AI Risk Board Pack Tab A of M

The AI risk register your board can actually read.

Audit committee · AI risk
Tab A · Overview
12 practice areas · 46 services

AI entered the organisation faster than the control environment did. Staff use tools nobody approved; models touch data nobody classified; agents hold access nobody reviewed. Boards are asked to approve the next phase before the last one is governable.

Kulutchka International works on that gap, from the boardroom down: forty-six defined services, ordered so that a recommendation becomes a control rather than a slide.

Exhibit A1 Likelihood × impact

Illustrative
Impact
Low Elevated High 31 open entries
Indicative, not client data. Moves the register exists to make: shadow AI tooling in daily use; prompt and upload data leakage. How it is built

Exhibit A2 Highest-tier entries

Illustrative
Six critical-tier entries, with the owner each control answers to and where it stands.
Ref Service Owner Status
SR-03 AI Risk Assessment & Risk Register Chief Risk Officer In force
SA-01 Shadow AI Discovery & Inventory CISO In review
SA-03 Enterprise AI Assistant Secure Deployment (for example Copilot) IT Director Overdue
GR-01 AI Acceptable Use Policy & Policy Stack General Counsel In force
GR-02 AI Governance Framework & Operating Model Chief Risk Officer Draft
TP-02 AI Data Security & DLP for AI Data Protection Lead In review
Owners and statuses are indicative, like the refs and tiers. Not client data. Open the full register

Tab B Strategy & Readiness

Illustrative
6 services in this area, with the owner each answers to and where it stands.
Ref Service Owner Status
SR-01 AI Security Briefing / Discovery Workshop Chief Risk Officer In force
SR-02 AI Readiness & Maturity Assessment Chief Risk Officer In review
SR-03 AI Risk Assessment & Risk Register Chief Risk Officer In force
SR-04 AI Vision & Strategy Chief Risk Officer In force
SR-05 AI Use Case Triage & Risk Tiering Chief Risk Officer Overdue
SR-06 AI Platform Adoption Security Review Chief Risk Officer In review
Establish where AI is already used, how ready the organisation is to use it safely, and what the board should decide first. Open Tab B

Tab C Shadow AI & Visibility

Illustrative
4 services in this area, with the owner each answers to and where it stands.
Ref Service Owner Status
SA-01 Shadow AI Discovery & Inventory CISO In review
SA-02 Sanctioned AI Enablement CISO In review
SA-03 Enterprise AI Assistant Secure Deployment (for example Copilot) IT Director Overdue
SA-04 AI Access & Usage Control CISO In force
Find the AI already in use without approval, then replace it with sanctioned tools held under control. Open Tab C

Tab D Governance, Risk & Compliance

Illustrative
7 services in this area, with the owner each answers to and where it stands.
Ref Service Owner Status
GR-01 AI Acceptable Use Policy & Policy Stack General Counsel In force
GR-02 AI Governance Framework & Operating Model Chief Risk Officer Draft
GR-03 AI Controls & Guardrails Framework (policy level) General Counsel Draft
GR-04 AI Regulatory Mapping & Compliance Assessment General Counsel In force
GR-05 ISO/IEC 42001 Readiness & Certification Support General Counsel Overdue
GR-06 Continuous AI Governance & Assurance (managed) General Counsel In review
GR-07 AI Ethics, Bias & Responsible AI Review General Counsel In force
Put roles, policies, controls and regulation around AI so that it can be governed, evidenced and audited. Open Tab D

Tab E Third-Party & Data Risk

Illustrative
3 services in this area, with the owner each answers to and where it stands.
Ref Service Owner Status
TP-01 Third-Party / Vendor AI Risk Assessment Data Protection Lead In force
TP-02 AI Data Security & DLP for AI Data Protection Lead In review
TP-03 AI Privacy & Data Protection Advisory Data Protection Lead Draft
Examine the vendors and the data that AI systems touch, and control what leaves the organisation. Open Tab E

Tab F Secure AI Architecture & Engineering

Illustrative
4 services in this area, with the owner each answers to and where it stands.
Ref Service Owner Status
AE-01 Secure AI Architecture Design & Review Head of Engineering In force
AE-02 AI Threat Modeling Head of Engineering In review
AE-03 Secure AI SDLC & MLOps Security Head of Engineering Draft
AE-04 AI Guardrail Design & Implementation Head of Engineering In force
Design the security of AI systems before they are built, and put guardrails on what already runs. Open Tab F

Tab G Agentic AI Security

Illustrative
4 services in this area, with the owner each answers to and where it stands.
Ref Service Owner Status
AG-01 Agentic AI Security Assessment Head of Engineering In force
AG-02 AI Agent Identity & Access Management Head of Engineering In review
AG-03 Agent Safety Controls & MCP Governance Head of Engineering Draft
AG-04 AI Software Supply Chain Security Head of Engineering In force
Give agents their own identity, least-privilege access and hard limits before they are allowed to act. Open Tab G

