AI Decision System
One evidence-based answer to what your company is doing with AI.
Where the return is. Where the exposure is. Which decisions AI can be trusted with. The AI Decision System gives your CFO, CRO, CIO and board one reconciled view, delivered through the AI Investment & Control Review.
AI Investment & Control Review
Board summary
Control score (evidence-capped)
Shown as a range · Confidence: Medium
Evidence base
- Operating Full weight
- Documented Partial weight
- Asserted Capped
Investment calls
- Invoice exception triage Accelerate
- Forecast assistant Restructure
- Policy Q&A copilot Stop
Illustrative mock-up. Sample content, not client data.
What it is
What the AI Decision System is
Where is the return, where is the exposure, and which decisions can AI be trusted with?
The AI Decision System is one evidence-based review of everything your company does with AI, run by EkaC with your leadership team.
- It tells the CFO where the return is, and where money is going to initiatives that will not pay back.
- It tells the CRO where the exposure is, and which controls are missing.
- It tells the board which decisions AI can be trusted with, and on what terms.
The AI Decision System is delivered through the AI Investment & Control Review, an advisor-led engagement. EkaC’s software platform supports the work by holding the register, the evidence and the scoring rules. Senior EkaC advisors run the review and sign off every finding.
The four questions leaders face
Four questions every board is now asking about AI.
Where are we using AI, and which uses are risky?
A complete register of AI systems and initiatives, including tools bought from vendors and built in-house, each with a risk tier.
Are we compliant?
What you can actually show against the EU AI Act, ISO/IEC 42001 and the NIST AI RMF, checked once from one set of evidence.
Which projects should we speed up or stop?
A clear investment call for every initiative, with the cost of the controls it needs before it can scale.
Can we trust the decisions AI is making?
Every AI-supported decision tested on seven controls, and given an authority level leadership can stand behind.
How these questions are answered today: with vendor slides, a maturity score and a compliance file that nobody has reconciled. Each tells a different story, and none of them would survive a hard question from an auditor or a regulator.
What it does
Six steps from evidence to decision.
Build the AI register
Every AI system and initiative in one list: what it does, who owns it, what it costs, which decisions it touches and how much risk it carries.
Score what you can demonstrate
We score what the organization can show, not what it states. Each answer is marked asserted, documented or operating, and the score is capped by the strength of that evidence.
Check controls against three frameworks at once
One set of evidence is checked against the EU AI Act, ISO/IEC 42001 and the NIST AI RMF, so your teams gather evidence once, not three times.
Make an investment call on each initiative
Accelerate, continue, restructure, defer or stop, with the cost of the controls each initiative needs to be safe to run.
Test each AI-supported decision
Seven controls set how much authority AI is given: act, act with approval, advise only, or not yet.
Name the root causes and assign the decisions
The few underlying causes putting value at risk are named. Findings become a decision register with owners and dates, reassessed every quarter.
Decision Trust Test
Seven controls before AI is allowed to act.
Each AI-supported decision is tested on seven controls, built on the Governance Before Configuration disciplines. Together they set the authority AI is given over that decision.
- OwnIs a named person accountable for the decision?
- KnowDo we know what data it uses, and how good that data is?
- TierHow much harm could a wrong decision cause?
- ValidateIs there evidence that it is accurate?
- ExplainCan the person who acts on it understand why?
- BoundAre there limits, and can a human override it?
- VerifyIs it monitored, and is there a fallback if it fails?
Act
All seven controls are evidenced. AI may act within defined limits.
Act with approval
AI proposes. A named owner approves before anything happens.
Advise only
AI informs. A person decides and acts.
Not yet
Gaps must close first. We name which ones, and the smallest step to close each.
Investment calls
A clear call on every initiative, with the cost of making it safe.
Worth more money now. Remove what is in the way and fund it.
On track. Keep going under current controls.
The value is real, the approach is not. Change scope, owner or design.
Not yet. Put the basics in place and look again next quarter.
The value does not justify the cost or the risk. Move the money elsewhere.
One set of evidence, three frameworks
Controls are checked against the major AI frameworks from a single body of evidence, so compliance work does not have to be repeated for each one.
This shows evidence status against each framework. It is not legal advice or certification.
No invented numbers
We never make up a return figure. Where the value of an initiative has not been measured, it is shown as “to be quantified” and setting a baseline becomes an action with an owner.
The cost of not doing it
Unchecked AI costs money twice: in projects that never pay back, and in exposure you cannot see.
These are public facts, each with its source. They are not EkaC estimates.
Regulatory exposure: the EU AI Act
The ban on prohibited AI practices has applied since 2 February 2025.3 The high-risk deadlines moved, but the work to evidence controls takes time. Organizations that start now will have quarters of operating evidence by the deadline, not a policy written the month before.
Value at risk: AI projects that do not pay back
- EU AI Act (Regulation (EU) 2024/1689), Article 99, Penalties. European Commission AI Act Service Desk: ai-act-service-desk.ec.europa.eu/en/ai-act/article-99
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), recital 40, Official Journal, 24 July 2026: eur-lex.europa.eu/eli/reg/2026/1744/oj/eng; European Commission, “AI Omnibus enters into force”: digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force
- EU AI Act, Article 113, Entry into force and application. AI Act Service Desk: ai-act-service-desk.ec.europa.eu/en/ai-act/article-113
- MIT NANDA, The GenAI Divide: State of AI in Business 2025 (archived copy of the original report): nanda.media.mit.edu/ai_report_2025.pdf (archived); coverage in Fortune, 18 August 2025: fortune.com
- Gartner, “Why 50% of GenAI Projects Fail — And How to Beat the Odds,” 26 January 2026: gartner.com/en/articles/genai-project-failure
- Gartner press release, “Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027,” 25 June 2025: gartner.com/en/newsroom
- RAND, The Root Causes of Failure for Artificial Intelligence Projects and How They Can Succeed, 13 August 2024: rand.org/pubs/research_reports/RRA2680-1.html
The value for clients
What changes for each leader.
