AI Governance & Responsible Adoption
Governance frameworks for organizations putting AI into use
An engagement produces one of three things: a readiness assessment measured against published standards, a written governance framework that assigns approval and oversight of each AI system to a named role, or continuing review and advice once that framework is in use.
The frameworks we work from
The NIST and ISO documents apply to any organization. The two OMB memoranda set requirements for federal agencies, so we use them when the client is a federal program office or supports one.
- NIST AI Risk Management Framework (AI RMF 1.0)NIST AI 100-1, January 2023
The gap analysis works through its four functions (GOVERN, MAP, MEASURE, MANAGE) one subcategory at a time, recording whether the organization already does what each subcategory describes and what evidence shows it.
Decision-rights work starts from GOVERN 2.1; the framework we write names who approves each AI deployment and who takes an escalation.
- ISO/IEC 42001:2023AI management system standard
Clauses 4 through 10 and the Annex A controls are the checklist for whether AI policy, roles, impact assessment, and internal audit are written down and assigned to someone.
Wallis Consulting does not certify organizations to the standard.
- OMB Memorandum M-25-21Federal agency use of AI, April 2025
On federal work, the framework assigns each of the memo’s requirements, from the AI use case inventory to the minimum risk management practices for high-impact AI, to a named owner and a review step.
- OMB Memorandum M-25-22Federal acquisition of AI, April 2025
For AI an agency buys, the framework sets the point early in the acquisition where a proposed purchase is checked for high-impact use, so a bought system goes through the same risk review as one built in-house.
Engagement models
| Readiness assessment | Framework implementation support | Ongoing review and advisory | |
|---|---|---|---|
| Deliverable | A written readiness assessment of the organization’s current AI governance. | A written AI governance framework for leadership to adopt as the organization’s policy. | A written review of each AI system proposed for use, and updates to the framework when NIST, ISO, or OMB guidance changes. |
| For | Organizations that want to know where their AI governance stands before they commit to building a framework. | Organizations ready to set up an AI governance function, including federal program offices subject to OMB M-25-21. | Organizations that have adopted a governance framework and want an outside reviewer applying it. |
| Scope includes |
|
|
|
Readiness assessment
- Deliverable
- A written readiness assessment of the organization’s current AI governance.
- For
- Organizations that want to know where their AI governance stands before they commit to building a framework.
- Scope includes
- Inventory of current AI use cases, with a risk tier for each
- Gap analysis against the NIST AI RMF and ISO/IEC 42001
- Decision-rights and accountability mapping
- Workforce readiness gap analysis
- Prioritized implementation roadmap, with the reasoning behind its order
Framework implementation support
- Deliverable
- A written AI governance framework for leadership to adopt as the organization’s policy.
- For
- Organizations ready to set up an AI governance function, including federal program offices subject to OMB M-25-21.
- Scope includes
- Decision rights and an oversight structure fitted to the organization’s risk profile
- An AI risk tiering policy and the review process for each tier
- Model documentation and reporting standards
- Workforce briefing materials and an AI literacy primer
Ongoing review and advisory
- Deliverable
- A written review of each AI system proposed for use, and updates to the framework when NIST, ISO, or OMB guidance changes.
- For
- Organizations that have adopted a governance framework and want an outside reviewer applying it.
- Scope includes
- Risk tier assignment for each proposed AI use case, with the reasoning recorded
- Standing decision support on who may authorize an AI deployment
- Governance input to internal AI investment and prioritization decisions (advisory only)
Research behind the advice
Our AI governance advice draws on Austin’s doctoral research in strategic management (DBA, Liberty University) examining how organizations govern AI, adopt it responsibly, and prepare their workforces for it. The frameworks we write cite the standard, memorandum, or peer-reviewed study each requirement comes from, so a client’s reviewers can check it against the source.
Research notes on Perspectives cover AI decision rights, operator trust in AI-enabled systems, and AI literacy curriculum, each with its sources listed.
Out of scope
Not AI model development or training
Wallis Consulting does not build or train AI models. Our governance work covers models built by the client’s own technical teams or by AI firms it hires.
Not procurement representation
We do not represent vendors selling AI products into client organizations.
Not generic AI consulting
The work stays within AI governance: frameworks, decision rights, risk tiering, and the workforce preparation they require. AI strategy decks and visioning workshops fall outside it.
A first consultation looks at the AI systems your organization uses or plans to adopt and which of the three engagement models fits them.