AI Governance for process manufacturing
We prepare UK process sites for ISO/IEC 42001, starting with a Readiness Assessment that tells you plainly where you stand.
Readiness Assessment
Many AI tools reach a site quietly, through a supplier update or a new feature in software you already run. The Readiness Assessment lists the AI tools we find on site, names an owner for each and shows what ISO/IEC 42001 asks of it.
It is a short, structured diagnostic that answers one question before any other work starts: should you adopt or scale AI at all, and on what conditions? The scoring rests on evidence from your site, not on a self-assessment questionnaire.
Every AI tool we find on site, listed, including the ones that arrived inside other software.
A named person for each one.
The primary risk of each tool, scored on evidence against what ISO/IEC 42001 asks.
A clear recommendation: proceed, proceed with conditions, pilot only, remediate and re-assess, or do not scale yet. Where it helps, a costed plan for closing the gaps.
Where things stand
AI adoption has run ahead of AI Governance almost everywhere. The rules are arriving unevenly, and faster in some places than others. A site that puts a management system in place now meets those rules ready, rather than in a rush.
In force in the EU
If you place AI systems on the EU market, or your AI output is used in the EU, the Act reaches you wherever you are based. Its obligations are tiered by risk, and the higher tiers require documented governance, risk management and human oversight. An ISO/IEC 42001 management system produces that evidence.
Developing in the UK
Rather than one AI act, the UK has so far worked through the regulators you already answer to, such as the ICO, FCA, MHRA and HSE, applying existing powers to AI. The obligations arrive through your sector, not on a single commencement date, and sooner than most boards expect.
Commercial pressure
The practical deadline is rarely legislative. It is the AI questionnaire in a tender pack, the insurer's renewal form, or a customer's supplier assurance review. A certificate answers all 3 at once.
In short: a management system takes months to build and days to evidence. Start before the request arrives, not when it does.
AI Governance
AI Governance is the set of decisions, checks and records that make sure the AI your site uses does what you intend, keeps doing it, and can be explained when someone asks.
It is not an ethics committee and it is not a document library. It is how the work is controlled, the same way process safety is: every risk has an owner and every decision leaves evidence.
The scale problem
A biased human decision affects one applicant. A biased model affects every applicant at once, at machine speed, and keeps doing it until somebody measures it.
The black box problem
When a decision cannot be explained to the person it affects, nobody can be held to account for it. Regulators, tribunals and customers all ask the same question, and “the model decided” is not an answer.
The exposure problem
Adversarial inputs, model drift, inference attacks that re-identify anonymised data, and safety failures in physical systems. ISO/IEC 27001 controls were not designed to catch any of these.
Every AI tool on site needs an owner, a control and evidence.
Why certify
Boards sign this off for 4 reasons. Each one turns into evidence you can hand to whoever is asking.
01
Proportionate controls for the risks AI creates, such as bias, privacy, security and safety, so failures are less frequent, less severe and cheaper when they do happen.
02
A certificate from an accredited body is a statement your board, investors and insurers can rely on. Governed AI reads as a lower risk profile, because it is one.
03
Customers, partners and procurement teams increasingly ask how you govern AI. A certificate from an accredited body answers in one document.
04
Already law in the EU under the AI Act, and developing in the UK through existing regulators. A management system means the rules land on a structure that is ready for them.
The standard
Published in December 2023, ISO/IEC 42001:2023 is the world's first certifiable AI Management System standard. It takes a risk-based approach to AI Governance and follows the same High-Level Structure as the management systems you may already run, so it builds on what you have.
4–10
If you hold ISO 9001 or ISO/IEC 27001, you already have a risk register, document control, an internal audit programme and a management review. 42001 extends them to AI rather than duplicating them.
It adds what no other standard covers: the AI System Impact Assessment, data quality and bias management, controls across the model lifecycle, and explainability requirements. Current risks are structured, and future ones are looked for deliberately.
One structure, shared across the family
Shared
4–10
High-Level Structure clauses
Your ISO 9001, 27001 and 27701 controls still apply to AI, but these five areas need extra attention.
Clause 6.1.2
What could go wrong for the organisation, whether regulatory, reputational, operational, security or financial, and how likely and severe would it be?
Clause 6.1.4 / Annex B
What is the real-world footprint on the people it affects: human rights, fairness, safety, privacy, and environmental and societal effects? Both are required. Risk is the forecast. Impact is the footprint.
Services
Engage us for the whole journey or for the one part you are stuck on. Everything is delivered as documentation you own, in language your team can use, without stopping the day job.
Free and 30 minutes long, with no slides and no pitch.
Where you stand, and whether to scale.
A working AI Management System in 12 or 16 weeks.
By an independent, accredited body.
01
The diagnostic described above. It answers whether you should adopt or scale AI at all, and on what conditions, and ends in a clear recommendation and, where relevant, a costed plan for closing the gaps.
