Please provide a consolidated description of your organisation's approach to risk management across the AI system lifecycle, including how the practices identified above operate together and any cross-cutting governance, review or escalation processes. Please also indicate how often these practices are reviewed and what types of events trigger reviews and updates. Where relevant, please distinguish between different types of AI systems (e.g. generative or agentic AI).
Felaris runs a governance-by-design approach, applied to its own AI work the way it advises clients. At the plan and design stage, a use case is scoped against the EU AI Act risk tiers and the Felaris five-dimension readiness assessment (data, process, people, governance, technology). At the data stage, a data-quality report runs on ingest so gaps are visible before anything is modelled, and per-tenant isolation keeps client data separate. Build and integration use third-party foundation models for extraction, with a human confirmation step on every extracted input. Verification uses a scoped pilot on one decision and one data domain, tested against a recent event the organisation already lived through. Deployment is gated by dev/production separation, data residency, and sign-off against the Felaris AI Governance framework. Operation is designed for model and data drift monitoring, a use register and an incident register with named owners, and a quarterly review. Practices are reviewed at each release and on any incident. Felaris does not build agentic AI, and its applications are pre-production.