsible specialists.
PRIVATE AI / IGNA® BOX
Bring AI closer
to your business.
Run selected workloads on your infrastructure. Define where information goes, who can access it and how the service operates.
A FEW USEFUL ANSWERS
Before we start.
Will our data train shared models?
The contract and approved model-provider terms must define permitted use. Confirm the policy and configuration for the selected deployment.
Can procurement review security evidence?
Discuss the required materials early. The team should establish which current evidence applies to the proposed service and the process for sharing restricted documents.
Does government delivery prove maritime compliance?
Government delivery is relevant experience. Every maritime deployment still requires its own assessment, acceptance criteria and evidence.
YOUR NEXT WORKFLOW
Put a real task
on the table.
Bring the process, the people and the problem.
We’ll help define a useful starting point.