Responsible AI governance · Confident compliance
AI your stakeholders can trust.
EU AI Act readiness and gap analysis
Book a callExplore our AI services
The development and use of artificial intelligence bring new challenges — including algorithmic transparency, data provenance, explainability and regulatory readiness. Our Responsible AI Governance & Compliance service helps you unlock the potential of AI while supporting responsible, fair, transparent and compliant AI practices.
Responsible AI Governance & Compliance
A single governance model bridging privacy, ethics and AI regulation.
Our Responsible AI Governance & Compliance Service helps organisations govern, deploy and oversee AI responsibly — integrating privacy, ethics and regulatory compliance into a single, practical framework.
Designed for both AI deployers and providers, as well as organisations exploring the role of AI in their operations, our services can be delivered as standalone consultancy support or as an extension to our outsourced DPO offering.
Structured approach
Built on HewardMills' proven four-pillar framework.
We take a holistic view of AI governance and data protection, structuring our support around HewardMills’ proven four-pillar framework — with AI Risk Management & Assurance embedded across every area.
Pillar I
Corporate Governance
Building leadership confidence through robust governance, accountability and strategic oversight.
- Regulatory & compliance landscape mapping
- EU AI Act readiness
- AI governance frameworks
- Decision support for governance bodies
- Roles & accountability mapping
- AI data governance, lineage & provenance
- Documentation & explainability frameworks
Pillar II
Privacy Operations
Embedding AI governance into operational privacy, compliance and risk controls.
- AI inventories
- Integrated impact assessments (AIAs)
- Privacy-enhancing technologies
- Vendor & contractual governance
- Fairness, bias & accountability reviews
- Technical & ethical assurance
- Control effectiveness monitoring
Pillar III
Policies & Procedures
Turning regulatory requirements into practical, operational policies and processes.
- Dedicated AI policies
- Automated decision-making
- AI transparency statements & disclosures
- Stakeholder communication
- Human oversight procedures
- Regulatory & audit support
Pillar IV
Training & Enablement
Building organisation-wide capability for responsible AI adoption.
- Ground-up training
- Board & executive briefings
- Specialist technical & compliance training
- Responsible AI playbooks & enablement guides
- Culture & awareness initiatives
Cutting across all four pillars
Embedded AI Risk Management & Assurance
Structured, defensible AI risk practices — embedded across governance, operations, policy implementation and capability building.
- AI risk management frameworks
- AI risk classification
- Integrated AI risk assessments
- Continuous risk monitoring
- Governance dashboards & reporting
- Risk escalation pathways
Flexible delivery
Delivery that suits your organisation.
Engage us in the way that fits your maturity, resourcing and goals.
Standalone consultancy projects
Targeted advisory engagements
Ongoing governance & assurance support
A modular extension to our outsourced DPO services
Need support with AI governance, risk or EU AI Act readiness?
Use case examples
AI governance support in action.
Our responsible AI governance and compliance services support a breadth of real-world AI use cases.
Conducting an AI DPIA for an algorithmic decision system (e.g. recruitment)
Creating an AI transparency statement for customer-facing chatbots or tools
Preparing for EU AI Act obligations (classification, documentation, CE marking)
Reviewing model bias and fairness testing documentation
Advising on privacy-preserving data strategies for machine learning
Experts
HewardMills' AI Governance Council
Our AI Governance Council is at the forefront of our AI governance expertise, bringing together senior specialists to ensure our clients receive market-leading advice on the safe, responsible, and compliant use of AI.
The Council sets and oversees the standards behind our AI governance methodology, providing strategic direction, quality assurance, and expert interpretation of emerging legal and regulatory developments. This ensures every engagement benefits from a consistent, robust, and forward-looking approach.
By combining deep technical, legal, and governance expertise, our Council helps organisations embrace AI with confidence; managing risk, meeting regulatory expectations, and unlocking the opportunities AI can deliver.
Christine brings over 17 years of experience in logistics, international development, and global operations, leading strategy and operations for global development programmes and services and delivering business transformation projects in complex, high-risk environments.
