How does it relate to the EU AI Act or sector rules?

The risk assessment maps the organization's uses to the obligations that apply; the mapping is documented for counsel and auditors to confirm.

What does the organization need to provide?

An inventory of AI uses (the assessment helps build it), access to the tenant for configuration, and the people who will hold the governance roles.

AI Governance Framework — a fixed-fee accelerator from EPC Group

Last updated October 17, 2026 by Errin O'Connor, Founder & Chief AI Architect, EPC Group

EPC Group delivers the AI Governance Framework as a fixed-fee accelerator: 6–10 weeks, led by the senior architect named on the Statement of Work, scoped to the deliverables below. The decision it supports: What the organization's AI governance operating model is — risk assessment, policies, technical controls and training — before Copilot and custom AI go into production. Fixed fee, quoted after a 30-minute scoping call. EPC Group does not publish price ranges.

Abstract slate panel with a teal frame of nested rectangles around a small bright node — governance around the model.

Duration: 6–10 weeks
Team: Senior architect named on the Statement of Work; engagement lead where the program size warrants it.
How it is priced: Fixed fee, quoted after a 30-minute scoping call. EPC Group does not publish price ranges.

What it is

The framework starts from risk: an AI risk assessment aligned to the NIST AI Risk Management Framework, applied to the organization's actual and planned AI uses. From it follow the policies (acceptable use, approval, monitoring), the technical controls configured in Microsoft Purview for AI interactions, and a Copilot Safety Blueprint tuned to the organization's industry.

The operating model that closes the engagement names who approves an AI use, who monitors it, what evidence is kept and how incidents are handled, and the Responsible AI training programme gives the people in those roles the vocabulary to do it.

Who it is for

Regulated organizations deploying AI on Microsoft — Copilot, Copilot Studio agents, Azure AI — that need a governance framework a regulator, an auditor and an engineering team can all read.

Start here by size — Stand up the controls. Governance frameworks, security hardening and quick-starts for organizations that already run the platform and need it governed. The organizations EPC Group serves, and the ones it does not, are set out on the fit page.

Deliverables

AI risk assessment (NIST AI RMF aligned)
Current and planned AI uses mapped, scored and prioritized.
Copilot Safety Blueprint for your industry
The controls, exclusions and review points for Copilot in the organization's regulatory context.
AI usage policies and acceptable-use guidelines
Written for employees, approvers and engineers, in that order of plainness.
Microsoft Purview AI governance configuration
Capture, classification and DLP for AI interactions configured in the tenant.
Responsible AI training programme
Role-based sessions for approvers, builders and the governance function.
AI governance operating model documentation
Roles, decision rights, evidence and incident handling.

What is not included

Building or remediating the AI systems themselves — agents, models and integrations are scoped under the relevant service.
Legal opinions on specific regulations; the framework is mapped to them and the organization's counsel confirms.
Ongoing governance operation — available as a Virtual Chief AI Officer engagement.

Anything outside the deliverables above is a change order under the Engagement Charter — written, priced and approved before the work starts.

When to start

Copilot or custom agents are in pilot and no one owns the approval decision.
A regulator, insurer or customer has asked for the organization's AI governance.
Shadow AI use has been found and policy does not exist.

How it is priced

Fixed fee, quoted after a 30-minute scoping call. EPC Group does not publish price ranges. The scoping call is run by the architect who would lead the work; the fixed fee, the deliverables and the acceptance criteria are written into the Statement of Work, and the change-control, escalation and acceptance rules are the ones in the Engagement Charter.

Frequently Asked Questions

The controls are configured in Microsoft Purview and Microsoft 365, and the policies and operating model apply to any AI the organization uses, including tools outside Microsoft.

Book the scoping call

A 30-minute call with the architect who would lead the AI Governance engagement; the fixed fee follows in writing.

Contact EPC Group