Tab H Testing & Validation

Illustrative
7 services in this area, with the owner each answers to and where it stands.
Ref Service Owner Status
TV-01 LLM / AI Application Penetration Testing CISO In force
TV-02 AI Red Teaming CISO In review
TV-03 Guardrail & Jailbreak Testing CISO Draft
TV-04 AI Infrastructure Penetration Testing CISO In force
TV-05 AI Exposure Snapshot Scan CISO Overdue
TV-06 AI Model Assurance & Validation CISO In review
TV-07 AI Runtime Defense Analysis CISO In force
Attack the AI, prove what it does under adversarial conditions, and prove it again after repair. Open Tab H

Tab I Monitoring, Response & Resilience

Illustrative
3 services in this area, with the owner each answers to and where it stands.
Ref Service Owner Status
MR-01 Managed AI Security Monitoring / AI Detection & Response Head of Security Operations In force
MR-02 AI Incident Response Planning, Playbooks & Tabletops Head of Security Operations In review
MR-03 AI Incident Response (breach response) Head of Security Operations Draft
Watch AI in production, and contain, investigate and repair when it is attacked or misused. Open Tab I

Tab J Training & Leadership

Illustrative
4 services in this area, with the owner each answers to and where it stands.
Ref Service Owner Status
TL-01 Fractional AI CISO / AI Security Advisor (vCISO) Chief People Officer In force
TL-02 Executive & Board AI Risk Briefings Chief People Officer In review
TL-03 Workforce AI Security Awareness Training Chief People Officer Draft
TL-04 Developer Secure AI Training & Survey Chief People Officer In force
Give the board, the workforce and the people who build AI the knowledge the programme depends on. Open Tab J

Tab K Transactions

Illustrative
1 service in this area, with the owner each answers to and where it stands.
Ref Service Owner Status
TX-01 AI Due Diligence for M&A and Private Equity Head of Corporate Development In force
Examine AI risk, governance, dependencies and value inside a company before a deal closes. Open Tab K

Tab L AI-Enabled Threat Defense & SecOps

Illustrative
2 services in this area, with the owner each answers to and where it stands.
Ref Service Owner Status
DT-01 AI-Enabled Threat Readiness (frontier AI exploit defense) Head of Security Operations In force
DT-02 AI for Security Operations Readiness Head of Security Operations In review
Prepare for attackers who use AI to move fast, and put AI to work inside the security operations team. Open Tab L

Tab M Technology Enablement

Illustrative
1 service in this area, with the owner each answers to and where it stands.
Ref Service Owner Status
TE-01 AI Security Tool Selection, Implementation & Management IT Director In force
Select, install and run the security products the AI programme depends on. Open Tab M
Prepared by
Reviewed by
Approved by
Availability

We are not accepting new clients at present.

Read the availability note

§ 01 · NotesWe are judged by what we hand over, not by what we describe.

Most AI security advice stops at a document. A policy is written, a maturity score is issued, a roadmap is presented, and the organisation is left to find the people who can actually implement it. The register then goes stale within a quarter.

We work the other way. The firm is built so that the same hands that brief the audit committee also perform the penetration tests, run the red team, design the guardrails and operate the monitoring. A control that appears in a policy is a control we can configure, test and evidence. That is why the register holds its shape.

The 46 services in this pack are not a menu to be sampled. They are the chain a programme runs along: establish the exposure, govern it, build the controls, attack them, and keep watching. Read as a chain, the pack answers the only question a board really has — what are we exposed to, who owns it, and what proof will we hold?

§ 02 · Register12 practice areas, 46 services.

Every service carries a reference, a defined output and an owner. Open any tab to read the area in full.

§ 03 · EngagementFive stages, in this order, every time.

The stages follow the register rather than a proprietary method: each one produces the artefact the next one depends on.

  • 01

    Briefing

    A short session on where AI has entered the organisation and which decision the board is actually being asked to take.

  • 02

    Finding

    The assessment that produces the register: risks scored, owners named, and the evidence each entry rests on.

  • 03

    Roadmap

    What gets fixed first, by whom, and inside what window — the 90-day plan that follows the register.

  • 04

    Controls

    The policies, guardrails, access limits, permission clean-ups and tests that turn the roadmap into something enforceable.

  • 05

    Assurance

    Monitoring, retesting and board reporting that keep the register current instead of point-in-time.

§ 04 · CredentialsHeld by the people doing the work.

We publish no client names and no engagement references. What we can evidence is the practitioner record behind the register.

Certification OSWP — Wireless attack and defence
Certification OSCP — Hands-on penetration testing
Certification OSAI — AI security
Qualification Master's — Healthcare IT
Prior role CTO — Healthcare industry
Prior role Consultant — Information security
Prior role Pentester — Application and infrastructure
Prior role DBA — Database administration
Prior role Manager — IT management
Prior role Director — IT direction
Prior role Coder — Software development

Held by individual practitioners of the firm, not by the company as certifications.

§ 05 · AvailabilityWe are not accepting new clients at present.

Capacity is committed to work already under way, so no briefing is running and there is no waitlist to join. The register above stays published: it is written to be used without an engagement, which is exactly how to use it now.

Read the availability note Read the full register first