A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →AI governance is the set of policies, roles, and processes an organization uses to oversee how AI is built, bought, and used, so that it stays within legal, ethical, and risk boundaries. It covers who approves AI use, what data models may touch, how outputs are checked, and who is accountable when something goes wrong. ISO 42001 and the NIST AI Risk Management Framework are the common reference points.
Governance works when it is owned. The single most useful step is naming someone accountable for AI risk, the same way a vCISO owns security, because policy with no owner decays into a document nobody follows.
It should be built on what you already run. A company with an ISMS can extend its risk assessment, management review, and policy set to cover AI rather than standing up a parallel programme, which is also the cheapest route to ISO 42001.
traztech delivers AI governance setup for startups and growth-stage companies, led by a published security researcher.
Book a callFor a broader look at getting audit-ready, see our SOC 2 readiness work, or talk to a fractional CISO about building a program around it.
AI governance moves from theory to necessity once AI touches customer data, product decisions, or regulated workflows, and a buyer or regulator asks who owns the risk. The question is rarely about a single model; it is about whether anyone is accountable for AI across the company. We stand this up as AI governance setup.
The practical core is unglamorous and effective: an inventory of where AI is used, a decision on acceptable use, human oversight where decisions affect people, and a named owner. Quebec Law 25's rules on automated decision-making make at least part of this a legal obligation for many Canadian companies.
Yes. Buying rather than building does not remove the risk; it moves it to vendor selection, data handling, and acceptable use. Much of shadow AI risk comes from third-party tools nobody approved.
ISO 42001 provides a certifiable management-system structure and the NIST AI Risk Management Framework offers a voluntary risk approach. The EU AI Act and Law 25 add binding obligations on top for companies in scope.
Free PDFs, no card
SOC 2 readiness, ISO 27001 gaps, incident response and vendor security, as PDFs you can print or forward. Free, no card.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.
Track record
Five published CVEs. CVE-2024-45163 (CVSS 9.1) is a flaw in the Mirai botnet itself, which gave defenders a way to shut down attacker infrastructure. CVE-2026-42626 takes HP ENVY 5000 printers offline from any unauthenticated device on the same network.
At Humera, a venture-backed US security company, Jacob built the compliance programme in-house from nothing: no report, no policies, no documented controls. It ended in a Type II attestation with zero exceptions.