FAQ
Frequently Asked Questions About AI Governance
Short answers to the questions SMEs ask most, grouped the way the rest of the site works: readiness first, then governance, then certification.
Readiness
- What is AI Readiness?
- AI readiness is a clear picture of where AI is used across your organisation, who is accountable for each use, and whether the controls around it are working. It comes before governance is designed, because you cannot govern what you have not identified.
- Why assess readiness first?
- Most governance failures start with an incomplete picture. Assessing readiness first shows which AI systems exist, which carry the most risk, and what to fix in order, so governance work is aimed at real exposure rather than assumptions.
Governance
- What is Governance Architecture?
- Governance architecture is the structure that decides who owns AI decisions, who approves them, and where accountability sits. It sets out roles, decision rights and escalation routes so AI use is directed by the business rather than left to drift.
- What is Attributable Authority™?
- Attributable Authority™ ensures organisations can identify who delegated authority to an AI system, what authority was granted, and under what conditions it can be exercised or withdrawn.
- What is Governance at Execution™?
- Governance at Execution™ focuses on validating authority, boundaries and controls at the moment an AI system acts, rather than relying solely on approvals given at deployment.
Certification
- Do I need ISO 42001?
- Not as a legal requirement. ISO 42001 is a voluntary standard for AI management systems, so the question is whether you need it commercially — because a customer, insurer or investor expects it, or because you want the discipline it brings. Many SMEs do the readiness and governance work first and take certification later.
- How do I prepare?
- Preparation starts with the same work that improves governance day to day: an inventory of AI in use, clear ownership, documented decision rights, operational controls, and evidence of how they run. A gap assessment against the standard then shows what is missing and in what order to close it.
Using Trestano
- What is the Trestano 7-Step Methodology™?
- Trestano helps organisations move from AI Readiness to Certification Readiness through a structured methodology covering Governance Architecture, Attributable Authority™, Governance at Execution™, Governance Operations™, Continuous Assurance and Certification Readiness.
- What is the AI Governance & Readiness Diagnostic™?
- The diagnostic measures governance and readiness maturity across multiple domains and provides a prioritised roadmap for improvement.
- Is Trestano suitable for SMEs?
- Yes. Trestano is specifically designed for organisations that need practical governance and readiness support without enterprise-sized governance teams.
- How long does the free check take?
- Most businesses complete it in under ten minutes and get a risk summary immediately.
- Is this legal advice?
- No. We provide structured guidance and documentation built on compliance best practice. For a formal legal opinion, speak to a qualified solicitor.
UK & EU Rules
- Does the EU AI Act apply to my UK business?
- It can. The EU AI Act is the EU’s law setting rules for how AI can be used. If you sell AI-enabled products or services into the EU, or the output of your AI tools is used there, parts of it can apply to you alongside UK GDPR.
- What is 'shadow AI'?
- “Shadow AI” means AI tools staff start using without telling anyone — usually free assistants in a browser tab. It is the most common way personal or confidential information ends up somewhere nobody has checked.
Contact
Email info@trestano.com and we'll respond within one working day.
Privacy
Trestano is the data controller for the information you give us. We collect only what we need to produce your results: your company name, sector, employee band, whether you have EU customers or staff, and the details of each AI tool you record. If you create an account we also store your email address.
We use that information to generate your risk ratings and documents, to keep your register available when you return, and to email you about your account. We do not sell your data and we do not use it to train AI models. Data is stored on servers in the UK and EU, encrypted in transit and at rest, and access is restricted to staff who need it to run the service.
Anonymous registers that are never claimed by an account are deleted after 12 months. Account data is deleted within 30 days of you closing your account. Under UK GDPR you can ask for a copy of your data, correct it, delete it, or object to how we use it — email info@trestano.com and we'll respond within one month. You can also complain to the Information Commissioner's Office (ico.org.uk).
Terms
By using Trestano you agree to these terms. Trestano provides software that helps you record the AI tools your business uses, rates them against published UK and EU guidance, and generates policy and assessment documents from your answers. It is guidance and documentation support — it is not legal advice and does not create a solicitor-client relationship. You remain responsible for your own compliance decisions.
Your results depend entirely on the accuracy of the information you enter. You agree to keep your account details secure, to use the service lawfully, and not to resell or redistribute the generated documents as a compliance product of your own. You keep ownership of the content you enter and of the documents produced from it.
Paid plans are billed as shown on the pricing page — one-off for Starter, monthly in advance for Pro. You can cancel a subscription at any time and it will run to the end of the paid period; we don't refund part-months. To the extent the law allows, our total liability is limited to the amount you have paid us in the previous 12 months, and we are not liable for regulatory penalties arising from your own use of AI. These terms are governed by the law of England and Wales. We may update them and will tell registered users by email before material changes take effect.
Discover your AI Governance Maturity Score
The Trestano AI Governance & Readiness Diagnostic™ measures where you stand across five dimensions — and gives you a prioritised plan for what to do next.
Book a Diagnostic