packets.build00 AI Governance
Use AI fast, with every use case governed
Register AI systems, assess them as they move through their lifecycle, and keep controls, tasks and evidence with each one. Named approval groups review what needs review.
For AI-native, IT services, fintech and healthtech teams selling to enterprise.
AI systems
- Customer support assistantUnder review
Head of SupportStage: Design
- Document summariserApproved
Head of OperationsStage: Run
- Candidate screening modelIn progress
Head of PeopleStage: Ideation
Business ownerLifecycle stageAssessments
- IdeationCandidate screening model
- DesignCustomer support assistant
- Build
- RWT / Go live
- RunDocument summariser
- Decommission
- Closed
- 01
One register of AI systems, each with a business owner, a lifecycle stage and its assessments.
- 02
The classification and the controls that apply follow from the assessment answers your team gives.
- 03
Assessments that need review go to named approval groups, and each decision is recorded.
01 Why it matters
AI adoption moves faster than oversight
- 01
Limited visibility
Teams adopt AI tools and build AI features faster than anyone records them, so leadership cannot say what is in use.
- 02
Unclear accountability
When something goes wrong or a customer asks, it is not obvious who owns the AI system or who approved it.
- 03
Risks, policies and evidence are apart
AI risks, policies, controls and evidence are kept in different places, which makes governance hard to demonstrate.
The question
How many AI systems are we using?
3+ ?
“3 that we know of. Maybe more.”
Other tools are in use, but nobody has written them down, so nobody owns them.
Recorded In use, not recorded
I IdeationD DesignB BuildG Go liveR Run
Illustration with made-up systems.
02 What packets is
A governed path for every AI use case
AI Governance gives each AI system a record and a route: registration, stage-based assessments, classification, applicable controls, review by approval groups and evidence. The aim is to know what AI is in use, who owns it and what has been decided about it.
Try it: change the answers and watch the classification, controls and reviewers follow.
AssessmentsYour team answers
- It influences decisions about people
- It uses personal data
- It touches health or financial data
- It runs on a general-purpose model
- We build or fine-tune it ourselves
OutcomeSample AI System
Classification
Applicable controls 5
- Full inference trace
- Retained decision record
- Human-in-the-loop
- Authority limits
- Retention limits
Approval routing
- AI GovernanceReview
- PrivacyReview
- SecurityNot needed
- LegalReview
- Third PartyNot needed
Simplified sample for illustration. Not legal advice. No AI model decides this.
Part of the packets control engine. It is part of the packets AI-powered Governance & Compliance Control Engine, so each AI system links to its controls, tasks, risks and evidence. packets organises and flags. Named reviewers decide.
03 Who it’s for
For teams building with AI or using it across the business
AI-native companies
You ship AI features and depend on model providers. Enterprise buyers want to know how those systems are governed.
IT services
You use AI in delivery and build it for clients. Show a consistent way of recording, assessing and approving AI use.
Fintech
AI that touches customer decisions or data needs a clear owner, assessment and review before it is relied on.
Healthtech
AI close to sensitive health data needs documented oversight, approvals and evidence.
04 How it works
From an AI idea to an approved, documented use case
Record its purpose, scope, business owner and whether it is a general-purpose model. Systems found by a cloud connector can be turned into a record by your team.
Respondents answer assessments for each lifecycle stage, such as profile, data and privacy, security, legal and responsible AI.
The classification, roles and applicable controls follow from the assessment answers. No AI model decides this.
Assessments that meet the review conditions go to a named approval group. Some lower-risk assessments pass automatically.
Each control becomes tasks with evidence and a reviewer. A task is done only when its reviewer approves it.
An assessment reopens when a later answer changes the outcome, and the next review cycle is scheduled from your monitoring frequency.
AI system record
- AI systemCustomer support assistantPurpose, scope and general-purpose model recorded
- OwnerHead of SupportBusiness owner named on the record
People decide. Classification and control applicability follow from your assessment answers. People answer, review and approve. Stage gates are optional and set by an administrator.
