Sectors
Any business. These fields we know especially well.
We advise leaders in private and public organizations. In the fields below we also know the rules you answer to and the ways things usually go wrong.
- 01
Government & Public Safety
AI and online services used by the public, where a failure makes the news. Purchases get a close look, the law says who is accountable, and your records have to be ready for an audit before anyone asks.
Where we are useful
- Checking which AI suppliers you rely on too heavily
- Written risk reviews for program decisions
- Security checks of AI used by the public
- Clear records of who is responsible for what
- Practice runs for AI used in public safety
Rules and risks to plan for
Federal and provincial buying rules, privacy impact assessments, accessibility standards, security clearances, and the political cost of an AI failure.
- 02
Financial Services
Banks, insurers, and fintech. Rules already cover the risk in your models, leaning on a few big suppliers, and keeping services running, and AI makes all three harder at once.
Where we are useful
- Dollar estimates for AI and model risk (FAIR)
- Checking how much you rely on a few suppliers
- Practice runs for keeping services running
- Proof your controls work, ready for regulators
- Checks for bias and fairness
Rules and risks to plan for
OSFI guidelines (B-10 on suppliers, E-23 on models), PIPEDA privacy law, model risk rules like the US SR 11-7, rules on explaining AI decisions, and the growing overlap between AI rules and rules on keeping services running.
- 03
Healthcare
AI that helps with patient care or runs the back office, where a wrong answer can reach a patient. Privacy, safety checks, and what to do when something goes wrong have to be built in from the start, not checked afterwards.
Where we are useful
- Safety and risk review of AI used in care
- Who to alert when a patient may be affected
- Privacy and data-handling review
- Mapping which suppliers you rely on
- What to do when AI-assisted care goes wrong
Rules and risks to plan for
Health privacy laws (HIPAA in the US, PHIPA in Ontario), clinical safety testing, health AI ethics guidelines, and who is liable when an AI recommendation is wrong.
- 04
Energy & Utilities
Systems people rely on every day, where AI that predicts and tunes operations is starting to reach the machines that run the plant. The big question is how much to rely on systems that must not fail.
Where we are useful
- Risk where office computers meet plant machinery
- How much grid and plant operations rely on AI
- Plans to keep running and to recover
- Security checks for critical systems
- Preparing for new rules
Rules and risks to plan for
Security rules for critical infrastructure, safety standards for systems that must not fail, environmental and regulatory reporting, and security for the systems that control plant equipment.
- 05
Technology & SaaS
Companies adding AI features, and AI that takes actions on its own, at the speed they ship software. Customer trust is what you sell, so security reviews have to keep up with every release.
Where we are useful
- Security review of AI features and AI agents
- Working out how an attacker would go after your AI
- Risk from your platform and software suppliers
- Keeping AI under control without slowing releases
- How to talk to customers about AI and security
Rules and risks to plan for
SOC 2 audits, what customers expect you to tell them about AI, how you handle customer data, watching what your AI actually does, and the damage to your name if your AI fails in public.
- 06
Professional Services
Law firms, consultants, and advisers using AI with confidential client information. The big question is which work to hand to AI and which to keep in human hands.
Where we are useful
- A plain plan for adopting AI, risks included
- Keeping client information confidential
- An AI use policy you can defend to clients
- Security review of your document systems
- Meeting your professional standards
Rules and risks to plan for
Client confidentiality, professional rules and privilege, keeping each client's data separate, and AI use policies that hold up when a client audits you.
Start here
Don't see your field? Get in touch anyway.
Tell us what your business does and what's worrying you. We'll tell you plainly what we'd look at first.
We’ll reply in writing: what we’d look at first, and a quote.
