Cybersecurity services
Practical cybersecurity: assessments, endpoint protection, email security, training, incident readiness and 24/7 monitoring for managed-service clients.
AI Solutions
AI governance, risk and security
AI tools now touch your documents, email, customer data and business systems, often without anyone having approved them. We help you see where AI is used, set sensible rules, assess the risks of each use and test the AI applications you build or buy, so you can say yes to AI with controls you can explain to a board, an auditor or a client.
Who this service is for
A good fit if
- Staff use AI tools and you do not know which ones, or what information goes into them.
- You are rolling out Microsoft 365 Copilot or building AI assistants and need the controls right.
- A client, insurer, funder or auditor has asked how you manage AI risk.
- You build AI features into products or portals and need them tested for misuse.
- You want to align with a recognized framework such as the NIST AI Risk Management Framework or ISO/IEC 42001.
Another approach may suit you better if
- You need a legal opinion on AI regulation. We work alongside your lawyers and privacy advisers, but we do not give legal advice.
- You want a certificate. We help you prepare for an ISO/IEC 42001 audit, but certification is issued by an accredited certification body.
- You have no AI in use or planned. A short AI readiness assessment is a better first step.
What this service is
AI governance is how your organization decides which AI to use, for what, under which rules, and how it checks those rules are followed. AI security is how you protect AI tools and applications, and the data they touch, from misuse and attack. We bring the two together in practical, proportionate work that fits your size and sector.
For most organizations the first concern is not exotic AI risk. It is ordinary information escaping through ordinary tools: a contract pasted into a free chatbot, a browser extension reading every page, an assistant that answers from files the user should not see. Governance and security controls make AI safe to use at scale.
What we put in place
- Visibility. We find the AI tools in use, using the security platforms you already have, such as Microsoft Defender for Cloud Apps or your firewall and secure web gateway, alongside a no-blame staff survey. Our guide to shadow AI explains why this matters.
- Rules people can follow. A short AI use policy, an approval path for new tools and a register of approved tools and use cases. Our guide to writing an AI acceptable use policy shows what it covers.
- Risk assessment. A consistent method to assess each new AI use for privacy, security, accuracy, bias and business impact, with stronger review where decisions affect people.
- Data protection. Data loss prevention, sensitivity labels and access policies that limit what information reaches AI services, applied through your existing tools where possible.
- Accountability. Named owners, review cycles and reporting that leadership and boards can understand.
Testing AI applications
AI applications and agents introduce new attack paths. We test assistants, chat features and agents for the risks cataloged by the OWASP GenAI Security Project in its Top 10 lists for LLM and agentic applications, such as prompt injection, sensitive information disclosure and excessive agency. Tests use realistic scenarios, such as a malicious instruction hidden in an uploaded document or an attempt to retrieve another user's data. Findings come with evidence, a clear explanation of impact and a retest after fixes. This work complements our broader security assessments.
Frameworks and standards
We use recognized frameworks so your governance holds up to scrutiny. The NIST AI Risk Management Framework and its Generative AI Profile (NIST AI 600-1) organize AI risk work into four functions: govern, map, measure and manage. ISO/IEC 42001 specifies requirements for an AI management system and can be certified by an accredited body. We help you choose a framework, run a gap assessment and build the documents and controls it calls for. Promatics does not certify compliance.
The US context
The United States does not have a comprehensive federal AI law. Federal policy is set through executive orders and guidance, and a December 2025 order directs the Department of Justice to challenge some state AI laws, but state laws remain in force unless courts or legislatures change them. Existing law still applies: the FTC Act covers unfair or deceptive practices, and sector and state privacy laws govern personal information used in AI systems. Obligations that often matter:
- Texas. The Texas Responsible Artificial Intelligence Governance Act (TRAIGA), in effect since January 1, 2026, applies to organizations that do business in Texas or serve Texas residents. It prohibits AI developed or deployed with the intent to unlawfully discriminate, encourage self-harm or crime, or infringe constitutional rights, and requires government agencies and health care providers to disclose certain AI use. The Texas Attorney General enforces it, with a 60-day period to cure. Substantial compliance with a recognized framework, such as the NIST Generative AI Profile, can support a defense but is not a blanket safe harbor.
- Automated decisions. Colorado's law on automated decision-making technology for consequential decisions takes effect January 1, 2027, and California's regulations require businesses that use automated decisionmaking technology for significant decisions to comply by the same date. Illinois and New York City add rules for AI in hiring and employment decisions.
- Health care. An AI vendor that handles protected health information for a HIPAA covered entity is a business associate and needs a business associate agreement. The Section 1557 rule requires covered health programs to identify patient care decision support tools that use protected characteristics, such as race, sex, age or disability, and mitigate the risk of discrimination.
- Public agencies. OMB memoranda M-25-21 and M-25-22 govern federal agencies' use and acquisition of AI. In Maryland, the AI Governance Act of 2024 requires state units to inventory high-risk AI and assess its impact, and the DoIT Responsible AI Policy, which also applies to contractors, requires risk assessments before high-risk AI is deployed.
