Focaloid governs AI through a nine-phase lifecycle, with a documented go/no-go gate between every phase - from the first intake conversation to the day the system is retired. Mapped to the EU AI Act, the NIST AI RMF and ISO/IEC 42001, so the evidence you produce once counts everywhere. You get a signed governance verdict, not a dashboard of numbers.
An AI model is an engine. Governance is the rest of the car - the brakes, the dashboard, the service log and a named driver. Without them you don't have a vehicle, you have a fast object with no way to stop it. These are the failures that happen, and none of them are hypothetical.
Governance is a thread, not a final gate. It starts before anyone writes code and doesn't stop until the system is decommissioned. Govern runs across all nine phases; Map, Measure and Manage own their stretch of the build. And it's a loop - Phase 9 feeds its findings straight back into Phase 1.
The lifecycle is mapped to each framework, so a single body of evidence satisfies all three. No parallel compliance projects, no second team producing the same artifacts in a different format for a different auditor.
The tooling market is split. GRC platforms govern from the policy side. MLOps platforms govern from the model side. They meet - badly - at the Design → Build → Deploy seam, and nobody has closed it. That gap is where ungoverned AI actually ships.
Brand examples are illustrative, not endorsements - we compose to whatever stack you already run.
Observability tools tell you what happened. Neither a trace nor a drift chart is an answer to “show me this system was approved, by whom, against what bar.” That answer is an artifact, and it's what we hand over.
One per phase, signable. Model card, eval and red-team results, data lineage, threat model, the DPIA where personal data is involved, the go/no-go decision and any conditions attached to it. The document a client's risk team or a regulator can read end to end.
The AI inventory that stays current. Every system, its risk tier, its owner, its gate history, its residual risk, its review dates. The thing an auditor asks for first and most organisations cannot produce.
Sample templates are being finalised with our delivery team - enter your email and we'll send the current redacted pack, or reach us at connect@focaloid.com.
“The team is responsible” is how governance fails. Each phase names who is Accountable (one person, the decision), who is Responsible (does the work), and who is Consulted and Informed. Eight roles carry the lifecycle between them.
Governance costs almost nothing when it's threaded through from Phase 1 - and the evidence pack assembles itself as you go, because every gate produced one. You ship with the proof already in hand.
You have AI in production and a customer or regulator is asking questions. We run the lifecycle backwards over what exists - inventory it, risk-tier it, evaluate and red-team it, document it, and close the gaps that matter. You end up with the evidence you should have had.
A structured, eight-dimension diagnostic of your AI estate. Scored, with a profile of your strengths and gaps and a practical 90-day roadmap. Fixed scope, fast, and it ends with something you can act on rather than a proposal.
Your score is computed in your browser and shown instantly - nothing is sent until you ask for the full report.
The Health Check, scored, with a prioritised 90-day plan. Where most engagements begin.
Start hereTake a single AI system end to end through the nine phases - the full evidence pack and a signed verdict.
Indicative - being finalisedInventory, policy and a Living Register across every AI system you run - governance as a standing capability.
Indicative - being finalisedThe full AI management system, prepared for certification against ISO/IEC 42001.
42001-alignedThe EU AI Act applies to us and we don't know what we'd have to show.
An enterprise customer's risk review is holding up the deal.
We shipped AI fast and now we can't evidence any of it.
We have agents taking real actions and no one can say what they did, or why.
Our board asked who is accountable for the AI, and the room went quiet.
We need ISO 42001 or our procurement stalls.
Usually a CTO, VP of Engineering, Head of Risk or Compliance, a DPO, a CISO, or a founder whose deal is stuck in a security questionnaire - in Europe, the UK and the US.
Nine phases, eight gates, a RACI and an artifact per phase - proprietary, documented, and mapped to three frameworks. Most firms bring principles. We bring a lifecycle.
We build agentic systems in production. We know what a guardrail costs, where a trace has to be wired, and why a red-team finding is real - because we've had to fix them.
Our artifact packs span the Design → Build → Deploy gap that GRC and MLOps platforms each stop short of. That's the whole reason the method exists.
We don't resell a platform. We compose to whatever stack you already run - and we'll tell you when a tool you already own is enough.
If you place AI on the EU market or your output is used there, usually yes - regardless of where you're headquartered. What changes is your role (provider or deployer) and your risk tier, and that classification is exactly what Phase 1 settles.
No. The NIST AI RMF is becoming the de facto US bar, state laws are arriving, and your enterprise customers' security reviews already ask these questions. The same lifecycle answers all of it.
A gate is a five-minute documented decision, not a committee. Threaded in from Phase 1 the overhead is small - it's the retrofit, after someone asks for evidence you never captured, that's expensive.
Yes - that's the review-ready path. We run the lifecycle backwards over what's already in production, and close the gaps that matter.
No. We compose to the stack you already run, and we'll tell you when what you own is enough. Our artifact packs are the connective tissue - that's the part no platform sells.
A signable Evidence Pack per phase, a Living Register of your AI estate, and a scored maturity profile with a 90-day roadmap. Documents you can hand to a client, an auditor or your board.
Fixed scope and fast - you get a scored profile and a prioritised roadmap, not a proposal. It's the cheapest way to find out how exposed you actually are.
Start with a Governance Health Check - eight dimensions, scored, with a 90-day roadmap out the other side. It's how we turn “trust us” into evidence you can put in front of a client.