This Practice Playbook is a field guide for Cyber Risk and Governance leaders taking AI governance from a one-off assessment to a repeatable practice. Nine chapters, structured in three acts: See It (map what you're actually exposed to), Govern It (turn that map into defensible controls), Scale It (turn the practice into something you can offer and sell). Every chapter ships with a working artefact from the toolkit below — a template, a question bank, a scoring model — so each idea comes with something you can actually run, not just read. This is published work, not a pitch. Frameworks built for real engagements, generalized and shared because governance gets better when the tools behind it aren't kept behind closed doors. The Acts II & III will soon be updated here, so stay tuned for that.

A working toolkit of AI governance frameworks, risk assessments, and practice-building strategy — built by a practitioner and sharpened through real engagements, turning regulatory pressure into governance programs that pass audit, and AI adoption into something a risk committee can actually sign off on.

We turn AI governance frameworks into an operating model that produces evidence a risk committee and auditor can actually use