Services · Artificial intelligence · AI security, risk and governance

Use AI with controls you can explain to an auditor.

Q: What is prompt injection?

Hidden instructions that try to make an AI system misbehave. An attacker places instructions in a message, document or web page that the AI reads, hoping it will leak data or take an action it should not. We test for this directly and add defences such as input filtering, tool permission limits and output checks.

Q: Which laws does this cover?

The work is designed around GDPR and the data protection law in each market and your sector obligations. We review data handling, transparency and human oversight against the laws that apply to you. We do not give legal advice, so your legal team or external counsel confirms the final position. We often work alongside them.

Q: Can you review AI we bought from a vendor?

Yes, vendor tools are part of the inventory. We review the vendor terms, data flows, hosting and settings, and test the tool where the licence allows. Where we cannot test directly, we list the questions you should put to the vendor and assess their answers.

Q: Does governance slow projects down?

Light controls for low risk work, more for high risk work. A drafting tool for internal notes does not need the same review as an agent that changes customer records. We match the controls to the risk level so that low risk projects move quickly and high risk ones get proper scrutiny.

Q: How often should systems be retested?

After any significant change, and on a regular schedule. Model upgrades, new tools, new data sources and prompt changes can all open new weaknesses. We set a review schedule by risk level and rerun the relevant tests whenever a system changes in a meaningful way.

Codeeo provides AI governance and risk services for companies that need to show how their AI systems are controlled. We write the policies, test the systems for misuse and put logging and human oversight in place, so AI use holds up to questions from regulators, customers and your own board.

We cover AI you build, AI you buy and the tools staff are already using without telling IT.

Get in touch All AI services

Built for: Risk, compliance, security and IT leaders who are accountable for AI use they did not design.
Typical timeline: An initial AI inventory and risk review usually takes a few weeks, and testing and control work follows per system.
What you own: You keep the policies, risk register, test results, control designs and logging setup, all written for your team to maintain.
Rated: 4.7 / 5 from 23 Google reviews

200+ companies across the US and the UAEFrom a first store to a listed developer

What you get

The controls we put in place.

Governance only works if it reaches the systems. Every policy we write is matched to a technical control we can show working.

Explain your project

AI policy
We draft an acceptable use policy and an AI development standard that fit your existing information security and data policies. Both are short enough for staff to read and specific enough to enforce.
Staff know which tools they may use and with what data, and managers can enforce it.
AI inventory
We find and list every AI system in use, including vendor features switched on inside existing software. Each entry records the owner, purpose, data used and risk level.
You can answer the question of where AI is used in your company with a single list.
Model risk assessment
We assess each system for the harm a wrong output could cause, the data it touches, bias risks and how decisions can be challenged. Higher risk systems get stronger controls and more frequent review.
Oversight effort goes where the consequences are greatest.
Red teaming and prompt injection testing
We attack your assistants and agents the way a hostile user would, testing for prompt injection, data leakage, jailbreaks and unsafe tool use. Findings come with a severity rating and a specific fix.
Weaknesses are found by your own testers before a customer or attacker finds them.
Data protection review
We map personal data flowing into and out of each AI system and check the handling against GDPR and the data protection law in each market. That covers lawful basis, retention, transfers to model providers and data subject requests.
Your privacy team can sign off AI use with the facts in front of them.
Audit logs
We set up logging of prompts, outputs, sources, tool calls and user identity, with retention rules and restricted access. Logs feed into your existing security monitoring where possible.
When something goes wrong you can reconstruct exactly what happened and who was involved.
Human oversight
We design review points where a person approves, edits or rejects AI output before it reaches a customer or changes a record. Escalation rules route uncertain or sensitive cases to named staff.
Accountability for important decisions stays with people, and you can show it.
Vendor review
We review AI vendors and features you plan to buy, covering data use terms, hosting regions, security controls and exit options. You get a short written assessment for each.
Procurement decisions on AI tools are made with the risks written down.

Who this is for

Situations where governance work pays off.

Governance is easier to add early, but most clients start once AI is already in use.

AI spread faster than policy

Staff use several chat tools and vendors have switched on AI features, but nobody has a full picture. We build the inventory, write the policy and close the riskiest gaps first.

Inventory and policy.

A customer facing agent is about to launch

You are close to putting an assistant or agent in front of customers and want it tested before it goes live. We run red team and prompt injection tests, check the logging and confirm escalation works.

Pre launch testing.

Auditors or customers are asking

An auditor, regulator, investor or large customer has asked how your AI is controlled. We assemble the evidence, fill the gaps and help you answer clearly.

Evidence and controls.

How a governance engagement runs.

01InventoryFind every AI system and feature in use and record its owner, data and purpose.
02AssessRate each system for risk and review data handling against your obligations.
03TestRed team the higher risk systems and confirm logging, access and escalation work as designed.
04ControlPut the policies, oversight steps and monitoring in place, and hand over a review schedule.

How we work together

A one time review or an ongoing function.

Some clients need a single review before a launch or audit. Others ask us to run periodic testing and keep the inventory current.

Discovery and pilot

Teams deciding where AI should start

A short, fixed piece of work: the use cases ranked, the data checked, and one pilot built against real examples so you can judge it on evidence rather than a demo.

Use cases ranked by value and risk
Data and systems review
A working pilot on your own examples
A written plan for what comes next

Get in touch

Build and launch

A use case that is ready to go live

A written scope and a fixed quote, then the build: integrations, guardrails, an evaluation set and a launch with your team trained to use it.

Written scope and acceptance tests
Integration with your systems
Evaluation set and human review steps
Launch, training and handover

Get in touch

Run and improve

AI that is live and needs looking after

A monthly plan to watch quality, cost and usage, update prompts and models as vendors change them, and add the next use case when the first one earns it.

Quality and cost monitoring
Model and prompt updates
A monthly report on usage and results
The same team that built it

Get in touch

Technology

What we build this with.

Models are chosen per use case for quality, cost and where your data is allowed to go. The systems around them run on the stack below.

01Web

React
Next.js
TypeScript
Node.js
Laravel
WordPress

02Data and cloud

PostgreSQL
MySQL
MongoDB
AWS
Azure
Docker

Questions about AI governance.

Do you certify our AI systems?

No. We test and document, and you decide on sign off.

Codeeo does not issue certifications and is not an accredited audit body. We give you test results, risk assessments and control evidence that your compliance team, auditors or an accredited body can rely on as input.

What is prompt injection?

Which laws does this cover?

Can you review AI we bought from a vendor?

Does governance slow projects down?

How often should systems be retested?

Services that usually go with this one.

Enterprise AIA private AI assistant that knows your company data.AI consulting and strategyKnow which AI projects to fund before you fund them.MLOps and AI platformsKeep your models working after launch day.

Tell us what the business needs. We will tell you what to build first.

Schedule a free consultation and get a written recommendation, with costs, before you commit to anything.

Get in touch

PROVEN RESULTS

4.7 / 5from 23 Google reviews

Use AI with controls you can explain to an auditor.

The controls we put in place.

AI policy

AI inventory

Model risk assessment

Red teaming and prompt injection testing

Data protection review

Audit logs

Human oversight

Vendor review

Situations where governance work pays off.

AI spread faster than policy

A customer facing agent is about to launch

Auditors or customers are asking

How a governance engagement runs.

A one time review or an ongoing function.

Discovery and pilot

Build and launch

Run and improve

What we build this with.

Questions about AI governance.

Services that usually go with this one.

Tell us what the business needs. We will tell you what to build first.