Her international career spans humanitarian operations in Sudan, South Sudan, Haiti, and Ethiopia with organisations including the United Nations, Médecins Sans Frontières, and the Norwegian Refugee Council — a background that underpins her ability to navigate uncertainty, assess risk, and deliver under pressure.
As COO and AI Governance and Ethics Lead, and a Certified Responsible Generative AI practitioner, Christine helps organisations adopt AI confidently — balancing regulatory compliance, operational resilience, and responsible innovation.
Christine chairs HewardMills' AI Governance Council, leading the strategic direction of the firm's AI governance services to ensure they combine operational practicality, ethical oversight and regulatory alignment.
Christine is also Co-Founder of Protect Black Women, reflecting her commitment to equity and systemic change.
Languages: English, French, Norwegian
Bushra is a privacy, data protection and AI governance expert with over a decade of experience advising leading global firms. At HewardMills she leads the delivery of outsourced Data Protection Officer and privacy advisory services across clients in higher education, financial services, technology, consumer and hospitality, and sits on the HewardMills AI Governance Council.
She was previously Global Head of Privacy and Data Protection at BlackRock, where she built the firm's global privacy function from the ground up, designing the strategy, operating model and policy framework and leading a global team across all business areas including Aladdin. Reporting to the Group General Counsel, she advised executive leadership and local country boards, chaired the Privacy and Data Protection Committee, and served on the firm's AI Committee, setting standards and policy for artificial intelligence alongside executive leaders across the business.
Earlier roles include Associate Director at KPMG UK, where she was Privacy Lead for Insurance and Investment Management, and lead privacy consultant on the A4 Cloud Project, a European Commission initiative supported by HP and SAP.
Bushra holds an LLB (Honours) and an LLM from the University of London.
Languages: English, Urdu
Jesal is a Fractional General Counsel and privacy professional with more than 13 years of in-house legal experience building legal, privacy, compliance, and governance programmes for high-growth technology companies.
She specialises in translating complex regulatory requirements into practical governance frameworks that enable innovation while managing legal, privacy, and operational risk. Her experience includes developing enterprise privacy programmes, designing governance processes, leading post-acquisition integration of legal and compliance functions, and supporting AI-enabled technology companies on privacy, contractual risk, and AI governance.
As a member of the HewardMills AI Governance Council, Jesal draws on her background as an in-house legal and privacy leader to support the development of practical AI governance methodologies, policies, training, and client-facing frameworks.
Jesal holds the CIPP/E, CIPP/US, and CIPM certifications from the International Association of Privacy Professionals (IAPP).
Bostjan brings 17 years of advisory experience across data protection and privacy, telecoms market regulation, and more recently AI ethics, having worked with innovative tech businesses, telcos, and regulators from East London Tech City and Central Europe to Silicon Valley and the Gulf. The geographic and sectoral breadth of his experience means he is fluent in how digital regulation actually plays out across different markets, regulatory frameworks, and stages of technological maturity.
Bostjan provides clients with senior guidance on complex regulatory questions, bringing the depth and cross-regime perspective needed where issues sit at the intersection of established rules and emerging frameworks.
He is also a member of HewardMills' AI Governance Council, helping to ensure the firms AI governance services reflect the realities of evolving regulation across international markets and keep pace with emerging technologies.
Ben is an AI governance and data protection specialist. He holds ISO/IEC 42001 Lead Auditor and Lead Implementer certifications, both accredited by the ANSI National Accreditation Board (ANAB) to ISO/IEC 17024, alongside CIPP/E and CIPM. A Doctorate holder and statutory Data Protection Officer, he leads on AI governance methodology within HewardMills’ AI Governance Council and is an AI CERTs Advisory Board member and instructor across more than 30 certification programmes.
Cristina is a Spanish bilingual Subject Matter Expert with nearly a decade of experience at the intersection of technology and privacy. Her bilingual capability and dual perspective on European and Spanish-speaking markets enables her to provide clients operating across these regions with guidance that is culturally and commercially sound.