We design governance with these obligations in view and work alongside your legal and privacy advisers. This is general information, not legal advice; see also our overview of AI laws in the US and privacy and compliance readiness.
What is included
The exact list is agreed in writing for each project. These are the usual deliverables and the usual boundaries.
Typical deliverables
- An inventory of AI use, including tools staff use without approval and AI features inside existing software.
- An AI use policy and staff guidance, drafted for your legal and HR advisers to review.
- A register of approved AI tools and use cases, with owners and review dates.
- A risk assessment method for new AI use cases, covering privacy, security, accuracy, bias and business impact.
- Vendor due diligence on AI tools, including data use for training, retention and zero data retention options, location and security terms.
- Technical controls, such as blocking or limiting unapproved AI services, data loss prevention and access policies, using your existing security platforms where possible.
- Security testing of AI applications and agents for prompt injection, data leakage, excessive permissions and unsafe outputs.
- AI incident response steps added to your existing incident response plan.
- A gap assessment against the NIST AI Risk Management Framework or ISO/IEC 42001, if requested.
- Staff training on safe and effective AI use.
Not included unless agreed separately
- Legal advice and legal opinions on AI, privacy, employment or sector regulation.
- Certification audits, which are carried out by accredited certification bodies.
- Remediation work on systems outside the agreed scope.
- Licenses for security or governance tools, which are billed separately.
What we will need from you
Most delays in this kind of work come from access and decisions, not from the technical build. Knowing these early keeps the project predictable.
- An executive sponsor and a named owner for AI governance.
- Access to security tooling, logs and configuration needed to discover AI use.
- Input from privacy, legal, HR and the business owners of AI use cases.
- Test environments and permission to test any AI applications in scope.
Delivery
How the work is delivered
Each stage ends with something you can review before the next one starts.
Discover
Identify AI use across the organization through security tooling, software inventories, interviews and a short staff survey.
Output: AI use inventory.
Assess
Review policies, data protection, vendor terms and the risks of each significant AI use, and test AI applications in scope.
Output: Risk findings and test results.
Set the rules
Draft the AI use policy, approval process, risk assessment method and register, and agree roles and responsibilities.
Output: Governance documents and register.
Apply controls
Configure technical controls, fix priority findings and add AI scenarios to incident response.
Output: Implemented controls and remediation report.
Train and review
Train staff and owners, then review the register, risks and controls on a regular cycle.
Output: Training records and review schedule.
Testing and handover
- Every approved AI tool and use case has an owner, a risk rating and a review date.
- High-risk findings are fixed or formally accepted by an accountable owner.
- Security test findings include evidence, impact and retest results.
- Policies are written in plain language that staff can follow.
- Governance documents map to the framework you chose, where one was requested.
What affects the cost
We do not publish package prices. Each estimate is based on an agreed scope, in US dollars, with taxes shown separately. These are the things that move the number most:
- The size of the organization and the number of AI tools and use cases in scope.
- Whether existing security tooling can discover and control AI use.
- The number and complexity of AI applications to test.
- Framework alignment or certification preparation, if requested.
- Training needs across teams and locations.
Questions buyers usually ask
Should we just ban AI tools?
Bans rarely work. People use personal devices and accounts instead, and you lose visibility. Approving good tools, setting clear rules about information, and blocking only the riskiest services usually reduces risk more.
Which framework should we use?
The NIST AI Risk Management Framework, with its Generative AI Profile, is a practical, freely available starting point. ISO/IEC 42001 sets out requirements for an AI management system that can be certified. Many organizations start with NIST and move to ISO/IEC 42001 when clients or contracts require certification.
Is there an AI law in the US?
There is no comprehensive federal AI law, but existing laws on privacy, consumer protection and discrimination already apply to AI. States are moving faster. The Texas Responsible Artificial Intelligence Governance Act has been in effect since January 1, 2026, and Colorado and California have rules on automated decisions that apply from January 1, 2027. Sector rules, such as HIPAA, add their own expectations. This is general information, not legal advice.
What is prompt injection?
An attack where instructions hidden in a document, email or web page make an AI assistant or agent ignore its rules, reveal information or take unintended actions. It is one of the main risks in OWASP's Top 10 for LLM applications, and we test for it in every AI application we review.
Do you also secure the AI solutions you build?
Yes. The same controls and tests are part of our generative AI development and AI agents work from the start.
Related
Privacy and compliance readiness
Get your privacy and security practices ready for regulators, clients, auditors and insurers, with gaps found and fixed before someone asks.
Shadow AI and how to control it
Why staff use unapproved AI tools, the real risks for US organizations, and how to find and control shadow AI without banning AI.
Can you show how your organization manages AI risk?
Tell us how AI is used today and who is asking the questions. We will reply to arrange a conversation and outline a governance and security review that fits your size and sector.