Independent AI Risk · Security · Safety · Governance Assurance

AI that stands upto scrutiny.

Alacrix independently assesses AI systems before, during and after deployment to determine whether their risks are understood, their security and safety controls are effective, their governance is accountable, and their operation can be evidenced.

Book an AI Assurance Review See how independent assurance works

Independent assurance positionFig. 01

Understand the risk. Test the controls. Assess residual exposure. Decide whether the system is ready.

01Builder, internal team or vendor builds the system02Alacrix independently challenges and tests it03Residual risk stated, not absorbed04The organisation decides whether to deploy

Independent × Evidence-ledAssurance, not delivery

Independent assurance for regulated, high-trust and professional-service organisations

Leadership & Boards
Risk & Compliance
Security & Technology
Law Firms
Accountancy Firms

The assurance questions

Who challenged the system before you trusted it?

Reliance on an AI system is only reasonable when its risks have been independently examined, its controls tested and its residual exposure accepted by someone accountable.

01
Who independently challenged this AI system before it went live?
02
What can it access, change or trigger without a person approving?
03
Which controls have been tested, rather than described?
04
What residual risk remains, and who formally accepted it?
05
If it failed tomorrow, could you evidence what happened and why?

Four connected domains

Risk, security, safety and governance are assessed together.

Assessed separately, they leave gaps exactly where data, models, permissions, people and actions meet.

AI Risk

Independent identification of material exposure: use case criticality, data, vendors, dependency and regulatory obligation.

AI Security

Testing of identity, privilege, data exposure, prompt injection resistance, tool access, logging, detection and containment.

AI Safety

Assessment of failure modes, misuse, autonomy boundaries, meaningful human intervention, safe operating limits and rollback.

AI Governance

Assessment of ownership, approval authority, oversight in operation, change control, incident routes and board reporting.

The lifecycle

Independent challenge before, during and after deployment.

Six assurance engagements that can be commissioned individually or sequenced across the life of an AI system.

Specify

AI Pre-Implementation Risk & Assurance Review

Independent review before build or procurement is locked in, producing the control requirements the system must meet.

Explore

Secure

AI Security Assurance

Independent assessment of identity, permissions, data exposure, injection resistance, detection and containment.

Explore

Contain

AI Safety Assurance

Failure modes, misuse, autonomy boundaries, safe operating limits, intervention and rollback assessed and tested.

Explore

Account

AI Governance Assurance

Assessment of whether ownership, approval authority, oversight, change and incident governance operate in practice.

Explore

Decide

AI Production Readiness Assurance

Multidisciplinary pre-deployment assessment concluding ready, ready subject to conditions, or not ready.

Explore

Monitor

Continuous AI Assurance

Post-deployment reassessment of control performance, changes, incidents, overrides and regulatory movement.

Explore

The Alacrix position

We do not build your AI. We challenge it.

Your internal engineering team or your AI vendor builds the system. Alacrix examines whether its risks are understood, whether its security and safety controls actually hold, whether its governance is accountable and whether its operation can be evidenced.

We have no interest in the system being approved. That independence is what makes the conclusion worth relying on, and it is why our findings can be put in front of a board, a client, an insurer or a regulator.

Builder, internal AI team or vendor

Designs, builds and operates the system.

Alacrix independent assurance

Assesses material risk, tests controls, states residual exposure.

The organisation

Approves, conditions or declines deployment.

Evidence by design

An assurance conclusion is only as good as its evidence.

We do not accept a control because it is documented. We look for the record that shows it operated, and we say so when that record does not exist.

The chain below runs from the system and its material risk through the controls we test, the evidence retained, the residual risk stated and the accountable decision that follows.

AI system
The use case, data, authority and intended operating conditions are defined.
Material risk
Consequence, failure modes and misuse scenarios are identified.
Control
Permissions, boundaries, oversight and limits are specified.
Test
Each material control is exercised, not assumed to operate.
Evidence
Test results, logs, approvals and rationale are retained.
Residual risk
What remains after controls is stated rather than absorbed.
Accountable decision
A named leader approves, conditions or declines deployment.
Monitoring
Control performance, changes and incidents are reassessed.

AI activityVerified control / human reviewDecision & evidenceUnresolved risk

Who we help

Organisations placing real reliance on AI systems.

Alacrix works across regulated, high-trust and professional-service environments, with specialist depth in law and accountancy.

Law firms

Protect confidentiality, supervision and professional judgement.

Control AI access to matter data, define review and escalation, and retain a record that supports client, insurer and regulatory scrutiny.

Matter and client-data boundaries
Agent and tool permissions
Meaningful lawyer supervision
Incident and disclosure pathways
Reconstructable decision evidence

AI Assurance for Law Firms

Accountancy firms

Scale machine-assisted work without weakening review control.

Secure client data, retain professional judgement and make AI-assisted preparation, analysis and reporting observable and auditable.

Client-data and vendor exposure
Machine-assisted review controls
Exception and escalation design
Working-paper traceability
Controlled workflow automation

AI Assurance for Accountancy Firms

Insights

Signals worth acting on.

Evidence-led intelligence across AI risk, security, safety, governance, regulation and implementation.

All insights

Regulatory Watch20 Aug 2026 · UK Legislation / DSIT

The UK just made AI governance harder to postpone.

The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 require the ICO to produce a code of practice on good practice for the use of personal data in AI and automated decision-making. Alacrix view: the next layer of UK AI governance is moving from principle to operating guidance. If your AI touches personal data, the sensible move is not to wait for the final code. Build the evidence now.

What to do now

Inventory AI systems using personal data. Define where human intervention is meaningful. Log decisions, review points and escalation paths before the code tells you to.

Read the source

Law20 Aug 2026 · SRA

Legal AI has a new regulatory fast lane. Evidence is still the entry ticket.

Applications opened on 5 August 2026 for the government's first Advisory AI Growth Lab, with legal services as the first sector, and run until 27 September 2026. The SRA is working with the Legal Services Board, the Council for Licensed Conveyancers and the ICO. Alacrix view: the signal is bigger than the programme. Regulators are moving from warning firms about AI to helping them test and deploy it responsibly, and the firms that benefit will arrive with a defined use case, clear controls and something worth testing.

Participation does not amount to regulatory endorsement or safe harbour.

What to do now

Pick one high-value legal workflow. Map the data, human review and evidence trail. Move it from experiment to governed pilot.

Read the source

Production Readiness20 Aug 2026 · ONS

AI adoption is rising. Depth is not. That gap is your opportunity.

In the ONS release of 20 July 2026, covering businesses with 10 or more employees: around 35% reported use of at least one AI technology, 55% of employees reported using AI for work or education, only 10% of AI-using businesses reported using it extensively, and large language models were the most widely used technology at 18%. Alacrix view: when employee use runs ahead of enterprise adoption, you do not have an AI strategy, you have distributed experimentation.

What to do now

Find the three AI behaviours already happening inside your firm. Measure frequency, value and risk. Standardise the one with the best economics.

Read the source

Independent assurance

If your AI system was challenged tomorrow, what could you prove?

Start with an independent assurance review to establish material risk, test the controls that matter and state the residual exposure someone must accept.

Book an AI Assurance Review Why Alacrix