CSA TAISE · ISO/IEC 42001 Lead Implementer · NACD.DC | AIG · Athene · Texas Capital Bank · F5
Most AI programs have the same issues right now; difficulty proving what the models do, where the training data came from, who is monitoring what, and who signed off on putting it in front of a customer. The governance work is what gets the thing into production, and more importantly, generates a return to make it worth keeping there.
While many teams didn't put tight governance in place during the race to build, businesses are figuring out that AI governance isn't actually a tax on achieving an AI ROI; it's the precondition for it.
In other words — if you think AI governance is expensive, try running your business on ungoverned AI. Now the regulators are watching, and while regulators aren't always right, they do tend to be undefeated.
Why leaders call
Any one of them is serious, and they almost never show up alone.
Your customer's procurement team added AI questions to the security review. They do business in the EU, your answers live across four teams, and the renewal is on the clock.
A director concerned about Director liability asked how AI is governed and the answer was a list of tools. Didn't go well, and if it hasn't happened yet, it will. Everyone in the room can guess how that lands.
EU AI Act obligations are in force with more sections coming in 2027, and your Risk team and regulators are asking the same questions. You need to know which systems are in scope, why, and what that entails before someone else decides for you.
Nobody can say how many AI systems the company is running. Building that inventory and keeping it current is the first piece of governance, and it changes as your teams and vendors continue to try and "AI All The Things", whether you asked for it or not.
The practice
In 2026, AI work and our security work are the same work now, so I stopped separating them. Engagements combine these as the situation requires.
Inventory, risk and impact assessment, model and agent risk, third-party AI. Mapped to ISO/IEC 42001, the EU AI Act, and NIST AI RMF.
Read more →Readiness assessment through certification-ready AI management system, then the surveillance cycle after. Lead Implementer certified.
Read more →Program assessment, API and application security, identity, and the attack surface that agentic systems just added to yours.
Read more →Senior leadership on a fraction of a headcount: security, AI, or technology, between hires or alongside a team that needs depth.
Read more →Decision rights, spend discipline, and the operating model that decides which technology bets get made and who owns the outcome.
Read more →Independent counsel to boards and audit committees on cyber and AI risk, in language a director can act on. NACD.DC trained and certified Board Director.
Read more →The ISO/IEC 42001 track
Most clients start with the assessment. It turns an open-ended worry into a plan, a budget, a schedule, and a named owner for each gap.
Where you stand against ISO/IEC 42001, cross-mapped to the EU AI Act and NIST AI RMF. You get a scored gap analysis, an AI system inventory and risk register, a draft Statement of Applicability, and a roadmap with owners and sequencing.
I build the management system with your team and hand you to the audit ready to pass. Policy and scope, AI risk and impact assessment methodology, Annex A controls, control-owner enablement, internal audit, management review. Tailored to how you actually run AI.
The ISO42001 certification lasts three years and the auditor comes back for a surveillance audit every single one. Avoid surprises with quarterly reviews, annual internal audit support and management review, surveillance prep, and new AI systems absorbed into scope as they ship.
Where we fit in
Herrin Advisory is independent. I prepare your organization for certification, and work with your team and an accredited certification body; consulting, auditing, and certification must be separated, and I cannot guarantee an outcome.
Budget for the audit itself and for whatever GRC tooling you use or choose. I will size both with you before you sign anything, so the number you approve is the number you spend.
Who you would be working with
I spent twenty-five years in security, more than twenty of them in the CISO chair, at the world's largest insurer, an annuities carrier (IPO of the Year 2016), and a bank (Most Trusted Bank in America, 2022). Regulated environments, real audits, real consequences when the answer was wrong.
Then I became a founder, built API and AI security as a CTO at Wib (acquired by F5) and Field CISO at F5. That is where I started seeing the AI questions arrive faster than anybody could answer them, which is what this practice is now for.
Plenty of 42001 shops can write you a policy set. Fewer know how to perform AI threat modeling, can tell you what your model's attack surface looks like, what your AI agents can be tricked into doing, or which vendor claim will not survive contact with a real assessment.
Tell me what you have deployed and what is making you nervous. You will leave with a clearer view of your exposure whether or not we partner. If Herrin Advisory is not the right partner, I will say so and can usually tell you who is.
