Stage 02 · Design
The policy was never the problem.
Almost every organisation we assess already has an AI policy. What it does not have is a way to show, on any given Tuesday, that the policy is operating. This practice builds that.
01 · The gap
Between what is true and what can be shown.
A board can only attest to what it can evidence. The common failure is not an absence of controls, it is that nothing evidences them on a cadence, so the organisation is left asserting a position it cannot demonstrate.
This practice closes that gap in the direction that matters: it makes the operating model produce evidence as a by-product of running, rather than as a project that runs before each audit.
02 · What it produces
An operating model that evidences itself.
- 01
Named accountability
Who is accountable at board and executive level, what they are accountable for, and what happens to the accountability when they leave.
- 02
A stated risk appetite
What the organisation has said it will and will not accept, written in terms that can be tested rather than terms that can be agreed with.
- 03
Lifecycle control
Approval, validation, monitoring and retirement for models; attestation and the material service provider test for vendors.
- 04
Agentic AI governance
Inventory, autonomy and consequence tiering, authority, identity, permissions, human approval and decommissioning, for the agents you build, buy or commission. See the specialism ↗
- 05
An evidence cadence
Quarterly, at material change, and on regulatory update, with named owners and a review date on every item.
- 06
A board reporting structure
A standing format for tabling AI risk in your audit and risk committee’s own language, with classification and state on every line.
03 · The boundary
You attest. We evidence.
This practice designs and evidences an operating model. It does not assure one. Where Mycelium designs an AI governance operating model, it does not also assess that model independently within the same twelve months, because that is the conflict this market is built on, and declining it is the point.
Stays with you
- The assurance opinion, in every form it takes
- Acceptance of residual risk
- Management, board, legal, risk and audit accountability
- The attestation, and the signature on it
Mycelium produces
- The operating model and its control intent
- The evidence expectation at each of fourteen dimensions
- The trace from every board claim to its artefact
- The cadence, the owners and the review dates
04 · Where it runs
Designed here. Kept current there.
The operating model is designed in this practice and then kept current in the Evidence Platform, so the record does not decay between cycles. That handover is the whole point, a governance model that only exists in a deck is the thing we were asked to replace.
D02Accountability, ownership & transparency: named, minuted, and tested at handoverAttested
D03Risk appetite & tolerance: stated in testable termsEvidenced
D04Model governance: approval, validation, monitoring, retirementPartial
D05Vendor governance: attestation and material service provider testPartial
Illustrative. Classification tells you which pillar the finding belongs to; the state tells you what exists.
05 · Start here
The first call is diagnostic.
Thirty minutes. No pitch. No proposal until it makes sense.