01 · Public services, permits, justiceGovernment & Public SectorCitizen-facing AI that a minister can stand behind.
01Assurance
AI Validation & Certification
Independent, evidence-based proof that a model does what it claims — before it touches a core workflow.
02Governance
AI Governance & Ethical Checks
An operating model that turns principles into controls, and controls into audit-ready evidence.
03Strategy
AI Advisory
Board-level guidance on where AI creates value, what it puts at risk, and how to build it so it lasts.
04Governments
National AI Agenda
From ambition to a trustworthy national AI ecosystem, on the five building blocks of the BCG × JICA playbook.
05Capability
AI Upskilling
Role-based, certified learning tracks — because a programme is only as robust as the people running it.
06Protection
AI Security
Protect the weights, the data and the compute from insiders, criminals and nation-states — today and post-quantum.
07Data audit
Data Audits, Validation & Fairness
Most model failures are data failures. We audit the data estate, validate every set before it teaches a model, and prove the outcomes are fair for the people the system decides about.
08Leadership
Empowered Leadership & AI Decision Rights
The hardest question in an AI programme is not technical: which decisions a model may augment, which it may automate, and which stay human. We make that call explicit, defensible and reversible.
09Diagnostic
AI Maturity Assessment
Where the organisation actually stands, scored against evidence rather than self-report — and the shortest credible path to the next level.
Sectors
Where trust in AI is hardest to earn.
The same validation, security and policy stack, tuned to the regulators and failure modes of each industry.
02 · QCB · SAMA · DFSA · CBUAEFinancial ServicesCredit, fraud and advice models a regulator can replay.
03 · Upstream, grid, waterEnergy & UtilitiesAutonomy in the field, validated before it touches the grid.
04 · Diagnostics, triage, researchHealthcare & Life SciencesClinical AI with evidence a hospital board can sign.
05 · Networks, data centres, cloudTelecoms & Digital InfrastructureNetwork AI and sovereign compute, attested end to end.
06 · Airports, airlines, hotelsAviation, Travel & HospitalityIdentity and service AI that holds up at peak demand.
The five tests
No system is certified without these five.
Accuracy is table stakes. These are the tests that decide whether a model is defensible in front of a regulator, a board or a court — run on every engagement, with the metrics and the tooling named up front.
01every engagement
Bias & fairness testing
What it tests
Whether outcomes vary across protected groups — race, gender, age, nationality, dialect.
Key metrics
Disparate impact ratio · demographic parity · equalised odds · equal opportunity difference
Why it matters
Decisive for high-stakes models — credit scoring, hiring, benefits. Discriminatory outcomes carry legal, ethical and reputational liability that no accuracy number offsets.
FairlearnAI Fairness 360AequitasBBQ
EU AI Act Art. 10(2)(f) · ISO/IEC 24027
02every engagement
Drift & population stability
What it tests
Accuracy decay over time by comparing live inference data against the training baseline.
Key metrics
Population Stability Index (PSI) · KL divergence · feature quality · prediction drift
Why it matters
Models degrade as the world shifts. Drift testing proves a model is still statistically valid after deployment and fires alerts or retraining before outputs go wrong quietly.
EvidentlywhylogsNannyML
EU AI Act Art. 72 post-market monitoring
03high-risk systems
Algorithmic red teaming
What it tests
Adversarial attacks that deliberately exploit the model’s defence layer.
Key metrics
Prompt injection · jailbreaking · data poisoning · PII leakage · tool and agent abuse
Why it matters
SAST and DAST cannot see AI-specific weaknesses. Red teaming is the empirical proof a model withstands active manipulation and protects corporate and customer data.
garakPyRITARTMITRE ATLASOWASP LLM Top 10
ISO/IEC 42001 A.6.2 · NIST AI RMF MEASURE
04every engagement
Explainability & transparency
What it tests
How the model reached a specific prediction — the decision path, not a plausible story about it.
Key metrics
SHAP values · integrated gradients · counterfactual analysis · feature attribution stability
Why it matters
Regulators require a justification for AI-driven decisions such as a declined loan. This test shows the model reasons on legitimate features instead of operating as a black box.
