AI Division
Clear rules for how your company uses AI.
Boards, clients and regulators now ask how you use AI. We help you write practical AI policies, classify your systems under the EU AI Act, prepare for ISO 42001 and the NIST AI RMF, and test your AI systems the way an attacker would.
In short
What does AI Governance and Security from Code Colonies cover?
AI policies, EU AI Act and ISO 42001 readiness, and red team testing. Deliverables include AI policy pack; AI system inventory and risk register; regulatory classification note; red team report with fixes. The work is delivered under 2good.dev at USD 2 or INR 199 an hour, a 150 hour minimum, no advance and payment after you accept the work.
- How does the work run?
- Assess (1 to 2 weeks), design (2 to 3 weeks), test (1 to 2 weeks) and advisory retainer (optional).
- Which tools and standards are used?
- EU AI Act, ISO/IEC 42001, NIST AI RMF, OWASP Top 10 for LLM Applications, DPDP Act 2023 and GDPR, chosen to fit your systems.
- Who owns the result?
- You do. Once you accept and pay, the documents, code and intellectual property from the work are yours.
- How do I start?
- Book a call or send a short brief. A specialist replies within one working day.
When clients call us
Situations we are asked to resolve
- Staff already use public AI tools and there is no policy.
- A large client sent an AI questionnaire you cannot fill in.
- You sell into Europe and need to know what the EU AI Act asks of you.
- Your AI product has never been tested for prompt injection or data leaks.
Scope
What the work covers
- AI policy and use rules
- Short, workable rules for staff, vendors and product teams.
- AI inventory and risk register
- Every AI system listed, classified and given an owner.
- EU AI Act classification
- Risk tier, obligations and an action plan for each system.
- ISO 42001 and NIST AI RMF
- A gap assessment and the documents an auditor will ask for.
- Red team testing
- Tests for prompt injection, jailbreaks, data leaks and tool misuse.
- Monitoring controls
- Logging, content filters and an incident process for AI systems.
How it runs
A clear path, with gates
- Step 11 to 2 weeksAssessList how AI is used today and find the gaps that matter most.
- Step 22 to 3 weeksDesignPolicies, controls and documents written with your teams.
- Step 31 to 2 weeksTestRed team your AI systems and fix what turns up.
- Step 4OptionalAdvisory retainerContinued support as the rules and your systems change.
Deliverables
What you receive, and what changes
What you receive
- AI policy pack
- AI system inventory and risk register
- Regulatory classification note
- Red team report with fixes
- Governance roles and routines
What changes
- Straight answers for clients and auditors
- Safer AI products
- Fewer compliance surprises
- Staff who know the rules
- Typical stack
- EU AI ActISO/IEC 42001NIST AI RMFOWASP Top 10 for LLM ApplicationsDPDP Act 2023GDPR
Start here
Talk to us about AI governance and security.
Tell us what you are trying to achieve. A specialist replies within one working day, and the first conversation is free.
Questions
Do you replace our lawyers?
No. We cover the technical and process side. Legal review stays with your legal team, and we work with them so the advice holds up.
Is ISO 42001 certification required?
In most cases the law does not require it. Large buyers ask for it more and more. The readiness work is useful even if you certify later.