AI governance has moved from a nice-to-have to a board level obligation in the space of two years. The regulatory picture is getting denser, the tools are multiplying, and a crowd of advisers who were selling something else last year now describe themselves as AI governance specialists. For a buyer, the risk is no longer finding someone to help. It is paying for a polished framework that never changes how the organisation actually uses AI.
The most reliable defence is to treat the first meeting as an interview and arrive with your own questions. These five do the most work.
Table of Contents
1. Have they been accountable for AI in production?
Governance written by people who have never carried responsibility for a live system tends to read well and fail quietly. A policy is easy to write. Deciding whether a model can go live on a Friday, with a known weakness and a commercial deadline, is the hard part, and that is where experience shows.
Ask for named organisations, the scale of the deployments and the decisions the consultant personally owned. Then ask for one thing that went wrong and how it was handled. A credible answer includes the cost, the uncomfortable conversation with the board and what changed afterwards. If every story ends in success, or the references are vague mentions of “working with AI teams”, you are talking to an observer, not a practitioner.
2. Can they be precise about the law and the standards?
The EU AI Act is a specific piece of legislation with defined obligations, categories of risk and penalties, and it reaches many UK businesses that sell into Europe or use European suppliers. A good AI governance consultant should be able to tell you which provisions apply to your organisation, how the general-purpose AI rules differ from the high-risk system requirements, and where the implementation timetable stands today, because it has been under active revision. If they cannot separate those, they are not current.
They should be just as clear about the standards. ISO/IEC 42001, the NIST AI Risk Management Framework and UK sector guidance overlap without matching, and a UK firm may face several at once. Ask how they reconcile them, and if the answer is a proprietary methodology, ask what it is built on and how it maps to ISO 42001. Directors who want to prepare before that conversation can start with the EU AI Act questions boards are asking most often.
3. Will they find the AI you do not know you have?
You cannot govern what you cannot see. Most organisations discover that their AI estate is far larger than the official list, for two reasons.
The first is shadow AI: models and tools adopted by individual teams without central oversight. The second is third-party AI. Most businesses buy their AI rather than build it, and it arrives embedded in HR software, customer service platforms and financial reporting tools. Your compliance exposure includes all of it.
Ask the consultant how they build and maintain a model inventory: a register of every system, its purpose, its risk classification, its owner and its governance status. Ask how they assess supplier compliance and where your contracts need strengthening. A rigorous adviser will describe a repeatable method. A weak one will describe a workshop.
4. Can their governance stop a system, or only record what happened?
A framework that lives only in documents is aspiration, not control. The harder question is what happens at the moment an AI system is about to do something consequential. Can the governance intervene, or does it merely log the outcome afterwards?
A good adviser knows the landscape of monitoring, drift detection, runtime policy enforcement and audit tooling, and can explain what “fail-closed” would mean in your environment. They should also be candid about the limits. Software can flag that a model has drifted from its baseline. It cannot decide whether that matters to the business, who needs to act, or what the board should be told.
That is why the human side counts as much as the technical side. Ask how they build AI literacy, escalation routes that work under pressure and board-level ownership of AI risk, rather than delegating it to legal. Ask how they will know the governance is changing behaviour, not just whether the paperwork exists. Anything else, frankly, is just “process theatre”. The MASTER-AI framework is one example of an approach that connects inventory, risk classification and board accountability in a single structure.
5. Is the plan proportionate, and will they make themselves redundant?
ISO 42001 can be applied lightly in a fifty person firm and rigorously in a global group. A credible consultant gives you a sequenced roadmap sized to your complexity, AI maturity and appetite for risk, not a generic project plan that assumes unlimited time and budget. Ask what the first thirty days look like, what good looks like at six months, and whether full certification is even the right goal for you.
Then ask the question most buyers forget: what happens when the engagement ends? Governance is a continuing management discipline, not a one off project.
The best advisers build your internal capability and plan their own exit. If every answer points towards a longer retainer, treat that as information.
Putting the questions to work
None of these questions is unfair, and the best consultants welcome them. They have seen the inside of real deployments, handled real compliance problems and left organisations behaving differently, not just publishing different policies. If the answers feel thin, keep looking.
For boards that want an independent view of where they stand, Alchemy Consulting works with leadership teams on AI strategy, governance and readiness, drawing on senior experience of running technology in complex, regulated organisations. If you would like help with any of the above, speak to an independent AI governance consultant at Alchemy to talk through what a proportionate, practical response looks like for your organisation.
