AI TRUST & GOVERNANCE
AI is arriving faster than the proof that it can be trusted.
We examine the evidence behind the AI you use or build, and give your leadership a clear position it can act on and show.
Do you really know what your AI does, what it was trained on, and where it stops being reliable?
Is AI already at work in tools you own, or acting on your behalf, without anyone having mapped it?
If a customer, a partner or a regulator asked you to show it can be trusted, could you?
- An assessment, not a certification
- Documents, technical records and live demonstrations examined
- Sensitive evidence never leaves your environment
- Fixed scope and price
For organisations
For organisations that use or build AI, agents included. Know what your AI does, and show it.
Discover the AI Evidence ReviewFor startups
Before the pilot, the tender or the round. A short, fixed-scope assessment of your AI product.
Discover the Pre-Launch ReviewWHY OXON X
Legal rigour and technical depth, in one team.
| Aspect | Big 4 · large law firms | At Oxon X |
|---|---|---|
| Who does the work | A pyramid: you meet the seniors, juniors do the work | The experts you met, from first call to debrief |
| Law and technology | Separate teams or firms, with hand-offs between them | Both disciplines in one team, one conversation, no hand-offs |
| Proof | Interviews, questionnaires, a maturity score | Each answer checked against evidence; legal duties scored apart from good practice |
| Focus | AI as one practice among many | AI only: models, data flows, agents |
| Time and price | Open-ended scope, months to deliver | Fixed scope and price, weeks to deliver |
HOW IT WORKS
Start from what you say you have. Then check the evidence.
Map
All your AI, including agents and AI inside tools you own.
Accountability
Owners, registers, contracts, risk files.
Data
What goes in, on what basis, where it travels.
The model and its supplier
What it was trained on, on what right, and tested for what; what the supplier shows.
Control in daily use
Who supervises, with what authority; what an agent does alone.
Security and sector rules
Cloud, incidents, the rules of your sector.
153 checks, each with a written criterion for enough evidence; binding and voluntary are scored apart.
Binding obligations and voluntary guidance are scored apart.
Each system is scored against the regimes it actually falls under. A good score on good practice never hides a gap in what the law requires. Every finding cites the text it rests on and the evidence behind it.
Binding obligations — Saudi regime shown
78 / 100
- Lawful basis and data principles
- Rights of individuals
- Transfers outside the Kingdom
- Records, data protection officer and impact assessments
- Contracts with processors and subcontractors
- Security and breach notification
- Sector and hosting rules, where they apply
Voluntary guidance
Reported on its own. Never added to the score.
- Fairness and bias measurement
- Explainability
- Robustness and drift monitoring
- Human oversight
- Transparency to users and for generated content
- Agent permissions and traceability
- AI risk management
Some of these points become binding depending on the system which is assessed (for example high-risk system under EU AI Act or medical device under SFDA rules in Saudi Arabia)
Illustrative, and not a client result. Both lists are extracts: they name the areas covered, not the full set of scored controls.
INSIGHTS
All insightsStart with a conversation.
Tell us about your AI. We reply with a scope and next steps within two business days.
Request an assessment