Responsible AI & Governance Built for Trust, Compliance, and Scale

The EU AI Act has extraterritorial reach that is analogous to GDPR — it applies to any provider that places an AI system on the EU market or puts it into service in the EU, and to any deployer that uses a high-risk AI system within the EU, regardless of where the provider or deployer is established. This means an Indian software company that develops and sells an AI system used by European banks, hospitals, or employers is subject to the EU AI Act's provider obligations for that system — including technical documentation, conformity assessment, CE marking (for high-risk systems), and post-market monitoring. The Act also creates obligations for importers (EU-established entities that import AI systems from non-EU providers) and distributors. If your organisation develops AI systems that are used by European customers — directly or through a European distributor or cloud platform — you almost certainly have EU AI Act obligations for any high-risk systems in scope. We recommend a scoping assessment to identify which of your AI systems fall into high-risk categories and which obligations apply to your position in the supply chain.

This is the most technically nuanced question in AI fairness — and it does not have a single right answer, which is itself the correct answer to the question. Different fairness metrics capture different notions of fairness, and it has been mathematically proven that many of these notions are mutually incompatible (you cannot simultaneously satisfy demographic parity and equalised odds unless base rates are equal across groups, which they rarely are in the real world). The choice of fairness metric must therefore be made explicitly, deliberately, and contextually — based on the use case, the nature of the harm being assessed, the legal framework applicable, and the stakeholder values being balanced. For credit decisions, calibration fairness is typically the most legally relevant metric because it ensures a given risk score means the same default probability regardless of group membership. For hiring screening, equalised opportunity (equal true positive rates) may be more appropriate because it ensures qualified candidates from all groups are equally likely to be correctly identified. For recidivism prediction, equalised odds (equal true positive and false positive rates) is often the most defensible because errors in both directions have significant consequences. We document the metric selection rationale for every engagement as a formal governance decision — because "we chose this fairness definition for these reasons" is as important as the fairness testing results themselves.

Yes — and this is what post-hoc explainability methods like SHAP and LIME are designed to do. These methods work with any model regardless of its internal architecture — they generate explanations by observing how the model's outputs change in response to perturbations of the input, without needing access to the model's internal weights or architecture. SHAP in particular provides explanations with strong theoretical properties (consistency, local accuracy, dummy feature handling) that make it suitable for use in legally consequential explanations. The honest caveat is that post-hoc explanations are approximations — they explain the model's behaviour locally, around a specific prediction, but may not capture global model behaviour accurately. For regulatory and legal purposes where explanations must be defensible, we typically complement SHAP local explanations with global feature importance analysis and, where the use case warrants it, consideration of whether an inherently interpretable model (Explainable Boosting Machine, scorecard) can be trained to the required accuracy level — because a model that is directly interpretable is always more defensible than a model with post-hoc explanations, even if the post-hoc explanations are high quality. For most tabular classification use cases in credit and insurance, EBMs can achieve near-XGBoost accuracy while remaining directly human-readable, which is increasingly the design choice we recommend for Tier 1 regulated applications.

A complete Responsible AI & Governance framework and governance operating model implementation typically takes 12 to 20 weeks depending on the size of your AI portfolio, the complexity of your organisational structure, and how much foundational work (AI inventory, model documentation) exists before the engagement begins. A typical timeline looks like this: Weeks 1–3 are discovery — AI system inventory, regulatory obligation mapping, current governance maturity assessment, and stakeholder interviews to understand the decision landscape. Weeks 4–7 are framework design — ethics principles operationalisation, risk classification model design, governance body structure, and artefact template development. Weeks 8–12 are framework documentation — drafting the ethics policy, MRM policy, Ethics Impact Assessment template, model card template, AI system register, and governance procedures. Weeks 13–16 are piloting — applying the framework to two to three existing AI systems to stress-test the artefacts, identify gaps, and refine the governance processes. Weeks 17–20 are rollout — training governance body members, training development teams, and establishing the ongoing governance cadences. The most common accelerator is a leadership team that has already reached consensus on what responsible AI means for the organisation — and the most common delay is ethics principle definition requiring extensive consultation with legal, risk, and business stakeholders before the framework design can proceed.

Model Risk Management (MRM) is a specific regulatory framework with a defined scope — it applies to quantitative models used in financial institutions for risk measurement and business decision-making, and it is primarily concerned with ensuring models are fit for their intended purpose, adequately validated, and appropriately monitored. MRM is a subset of AI governance. AI governance is a broader organisational discipline covering the full lifecycle of AI systems across all use cases — not just quantitative financial models, and not just risk measurement applications, but any AI system the organisation builds or procures that has the potential to cause harm. AI governance encompasses MRM requirements for financial models but also covers ethics, fairness, explainability, privacy, human rights impact, and the broader accountability structures that apply to AI systems making consequential decisions about people. For a bank, both are needed: MRM to meet the specific regulatory requirements for their credit scoring and market risk models, and a broader AI governance framework to cover their operational AI systems (customer service chatbots, fraud detection, HR tools, marketing personalisation) that MRM does not directly apply to but that carry governance obligations under the EU AI Act, data protection law, and the organisation's own ethical commitments. We help organisations design an integrated programme that satisfies MRM requirements within a coherent broader AI governance framework rather than running two separate parallel programmes that produce duplicated governance overhead.