We got certified first. Then we made it a service.
In January 2025 Nunnari Labs became one of the first AI-native companies in India certified to ISO/IEC 42001:2023, the international standard for AI management systems. The audit covered how we design, build, deploy and operate every AI system we ship — risk, data governance, human oversight, monitoring and improvement.
Doing it for ourselves taught us what the standard actually asks of an engineering organisation, and what an auditor looks for. That is now what we deliver to clients: the same workflow, pillars and evidence, packaged so a public-sector agency or an enterprise can get from an unmanaged AI estate to an audit-ready one in months, not years.
Governance services
- Assessment and risk tiering of your AI estate
- Policy suite, committee and decision rights
- Impact and risk assessments (ISO 42005, FRIA)
- Testing, evaluation and red-teaming
- Audit, certification readiness and assurance
- AIOps and managed governance against an SLA
01
Discovery & scoping
Use cases, stakeholders, regulatory exposure
02
Gap assessment
Current state against a regulatory framework
03
Process governance
Controls, roles and decision rights
04
Implementation
Tooling, evidence and reporting live
Framework refreshed annually against regulatory change.
Leadership
Committee, sponsorship, decision rights
Named owner for every AI decision
Policies
Principles, policy suite, procedures
Ratified and version-controlled
Risk
Taxonomy, assessments, register
Treatment plans with due dates
Controls
Gates, monitoring, human review
Release blocked without evidence
Training
AI literacy, role-based enablement
Certification pathway for key staff
Reporting
Evidence, lineage, external reporting
Audit pack produced on demand
Organisational
Oversight, structure, culture
System
Lifecycle, risk, incidents, gates
Model
Registry, drift, monitoring, evidence
Packaged engagements with fixed scope, milestones and deliverables.
Each mapped to ISO/IEC 42001, NIST AI RMF and the local regulator.
G1
4–6 weeks
Assessment & Risk Tiering
Inventory and risk-tier the AI estate, score maturity, price the gap.
Risk-tiered inventory, maturity scorecard
G2
6–8 weeks
Policy, Framework & Literacy
Policy suite, committee, decision rights, GRC literacy.
Policy suite, committee charter, intake gate
G3
8–10 weeks
Risk & Impact Assessment
ISO 42005 impact assessments, FRIA, risk register, controls.
Impact assessments, risk register
G4
8–12 weeks
Testing, Evaluation & Red-Teaming
Evals, red-teaming, bias and drift testing, evidence platform.
Eval results, red-team findings
G5
10–14 weeks
Audit, Certification & Assurance
Internal audit, conformity audit, vendor audit, attestation.
Audit report, control scores, attestation
G6
Annuity · 12 months+
AIOps & Managed Governance
Continuous monitoring, evidence on demand, retained expertise.
Monthly dashboards, incident register