SHAPCaptumDiCEAlibi
EU AI Act Art. 13 · Art. 86 right to explanation
05every engagement
Grounding, hallucination & provenance
What it tests
For LLM and RAG systems: whether outputs stay tied to a trusted knowledge base.
Key metrics
Faithfulness · context relevance · citation accuracy · toxicity · data lineage & IP boundaries
Why it matters
In agentic workflows a quietly invented fact becomes an operational failure. Grounding tests confirm the output layer adheres to sources and respects copyright boundaries.
RagasDeepEvalTruLensOpenLineage
EU AI Act Art. 50 transparency · Art. 53 GPAI
The toolkit
The tests we run, and what we run them with.
Open, reproducible and vendor-neutral by default: anything in an evidence pack must be re-runnable by your team or a third-party auditor without a licence from us. Commercial tools appear only where an open equivalent does not exist.
Model evaluation01 · 07
Capability & reliability testing
HELMlm-evaluation-harnessInspect (UK AISI)AI VerifypromptfooDeepEvalRagasMLPerfSHAP · CaptumDiCE · Alibi
Task accuracy, groundedness and hallucination rate, refusal behaviour, robustness to paraphrase, latency and cost under load — scored against a frozen test set we hold in escrow.
Data quality07
Data validation & lineage
Great ExpectationsSodaDeequCleanlabDVCOpenLineageDataHubCroissant · datasheets
Expectation suites run as pipeline gates: schema, completeness, duplication, label noise, train/test leakage and poisoning checks — every dataset versioned and documented.
Fairness07 · 02
Bias measurement & mitigation
FairlearnAI Fairness 360AequitasSHAPGiskardBOLD · BBQ · WinoBiasPresidio
Group metrics computed side by side — demographic parity, equal opportunity, equalised odds, calibration — plus counterfactual and dialect probes for Arabic and multilingual deployments.
Adversarial06
Red-teaming & robustness
garakPyRITAdversarial Robustness ToolboxTextAttackCounterfitOWASP LLM Top 10MITRE ATLAS
Automated probe suites plus a human red team: prompt injection, jailbreaks, tool and agent abuse, data extraction, evasion and poisoning — findings mapped to ATLAS techniques.
Supply chain01 · 06
Integrity & attestation
Sigstore · cosignin-toto · SLSASyft · GrypeModelScan · picklescanIntel TDX · AMD SEV-SNPNVIDIA CCKeylime · Veraisonliboqs (ML-KEM · ML-DSA)
Weight hashes, signed build provenance, AI-BOM, unsafe-serialisation scans and hardware attestation quotes — the raw material a Trust Proof is assembled from.
Runtime02 · 06
Monitoring & guardrails
EvidentlywhylogsLangfuseOpenTelemetry GenAIGuardrails AINeMo GuardrailsLlama GuardNannyML · PSITruLens
Input and output filtering, drift and fairness alerting on live traffic, full decision logging — the evidence stream that keeps a certificate valid between audits.
Assurance02 · 03 · 04
Governance & evidence
NIST AI RMF · DioptraISO/IEC 42001 controlsEU AI Act mappingModel cardsMLflow · W&BOpenTelemetry audit trail
A single control library mapped once and reported many ways: one test result satisfies the AI Act, ISO 42001 and your internal audit committee simultaneously.
How we pick a tool. Four rules: it must be reproducible by a third party, versioned so a result can be re-run years later, mapped to a named framework control, and replaceable — no test we run should lock you to a vendor, including us.
How we engage.
Best practice in AI assurance has five rules, and we hold ourselves to them: assessment before build, independence between the team that builds and the team that assures, every control mapped to a named framework, measurable outcomes, and capability handed over — not held hostage.
Step 1 · 2–3 weeks
Diagnose
Fixed-scope maturity and risk diagnostic. Inventory, exposure, gap map, priorities.
Step 2 · 4–8 weeks
Design
Target operating model, control set, architecture and roadmap — agreed with the board or the ministry.
Step 3 · 3–12 months
Deliver
Build–iterate–roll out with your teams. Evidence captured as we go.
Step 4 · continuous
Assure
Independent validation, runtime attestation, re-certification on every release and every new rule.