Capital stops going to initiatives that won’t pay back
The ones that will pay back get a named owner and a measured baseline, so you can see whether the return arrives.
Control gaps close before a regulator or auditor finds them
You know which controls are operating, which exist only on paper, and what it costs to close each gap.
One register, one set of evidence
Every AI system in one place, checked against three frameworks at once, with clear limits on what AI may do on its own.
A quarterly answer it can defend
A short, consistent report on return, exposure and trust, with each finding traceable to evidence.
After the review
Before and after.
Swipe sideways to see all columns.
| Area | Before | After |
|---|---|---|
| AI inventory | Nobody can list every AI tool in use, including those bought from vendors | One register of every AI system and initiative, each with an owner and a risk tier |
| Investment | Pilots keep their budget because nobody decided otherwise | Each initiative has a call (accelerate to stop) and a cost of controls |
| Return | Benefits are claimed but never measured | Initiatives that continue have a named benefits owner and a baseline |
| Compliance | Separate, unreconciled files for each framework | One set of evidence mapped to the EU AI Act, ISO/IEC 42001 and the NIST AI RMF |
| Trust | AI influences decisions with no agreed limits | Each AI-supported decision has an authority level and named gaps to close |
| Board reporting | A maturity score and vendor slides | A quarterly decision register with owners, dates and progress since last quarter |
Engagement options
Start small, or go straight to the full review.
Every option is advisor-led. Every finding comes with an audit pack: the evidence it rests on, the rule applied and the framework references, so your auditors and lawyers can check it.
AI Pulse
A short, structured conversation with one or two leaders. You get a first, indicative read on where you stand and whether a deeper review is worth it.
Request a PulseSnapshot
A fast review of your main AI initiatives: a first register, evidence status, headline investment calls and the top risks to address.
Contact usFull Diagnostic
The complete AI Investment & Control Review: full register, framework check, investment calls, Decision Trust Test, root causes, decision register and board pack.
Contact usQuarterly Review
Reassess, update the decision register and report progress to the board: what improved, what closed and what is overdue.
Contact usWho it’s for
For leaders who have to answer for AI.
- CFOs who need to know which AI spending will pay back
- CROs, risk and compliance leaders who need to show controls, not just policies
- CIOs and CTOs who own the AI estate and want one register and one set of evidence
- Boards and audit or risk committees who want a quarterly answer they can defend
- Organizations with several AI initiatives under way, especially those operating in or selling into the EU
What you get
Deliverables.
AI register
Every AI system and initiative, with owner, purpose, cost, risk tier and evidence status.
Control check
Evidence status against the EU AI Act, ISO/IEC 42001 and the NIST AI RMF, from one set of evidence.
Investment calls
Accelerate, continue, restructure, defer or stop for each initiative, with the cost of the controls it needs.
Decision Trust Map
An authority level for each AI-supported decision, and the gaps that block the next level.
Root causes and decision register
The few causes putting value at risk, and the decisions to fix them, each with an owner and a date.
Board pack and audit packs
A short report for the board, CFO, CRO and CIO, plus an audit pack behind every finding.
Example: one row of the decision register
Every finding is carried through to a decision with an owner and a date, then checked again next quarter.
Swipe sideways to see all columns.
| Finding | Evidence | Call | Authority | Decision | Owner | Due |
|---|---|---|---|---|---|---|
| Cash-flow forecasting model has no accuracy testing and no named owner | Asserted | Restructure | Advise only | Name an owner, run a back-test against 12 months of actuals, and keep it advise-only until Validate and Bound are evidenced | CFO | End of next quarter |
FAQ
Questions leaders ask.
Is this legal advice?
No. We report the evidence status of your controls against the EU AI Act, ISO/IEC 42001 and the NIST AI RMF. It is not a legal opinion or a certification. We recommend your legal counsel reviews any finding with regulatory consequences.
How much time does it need from our team?
A senior sponsor, short interviews with the leaders and the owners of each AI initiative, and one person to gather documents. We agree the time commitment before we start. The AI Pulse and the Snapshot are designed to ask much less of your team than the Full Diagnostic.
Do you need access to our systems?
No direct access is required. We work from documents and records, and ask your team to show us controls operating. Any further access is your choice.
How is our data protected?
Engagement data is held in the European Union (EU data residency) and handled in line with the GDPR. We agree up front what we need and collect only that.
Is AI used to score us?
No. Scores are set by fixed rules and capped by the strength of the evidence. AI only helps draft narrative text, and a consultant reviews and signs off every finding before you see it.
How is this different from a maturity assessment?
A maturity score tells you how you compare. This review tells you what to fund, what to stop, which controls to fix and how far each AI-supported decision can be trusted, with an owner and a date for each.
Next step
Start with a free AI Pulse.
Email shanka@ekac.pro to arrange a conversation, or connect on LinkedIn.