Discuss this: AI Readiness Assessment02
A facilitated session, or a short series, with your leadership team that turns “we should probably do something with AI” into a prioritised, realistic plan: which use cases are worth pursuing, which are not yet, and in what order, given your data, your people and your risk appetite.
Discuss this: AI strategy workshop03
Hands-on advisory support as AI use cases move from pilot to everyday operation. Advisory input, not systems integration. Available as a day-rate retainer once the assessment or strategy stage is done.
Discuss this: AI implementation support04
Flagship programme
A structured programme of 12 to 16 weeks that takes a process manufacturing site from where it stands to a working AI Management System that conforms to ISO/IEC 42001 and is ready for audit. The 2 tracks are scoped by the number of sites and AI use cases, not by company size.
See the 2 tracks05
For organisations already running several AI or analytics systems, built separately, with no shared standards and no single view of what is in production. We reframe the ask from “merge everything into one system” to one platform, one management system and many governed use cases. It starts with a short readiness assessment, then a phased programme of typically around 64 weeks across 5 phases that delivers value early through a time-boxed, governed pilot.
Discuss this: AI estate consolidationThe flagship programme
Both are scoped by how many sites and AI use cases are in scope, rather than by headcount. Both end in the same place: a working AI Management System you own, ready for an independent audit.
12Weeks
A single site with a small number of AI use cases in scope.
16Weeks
Several sites, or a broader inventory of AI systems.
+Optional add-on
Prepares you for the independent certification body's audit. You pay the audit fees directly to the certification body, and they sit outside anything quoted for either track.
Both tracks are quoted individually once the scope is clear. Ask for a figure at the introductory briefing and you will have one in writing.
A note on certification. Certification is awarded by an independent, accredited certification body. It cannot be issued by the people who helped you implement, and you should be wary of anyone who offers both. We never audit our own work. Our job is to prepare you so the audit holds no surprises, and to be in the room while it happens.
Your roadmap
The roadmap has 7 steps, from measuring the distance to holding a certificate and keeping it. We deliver the first 3 as part of the flagship AIMS programme. The last 4 belong to an independent certification body, and we prepare you for them and sit in the room.
Sectors
Our background sits inside one industry family, process manufacturing, seen from 2 vantage points. Chemical engineering gives a systems-level understanding of the whole family. Petrochemicals and brewing are where our delivery experience runs deep. The labels say which is which.
General
A chemical engineering foundation underpins this rather than one sector. Process manufacturing runs on the same logic wherever the product changes: engineered systems, safety cases, quality control and continuous improvement. That grounding means we can follow an AI Governance conversation in most process plants without the fundamentals being explained first.
Photo: Miha Meglic / Unsplash
Speciality
Wayne spent 14 years inside petrochemical operations, where process safety management is how the plant runs, not a document on a shelf. ISO/IEC 42001 fits the same discipline: the same audit programme and the same evidence, extending what you already run.
Photo: Paul T / Unsplash
Speciality
Wayne spent 12 years in brewing and FMCG, including managing a $20m capacity upgrade, where quality and food safety systems are mature and well understood. Forecasting, yield optimisation and automated inspection are usually where AI appears first on the production side, and governance belongs alongside those checks from the start.
Photo: Keith Tanner / Unsplash
About
Most AI Governance advice comes from people who have never had to make a management system survive contact with a real operation. Wayne Wright has spent 26 years inside heavy industry, where a control that only works when someone is watching is not a control. It is a hazard.
“We bring the discipline of process and project engineering to AI Governance: define the system, evidence it, audit it, improve it. No 200-page policy nobody reads.”
Our vision
A process manufacturing industry where AI Governance is as fundamental as process safety, and plants scale their AI as confidently as any other management system, without increasing the risk.
Our mission
We guide process manufacturing plants to AI Governance readiness and ISO/IEC 42001 certification, combining the Lead Implementer credential with 26 years' hands-on engineering experience across the manufacturing value chain and structured change management.
Background and credentials
Global AI Certification Council (GAICC), accredited in the UK through the CPD Standards Office. Verify this credential
Executive certification in leading AI adoption and what it means for an organisation. Verify this certificate
Brewing and petrochemicals, over 26 years: operations that run continuously, where management systems carry real load.
A risk-based, systems-first way of thinking that maps directly onto how ISO/IEC 42001 asks you to govern AI.
Formal project discipline, applied to implementation programmes: scope, stages, evidence and closure. Held from 2010 to 2013.
Process engineering, project engineering, operations management, and maintenance and reliability advisory.
Contact
Start with a free 30-minute introductory briefing. No slides and no pitch. We look at where AI already sits in your operation, what ISO/IEC 42001 would ask of you, and whether it is worth your time. You will get a straight answer either way.
Prefer email? Write to enquiries@wrightframeworks.co.uk.
It is switched off in this browser, so the form cannot send. Email enquiries@wrightframeworks.co.uk with your name, organisation and a sentence about your AI systems, and you will have a reply within 1 working day.
The same address works if the form fails for any other reason.