AI governance consulting that maps your AI portfolio against the EU AI Act, NIST AI RMF and ISO/IEC 42001, then ships the policies, oversight, model risk controls and audit evidence that pass review. Delivered by senior AI engineers, not generalist GRC consultants. Trusted by Google, Microsoft and Shell since 2013.
Tell us where you are, scoping EU AI Act exposure, building an ISO/IEC 42001 ISMS for AI, or remediating live systems, and we'll tailor the engagement. Typically two to six weeks from first call to readout.
AI governance consulting is the structured work of putting policy, oversight, model risk management, controls and audit evidence around an organisation's AI systems so they can be operated safely, lawfully and accountably. Modern AI governance is anchored in three frameworks: the EU AI Act (risk-classified obligations for AI placed on the EU market), the NIST AI Risk Management Framework (govern, map, measure and manage risk across the AI lifecycle), and ISO/IEC 42001 (a certifiable information security style management system for AI). Winder.AI delivers all three, mapped onto your existing risk function, with the engineering controls (evaluation, lineage, audit logging, guardrails) that turn a policy document into a defensible production posture. We have been shipping regulated AI for enterprises since 2013, for clients including Temple University, Google, Microsoft and Shell.
2026 update. EU AI Act obligations for general-purpose AI models and high-risk systems are now in force, NIST AI RMF has hardened around generative and agentic AI, and ISO/IEC 42001 certification has moved from novelty to procurement requirement. Our 2026 governance work covers agentic AI controls, third-party model assurance for hosted LLMs, evaluation discipline for non-deterministic systems, and the audit evidence regulators and enterprise buyers now expect.
| Governance approach | What you get | Best for | Main weakness |
|---|---|---|---|
| Big-4 / global SI governance programme | Branded governance framework, executive workshops, policy templates and a transformation deck | Board-level signalling, multi-year compliance programmes, regulator-facing optics | High six-figure cost, generic templates, junior analysts behind a senior pitch, weak on the engineering controls that actually pass audit |
| In-house GRC / risk function | Policy ownership inside the second line of defence, integrated with existing risk frameworks | Mature financial services and healthcare organisations with an established model risk function | Often lacks deep ML and LLM expertise, slow on agentic AI and generative systems, struggles with evaluation and lineage controls |
| Vendor or tooling-led governance (model registry, observability platform) | A platform that logs runs, scans prompts and produces compliance reports | Teams that already have policy in place and need automated controls and evidence | Tooling without a policy framework produces dashboards, not assurance; conflicts with sales incentives; rarely covers the EU AI Act conformity path |
| No governance, ship and hope | Faster initial pilots, deferred risk | Pre-revenue experimentation with non-sensitive data | EU AI Act, NIST AI RMF and ISO/IEC 42001 expectations have hardened; first audit, incident or regulator letter forces retrofit at 5x cost |
| Specialist engineering-led governance (Winder.AI) | EU AI Act risk classification, NIST AI RMF mapping, ISO/IEC 42001 ISMS for AI, model risk policy, evaluation harnesses, audit logging, lineage and assurance reports written by engineers who ship the controls | Enterprises that need a defensible governance programme aligned to EU AI Act, NIST AI RMF and ISO/IEC 42001, implemented in production, not just on slides | Boutique scale, not designed for 100-seat staff augmentation engagements |
Winder.AI runs AI governance as a single connected programme: a defensible policy framework, the operational controls that make the policy real, and the assurance evidence that passes audit. One engineering team, one engagement, no handover between strategy consultants and the people who implement controls.
We sought AI engineering experts that could quickly learn our day-to-day scientific legal mapping processes enough to develop a tool to make our work more efficient. Winder.AI dug into our day-to-day workflow to thoroughly understand the value of an AI Assistant for scientific legal mapping, which is a critical process to the field of legal epidemiology.
Senior AI engineers writing policy, controls and audit evidence that survive contact with production. Aligned to EU AI Act, NIST AI RMF and ISO/IEC 42001, grounded in a decade of regulated AI delivery.
Governance, controls and assurance work across finance, healthcare, energy, legal, technology and regulated public services.
Each area below is delivered as a scoped workstream with named owners, written policy or technical artefacts, and the audit evidence to back it up. Mapped to EU AI Act articles, NIST AI RMF functions and ISO/IEC 42001 controls:
We deliver the policy, technical controls and assurance evidence that turn AI governance from a slide deck into a production posture. Each capability below is in scope on a typical engagement:
Case study
Winder.AI helped Duetto evaluate offline reinforcement learning for dynamic hotel pricing. Over five months, the engagement progressed from behavioural cloning baselines through Implicit Q-Learning experiments on real booking data, revealing where RL outperforms simpler approaches, what data quality prerequisites exist, and how to evaluate pricing agents when ground truth is unavailable.
Case study
Winder.AI helped Apartment List modernize its machine learning operations by unifying data pipelines, automating Kubeflow workflows, and introducing enterprise-grade governance. The outcome: consistent training and inference data, faster deployment cycles, and self-service capabilities that enabled Apartment List’s data science team to scale model delivery with confidence.
Case study
Using digital twin data to build flight traffic simulators and train reinforcement learning AI agents. A leading aerospace business and Winder.AI opened new horizons for dynamic, data-driven scheduling solutions that integrate with our client’s advanced flight planning technology.
AI
Adoption of legal services AI has gone mainstream. Litify’s 2025 State of AI in Legal Report found that 78% of legal professionals already use AI in some form, up from 23% in 2023. But what workflow should you automate first?
Getting this wrong means months of effort on a low-impact problem. Getting it right means a quick win that funds the next step. The difference between a successful AI initiative and a stalled pilot usually comes down to picking the right starting point.
AI
“AI contract review” is a popular keyword to compete for. Look, I’m doing it right now! A couple of years ago my colleagues and I half-built a contract review service prototype. We decided not to take it any further, but that was a mistake. It’s now very hot.
So hot you can easily find a wall of product pages. Sign up, upload your contracts, get results. The pitch is simple. For straightforward use cases, it works.
But what if your contracts don’t fit their templates? What if your review process has steps a product can’t model? What if your data can’t leave your infrastructure? What if your firm’s clause playbook differs from the vendor’s defaults?
This article walks through what a custom-built contract review pipeline actually involves.
AI
Legal AI adoption has accelerated. Litify’s 2025 State of AI in Legal Report found that 78% of legal professionals now use AI in some form, up from 23% just two years earlier. In Winder.AI’s 13 year history (and counting!) I have observed a similar trend first hand.
On the back of this trend, significant VC funding has attempted to capture a share of this market. $2.4 billion was invested in 2025. A tsunami of products promise to automate contract review, legal research, and document analysis. Many of them work for a while. Then firms hit the ceiling.
This article is about where that ceiling is and what lies beyond it.
This page provides answers to our most common questions. If you have a query that isn't covered, please get in touch.
Whether you are scoping EU AI Act exposure, building an ISO/IEC 42001 ISMS for AI, or hardening live systems against the next audit, talk to the team that has been shipping regulated AI since 2013.
Send us a brief and book a welcome call within 48 hours.
Talk to the AI governance team