Cristina works closely with client teams to provide expert guidance on data protection and AI matters, bringing the technical fluency and multidisciplinary perspective needed to navigate the questions sitting at the leading edge of privacy and emerging technology. She also acts as External Ethics Advisor to multiple EU-funded projects, helping to bridge the gap between technological innovation and its ethical, legal and societal implications.
As a member of HewardMills' AI Governance Council, Christina helps to shape the governance frameworks, methodologies and standards that underpin HewardMills' Responsible AI Governance and Compliance services.
Languages: English, Spanish
Elena is a California-licensed attorney working at the intersection of technology, privacy, cybersecurity, and commercial law, with particular focus on legal operations, contracting, and emerging technology.
Her perspective is shaped by experience across policy, academic, and government environments, including the Future of Privacy Forum in Singapore, the Harvard Law School Cyberlaw Clinic, and the Department of Defense Cyber Crime Center. This breadth means she understands how privacy and cybersecurity play out in practice across jurisdictions, sectors, and operational realities.
Elena works closely with clients to translate complex technology-related risks into clear, actionable guidance to bridge the gap between regulatory compliance and operational decision-making.
She is also a member of HewardMills' AI Governance Council, helping ensure the firm's AI governance services bridge the gap between legal requirements, technological innovation and operational reality.
Languages: English, Spanish
Ley specialises in AI governance across the full product lifecycle, from early development decisions through to post-deployment evaluation. Her areas of focus include bias and fairness auditing, international AI standards, the EU AI Act, and research-led approaches to emerging governance questions. This combination of technical depth and engagement with the evolving research landscape positions her well to advise on the issues sitting at the leading edge of AI governance.
Ley works closely with client teams and external stakeholders to translate complex AI governance requirements into practical guidance, drawing on standards, regulatory frameworks, and current research to support decisions that hold up to scrutiny as AI regulation continues to evolve.
She also sits on HewardMills' AI Governance Council, helping ensure clients benefit from AI governance informed by current research, international standards and evolving regulation.
Languages: English, Norwegian, German
Steve brings broad experience in data governance and data protection law, including leading large, multi-million-pound projects across Europe with both governments and private corporations. His exposure to public and private sector work at scale gives him a grounded understanding of how data governance challenges look from very different vantage points.
He also has extensive experience with ISO standards, including the implementation and build-out of ISO 27001 and ISO 27701. This enables him to advise clients on how to establish and operate the information security and privacy management systems that increasingly form the backbone of regulated, audit-ready operations.
As a Subject Matter Expert, Steve regularly provides senior guidance on complex engagements and queries where data governance, privacy, and information security standards considerations are involved.
He also serves on HewardMills' AI Governance Council, helping shape and deliver AI governance services that are practical, auditable and aligned with international standards.
Languages: English, Welsh
How we engage
Let's get started.
Our support brings a dedicated layer of AI-specific expertise, assurance and independent oversight to your AI activities. We start by understanding your AI objectives and strategic priorities, before assessing your current AI governance and maturity against regulatory frameworks and internal policies — which then informs a tailored workplan and implementation roadmap.
1. Scoping session
Understanding your AI landscape, current initiatives and strategic priorities.
- Setting expectations on objectives
- Aligning timelines
- Identifying key stakeholders
2. Gap analysis
A detailed assessment of AI governance and maturity against the EU AI Act, GDPR and your internal policies.
- Evidence-based view of strengths
- Vulnerabilities surfaced
- Immediate risk areas flagged
3. Tailored workplan
A roadmap of recommended actions, priorities, timelines and resource requirements, aligned with your overall data protection and privacy programme.
- Prioritised, actionable steps
- Resource and timeline guidance
- Forms the basis for implementation
Ready to take the next step?
Responsible, compliant AI from day one.
Connect with an AI governance and compliance specialist today, and build the governance, assurance and transparency your stakeholders expect.
