Overview
Across every enterprise I have advised over the past eighteen months, the same three questions about AI surface in the same order.
First comes curiosity: “Can we use AI for this?”
Then comes judgement: “Should we use AI for this?”
And finally, quietly, comes the question that determines organisational risk posture: “If it goes wrong, what happens to us?”
The first question is exciting. The second requires discipline. The third determines careers.
This article outlines the platform I spent the last two months building-the platform I wished existed for that third question. It is a practical response to the governance, risk and compliance challenges enterprises face when adopting AI at scale. It is also a reflection of what I learned while designing a system that connects risk, compliance, security, regulatory evidence and executive decisionmaking into one coherent lifecycle.
The Pattern I Kept Seeing Across Enterprises
Large organisations already possess the ingredients required to govern AI responsibly. They have risk policies, compliance functions, security teams, AI product groups and regulators watching closely. What they lack is the plumbing that connects these components into a unified system.
Evidence often lives in a SharePoint folder. Risk assessments sit in spreadsheets on individual laptops. Governance frameworks exist as PDFs nobody reads. AI inventories are mental models distributed across three different people. When an approval question arises, four meetings occur, sixteen people attend, one decision is made-and three months later nobody remembers why.
Meanwhile, regulators publish new guidance. Models are updated. Incidents occur. And when asked to produce a decision record, organisations struggle to show: “We assessed this on this date, against these controls, and here is why we approved it.”
This is not a policy failure. It is a systems integration failure. A plumbing problem masquerading as a governance problem.
The Four Questions No Single Tool Answered
Once I reframed the challenge as a plumbing problem, four distinct questions emerged-each requiring its own specialised capability:
- Should we build this? What could go wrong with this specific AI proposal?
- How intensely must the AI be governed? What level of oversight is appropriate?
- What does authoritative evidence say? Which regulatory, policy or industry obligations apply?
- What should the enterprise actually do? And how do we prove that decision to a regulator?
I built four components-one for each question.
Agentic Risk Analyst
The first component is a multiagent AI system that transforms naturallanguage business scenarios into structured risk assessments.
A user might paste: “An Australian bank wants to deploy an autonomous AI agent that approves personal loans up to AUD 50,000.”
A Scenario Intelligence agent extracts a structured brief: what the AI does, who is affected, what data it uses, where it operates and what information is missing. Three specialist agents-Risk, Compliance and Security-analyse the brief in parallel. A Control Analyst maps specific controls to specific risks and computes residual risk. A Supervisor synthesises an executive decision. An optional RedTeam agent runs adversarial tests including prompt injection, data exfiltration and regulatory hallucination.
Every finding is typed JSON; not free text. That distinction becomes critical later.
CALIBRE – Deterministic AI Governance Scoring
The second component is CALIBRE, a governance framework that measures how intensely a specific AI system must be governed. It uses five weighted factors to produce a Governance Intensity Index from 0 to 100, grouped into four bands: Low, Moderate, High and Critical.
CALIBRE is deliberately deterministic. It is a transparent linear weighted model that produces the same answer every time and is fully explainable. In governance, determinism is a feature, not a limitation. Because the model is linear, each factor’s contribution is exactly known and equals its SHAP value without approximation.
Controls map directly to NIST AI RMF, ISO/IEC 42001 and the EU AI Act.
SecureRAG 2.0 – Grounded Regulatory Intelligence
The third component is a grounded retrieval system that answers regulatory and policy questions with citations from an indexed corpus. Every answer traces back to a source. Every citation is inspectable.
The corpus can include AUSTRAC guidance, APRA prudential standards, ISO 27001 policies, decades of case law or an organisation’s internal compliance manuals. The value is not the LLM-it is the grounding of the LLM in what the organisation actually says.
AI Governance Nexus – The Lifecycle Engine
The fourth component is Nexus, where the plumbing lives. Nexus is a lifecycleaware system with four capabilities:
- AI Initiative Register Every AI system receives a persistent record with a stable ID, owner, lifecycle stage, assessment history and next review date.
- Orchestration Layer Nexus calls ARA for scenario analysis, runs CALIBRE natively and calls SecureRAG for evidence resolution. It fuses their outputs into one initiative record.
- Deterministic Decision Engine Rules operate on top of multiagent outputs to produce a verdict: APPROVE / APPROVE WITH CONDITIONS / REQUIRES REMEDIATION / ESCALATE TO RISK COMMITTEE / DO NOT APPROVE. Each verdict includes an action plan, owner roles and evidence requirements.
- Trust Score A single number from 0 to 100 that composes ARA’s residual risk, CALIBRE’s governance intensity and SecureRAG’s evidence coverage. Executives see one number. Analysts drill into its composition. Regulators inspect the traced evidence.
Every completed initiative can generate a boardready Executive Decision Pack.
The Technical Unlock – Structured Findings Contract
None of this works if the four components pass free text between each other. They pass structured JSON conforming to a shared schema called the Structured Findings Contract.
Every risk from ARA, every control from CALIBRE, every citation from SecureRAG and every verdict from Nexus is an instance of the same shape: initiative ID, source app, capability, finding ID, finding type, severity, confidence label, regulations cited, controls addressing, source URL, model used and timestamp.
This single schema turns four heterogeneous systems into one platform. It also makes drift trackable. When an initiative is reassessed six months later, Nexus can show that risk R014 was High in March and Medium in September because control C03 was implemented in May.
What I Learned
Three principles emerged that generalise beyond this specific build.
- Persistence matters more than assessment. Assessment is not the hard part. Persistence, versioning and reassessment triggering are the hard parts. Without them, assessments evaporate the moment the browser closes.
- Mix determinism and nondeterminism deliberately. LLMs are excellent for scenario understanding, risk elicitation and regulatory reasoning. They are terrible for decision engines. CALIBRE and Nexus are intentionally deterministic. The LLM writes the narrative; the verdict is arithmetic.
- Composable beats sequential. Each component is independently useful. SecureRAG can be used fifty times a day without touching the others. Nexus brings them together only when the initiativelevel use case demands it. A forced linear flow would kill everyday utility.
Where This Goes Next
I am now opening this work for conversations with senior stakeholders, executives, CIOs, CROs, CISOs and Heads of AI Governance who are wrestling with these questions inside their own organisations. If any of this resonates, reach out. I would rather discuss your specific governance challenge than deliver a generic pitch.
Live demos and the full technical architecture writeup: chiragdani.com/insights
Currently open to senior contract, consulting and advisory engagements in enterprise AI, AI governance, cybersecurity and technology transformation. Chirag Dani Melbourne | Available across Australia, remote and international