05 Stage gates
Hold a system at the gate until it is approved.
Every AI system moves through lifecycle stages, and each stage brings its own assessments to named approval groups. Turn stage gates on and a system cannot advance until they are approved. They are optional, and off by default.
Sample AI SystemStage: Design
- Ideation
- Design
- Build
- RWT / Go live
- Run
- Decommission
- Closed
Status2 assessments still open. Stage gates are off, so you can advance anyway.
- Business & Decision ImpactNone, approves itselfApproved automatically
- Data & PrivacyPrivacyUnder review
- Legal & RegulatoryLegalUnder review
- Stage advanced from Ideation to Design
Stage gates are optional, set by an administrator and off by default.
06 Key capabilities
What your team works with
01 Register and classification
AI system register
Name, purpose, scope, business owner and lifecycle stage for every AI system.
Lifecycle stages
Move each system through ideation, design, build, go-live, run and decommission.
Classification from answers
Classification, roles, high-risk and general-purpose flags follow from assessment answers.
Cloud discovery
Read-only connectors for Azure, AWS and Google Cloud can find AI resources. Your team decides which become registered systems.
02 Assessment and approval
Stage-based assessments
Respondents, deadlines, comments and requests for more information on every assessment.
Approval groups
Review routed to AI Governance, Privacy, Security, Legal and Third Party groups.
Reassessment
Reopen an assessment when an answer changes, and schedule the next cycle from your monitoring frequency.
Optional stage gates
Hold stage advance until acceptance conditions are met. Off by default.
03 Controls and evidence
Applicable controls
A control catalogue where the controls that apply to a system follow from its answers.
Control tasks with reviewers
Tasks carry evidence and need reviewer approval before they count as done.
Connector evidence
Connector runs record configuration evidence with its source and collection date.
07 Why packets
Governance that gets worked through, not just documented
Many tools
Catalogue AI systems or organise evidence, and leave the follow-through to your team.
Systems cataloguedConsultants
Assess your AI use and provide recommendations, often as a report.
Report deliveredpackets
Helps you work through assessments, controls and evidence with an actionable workflow and a Compliance Lead inside your team.
Worked through to approval
Judgement stays human. Your Compliance Lead helps with judgement calls. packets supports expert judgement. It does not replace it.
08 Frameworks
Standards and regulation this work relates to
- ISO 42001
Controls cite ISO 42001 Annex A references.
- EU AI Act
Classification captures roles, high-risk and general-purpose flags. packets does not provide legal advice or automatic conformity.
- ISO 27001
Part of the baseline for AI risks and controls.
- GDPR
Personal data used by AI systems, covered in the data and privacy assessment.
Listing a framework does not mean full coverage, legal compliance or guaranteed conformity.
09 Works with
Read-only cloud connectors
Read-only access to AI configuration across the major cloud providers, granted by your team.
- +More coming
10 Questions
Questions about AI governance
01What does AI Governance in packets cover?
A register of AI systems, lifecycle stages, stage-based assessments, classification and controls, approval groups, control tasks and evidence.
02Does packets find AI tools in use automatically?
Read-only connectors for Azure, AWS and Google Cloud can find AI resources in accounts your team connects. Discovery does not create a system by itself. Your team decides which resources become registered systems.
03Who approves an AI assessment?
Assessments that meet the review conditions go to a named approval group. Some lower-risk assessments are approved automatically. Task completion needs a named reviewer.
04Does this make us compliant with the EU AI Act?
No. It helps you organise governance, controls and evidence. It does not provide legal advice or automatic conformity.
05How does it relate to risks and evidence?
They share the same control engine, so each AI system links to its controls, tasks, risks and evidence.
06Is this available today?
Yes, available.
11 Keep exploring
Keep exploring
12 Get started
Know what AI you run, and who approved it.
Talk to us about how AI governance would work for your team.