Service
Risk, compliance, and explainability for production AI — built into the system, not bolted on after the auditor arrives.
Frequently Asked
End-to-end controls across the AI lifecycle: model inventory, risk classification, data lineage, evaluation, deployment approval, runtime monitoring, incident response, and audit. Both classical ML models and generative AI.
Especially then. Vendor models shift the failure surface — you do not control the weights, the training data, or the version. Governance becomes about your data, your prompts, your outputs, and your accountability — none of which the vendor owns.
We build a single control framework that satisfies multiple regimes — DPDPA 2023 for Indian customer data, RBI guidance and the draft FREE-AI framework for BFSI, EU AI Act risk categories for European exposure, and NIST AI RMF as the engineering backbone. One implementation, multiple audit-ready outputs.
It's a service that builds a system. We assemble the control stack from open and commercial components — model registries, eval frameworks, prompt registries, gateways, observability — configured to your risk taxonomy. No vendor lock-in unless you want one.
Joint ownership: CIO/CTO for engineering controls, CISO for security and data protection, Legal/Compliance for regulatory mapping, and an AI/Model Risk function (often new) for ongoing oversight. We help stand up the operating model alongside the technical controls.
Controls as Code
What we build
We design and implement governance frameworks that let enterprises ship AI faster — by removing the ambiguity, not adding to it. Risk taxonomies, model inventories, eval and monitoring infrastructure, policy enforcement, and the audit trails that survive a regulator’s questions.
Governance done well is an accelerator. Done as paperwork, it becomes the thing the engineering team routes around. We build it as code.
How we approach it
- Inventory before policy. Every model, prompt, and integration — classical ML, foundation-model calls, RAG pipelines, agents — into a single registry. You cannot govern what you cannot see.
- Risk classify against a real taxonomy. EU AI Act categories, RBI model risk tiers, internal materiality bands. Each model gets a level; each level gets a control set.
- Controls as code. Eval gates in CI, policy interception at the gateway, observability in the runtime, drift monitors on the data. Manual checklists are an antipattern.
- Operating model. Approval boards that meet weekly not quarterly. Incident playbooks. Quarterly attestation. Clear RACI between engineering, security, legal, and the AI/MRM function.
- Audit-ready by default. Every prompt, retrieval, tool call, and human override logged in a tamper-evident format. Replay any interaction six months later, exactly as it ran.
Frameworks we work to
- India: DPDPA 2023, RBI Master Direction on IT Governance, RBI FREE-AI framework, SEBI AI/ML disclosure norms, MeitY AI advisory, IndiaAI Mission guardrails.
- Global: NIST AI RMF, ISO/IEC 42001, EU AI Act, GDPR, US executive orders on AI, sector-specific (HIPAA, GLBA, SR 11-7).
We don’t pick favourites. We map your obligations once and build controls that satisfy multiple regimes simultaneously.
Capabilities
- AI/ML model and prompt inventory (technical + organisational).
- Risk taxonomy and classification, tiered to regulatory and internal materiality.
- Eval frameworks: capability, safety, bias, drift, adversarial robustness.
- Runtime policy enforcement: input filters, output guardrails, DLP, PII redaction, jailbreak detection.
- Observability and audit logging — prompts, retrievals, tool calls, human overrides — tamper-evident.
- Incident response playbooks and tabletop exercises.
- Board and regulator-facing reporting templates.
Where it fits
Banks, NBFCs, insurers, capital markets firms, healthcare providers, public-sector deployments, and any global enterprise with EU exposure. If a regulator can ask “how did the model decide that?”, you need this.
Why Eldridge Morgan
We treat governance as engineering, not compliance theatre. The controls we build are owned by the same teams that own the models — so they hold up the day a real incident happens, not just the day of the audit.
Sectors Served
Related Reading
- DPDP Act and Generative AI: What Indian Enterprises Must Implement
- Cutting Loan-Underwriting Cycle Time 70% at an Indian NBFC
- Building an AI Audit Trail Regulators Will Actually Accept