Morgan's AI Hub helps small and medium-sized organizations govern artificial intelligence, reduce operational risk, improve compliance readiness, and build responsible AI programs — without standing up an enterprise GRC team.
SMEs, healthcare organisations, public-sector teams, law firms, universities, and regulated businesses using ChatGPT, Copilot, AI agents, or vendor AI tools without a complete governance system.
Cumulative figures across advisory, training, and research engagements. Up to 50% documentation-effort reduction observed in selected internal or pilot workflows; results vary by organization, scope, and implementation.
No affiliation, endorsement, approval, or certification by these organizations is implied unless expressly stated.
AI governance should not stop at policy. It must become inventory, controls, evals, telemetry, evidence, escalation, and accountable decision-making.
Inventory, controls, evals, telemetry, evidence, escalation — the operating system beneath policy.
Frameworks that make model behaviour legible to auditors, regulators, and the business.
EU AI Act, ISO/IEC 42001, and NIST AI RMF mapped to your actual controls and evidence.
Audit-ready governance designed for real-world deployment — not just enterprise budgets.
Seven operating layers that turn AI policy into auditable practice. Each layer maps to controls under the EU AI Act, ISO/IEC 42001, and NIST AI RMF — and to the deliverables in every Morgan Signing House engagement.
Every AI system, owner, vendor, data flow, and decision impact in one register.
Acceptable use, approvals, data rules, human-review gates by risk tier.
Pre-deployment and ongoing tests for accuracy, bias, drift, and misuse.
Logging, retention, and monitoring that produce evidence by default.
Auditor-ready artifacts — policies, model cards, reviews, approvals.
Defined response, pause authority, and incident reporting workflows.
Named owners, board reporting, and decision authority at every layer.
SMEs are using the same AI tools as Fortune 500s — but without enterprise GRC teams. We deliver audit-ready governance built for real budgets, real headcount, and real timelines.
Right-sized controls, plain-language templates, and workflows that fit a 10–500 person team.
Crosswalks to EU AI Act, ISO/IEC 42001, and NIST AI RMF — translated into your operations.
Every deliverable is an audit artifact. No binders. No theatre. Just defensible records.
Direct work with Horatio Morgan, PMP — published researcher and NSF TRAILS collaborator.
Three named offers, each with a defined problem, deliverables, and outcome. Pick the one that matches where you stand today.
Using AI but lacking formal controls, inventory, or audit trail.
A complete starter governance system — audit-ready, sized for SMEs.
Executives who need risk clarity, regulatory timelines, and decision authority — fast.
A board that can ask the right questions and sign off with confidence.
Deploying GPTs, copilots, agents, RAG, or workflow automation with real shadow-AI and excessive-agency risk.
Agents that can be deployed, audited, and explained.
Building governance infrastructure at scale.
Audit-ready, evidence-based AI controls.
Advancing responsible AI in partnership with NSF and beyond.
Translating AI law into operational practice.
AI governance platform deployed in the GPT Store. Active within NSF TRAILS — open it and run a real evaluation in under a minute.
Launch the auditor →Published on arXiv — a working specification for translating policy into evidence.
Read on arXiv →AI governance architecture accepted for evaluation of explainability-driven systems.
Read about the VA Innovation Repository →A public-interest research initiative on behavioural monitoring, drift detection, and accountable governance mechanisms — so organisations can tell when AI systems change behaviour after deployment, and who has the authority to respond.
The U.S. Supreme Court's expansion of presidential removal authority over the FTC weakens a key institutional assumption behind the EU–U.S. Data Privacy Framework. What AI governance leaders should do now.
Read the full brief →As of June 2026, EU institutions have approved or advanced simplification measures affecting AI Act timelines, with stricter rules for high-risk and prohibited AI systems. Businesses should confirm final adopted text and sector-specific applicability before relying on any compliance deadline.
For companies building or deploying AI:
The EU is explicitly banning AI systems that:
Applies to providers (cannot market in the EU) and users (cannot deploy for that purpose).
If you are managing AI systems, products, teams, or strategy, now is the time to:
Karin Tafur · EU AI Act – Regulatory Strategy · Consulting & Training
Analyzing AI regulation, policy shifts, and key developments. For advisory or collaboration discussions, reach out via the contact link below.
EU AI Act Notice
References to the EU AI Act are provided for educational and planning purposes only. AI Act obligations depend on role, intended purpose, risk classification, geography, sector, and final adopted legal text. Use of this website, course materials, templates, or AI-assisted tools does not guarantee EU AI Act compliance.
No pitch. Just clarity on where your organisation stands.
