Your teams already use AI
Find out which tools have access to company or customer data and who owns each use case.
You know where your data goes
AI Governance Consulting Services
Decide what your AI can do before it does it
Before an AI assistant can read a customer record, draft a reply, or send it, someone has to decide what it can access and who approves the action. Merehead helps you make those decisions and put them into practice.
- Our lawyer specializes in AI regulation
- Our engineers build and test the controls in your software
Legal + engineeringAn AI lawyer and an engineering lead on every review
1–4 weeksTypical length of a focused assessment
3 frameworksNIST AI RMF, ISO/IEC 42001 and the EU AI Act
When to start
When to Start
Governance pays off at three moments: when AI is already in use, when a product is about to launch, and when it is about to reach a new market.
An AI product is close to launch
Decide which actions the system can take, which need approval, and what happens when it cannot complete a task safely.
You launch with clear limits
You're entering a new market
Check which obligations apply to the product and what needs to change in the system or its documentation.
You see what changes before you expand
Services
AI Governance Services
Five services, from the first inventory to safeguards running in your product. Each shows a typical timeline. Start with one or combine them.
01
AI Governance and Risk Assessment
Typical timeline: 2–4 weeks for one workflow or a small set of related use cases.
We trace each use case from the data it receives to the decisions or actions it affects. For an internal assistant, that might mean checking whether a user can retrieve a document they cannot open in the source system.
You getAn inventory of the systems reviewed, the risks we found, and a list of fixes in priority order.
02
AI Policy and Operating Model
Typical timeline: 3–6 weeks to draft the policy and agree on roles, approvals, and escalation procedures.
We write the rules your teams need for approving new AI uses, granting access, and responding to incidents.
You getA policy that names who can approve a change and when a system needs another review, such as after a model swap or a new data integration.
03
EU AI Act Readiness Assessment
Typical timeline: 2–4 weeks to assess one AI system and document applicable obligations and gaps.
Our AI lawyer reviews the intended use of your system and your organization's role to determine which obligations apply. Engineers compare those findings with what the system does today.
You getA written assessment and a list of changes to your product, processes, or documentation, with an owner and a way to verify each change.
04
AI Vendor and Model Risk Review
Typical timeline: 1–3 weeks for one vendor or model, depending on documentation and vendor response times.
We check what data you send to each provider, what the provider says it retains, and how it handles model changes or incidents.
You getA review that records what we can verify, which questions the vendor still needs to answer, and any conditions you want in place before the tool is used.
05
AI Controls Implementation
Typical timeline: 3–8 weeks to implement and test a defined set of controls in one application.
We build the agreed safeguards into the product. Our AI agent development services cover tool permissions, integrations, and limits on autonomous actions. For example, an agent can prepare an invoice while the application requires an authorized person to approve it before sending.
You getWe test the normal workflow and try to bypass the approval. Your team receives the test results and knows who owns the control after release.
Frameworks
How We Use NIST AI RMF, ISO/IEC 42001, and the EU AI Act
Each reference shapes a different part of the work: how risk is owned, how the management system is checked, and which legal obligations apply.
NIST AI RMF
We use Govern, Map, Measure, and Manage to assign risk owners, document how the system is used, decide what to test, and track how each risk is handled.
GovernMapMeasureManage
ISO/IEC 42001
We compare your AI management system with the standard and identify gaps in policies, responsibilities, records, and review procedures.
You get a gap assessment and a plan to address it
EU AI Act
Our AI lawyer assesses applicability and relevant obligations. We map the findings to the changes and evidence your team needs for the systems in scope.
Findings become changes and evidence
Example control
What a Control Looks Like
Here is an example of how we would document a human approval requirement for an AI assistant.
Rule
A staff member must approve an AI-drafted reply before it goes to a customer.
Product behavior
The assistant saves a draft. Only an authorized user can approve it for sending.
OwnerCustomer operations lead
Acceptance test
- 1
Try to send without approval. The attempt should fail.
- 2
Try to approve with an unauthorized account. The attempt should fail.
- 3
Approve with an authorized account and check that the log records the approval and the send.
Client projects
AI Governance Controls in Client Projects
Insurance Claims With Human Oversight
Insurance · Property and casualtyWe built a private knowledge hub and two AI assistants for a property and casualty insurance administrator. The assistants retrieve documents according to the employee's access permissions. When a claim arrives without required information, the claims assistant flags the missing fields and drafts a request from an approved template. The claims handler makes the coverage decision.
Read the insurance case study
Claims intake time fell from 14.5 to 9.1 minutes.
The agent fits into our daily work, and our people stay in control of the decisions.
Team
Who Does the Work
Legal and engineering review the same system side by side, so findings turn into changes your team can act on.
AI lawyerVadym Martsenyuk
Reviews the system's intended use, your organization's role, and the requirements that apply.
- Intended use and your organization's role
- Requirements that apply to the system
Engineering leadAndrew Klimchuk
Reviews data flows, permissions, and actions the AI can trigger.
- Data flows and permissions
- Actions the AI can trigger
Together, they turn findings into changes your team can prioritize and verify. If you hire us to implement those changes, we agree on acceptance tests before development starts.
Discuss your AI systemYes. We start with the available documentation, a walkthrough, and access to relevant settings or logs. The findings distinguish what we verified from what still needs evidence. Our guide to building an end-to-end AI system covers how to test the full workflow before release.
Yes. We can scope the work around one system or workflow, such as an agent that drafts replies using customer account data.
A focused assessment typically takes 1–4 weeks, depending on what we're reviewing. Once we know which systems are in scope, what documentation is available, and whether you need legal review or implementation, we can give you a timeline and cost estimate. The timelines above assume we have access to the relevant materials and people when work starts.
Contact
Discuss Your AI Governance Needs
Tell us what your AI system does, who uses it, and which decision you need to make before launch or expansion.
- Start with one system or workflow, typically 1–4 weeks
- Scope, timeline and cost agreed before work starts
- Legal review and implementation from one team