Epocha worked with QualitaX to govern its AI use and meet customer and regulatory requirements. The framework surfaced missing controls early, brought AI, privacy, security and regulatory risk into one view, and turned AI assurance into a selling point.
“Working with QualitaX helped Epocha approach AI governance with greater clarity. Their guidance deepened our understanding of risk exposure and the importance of accountability, transparency, and human oversight. I value their practical approach to connecting responsible AI principles with decisions that shape our technology strategy and educational mission.”
Governance was seen as a brake on growth
Epocha was redesigning its whole business around AI and planned a more aggressive go-to-market strategy. Its concern: an ISO/IEC 42001-aligned framework would slow down both priorities.
Meanwhile, security and AI-assurance questions were starting to appear in procurement and funding questionnaires, especially in education.
Baseline first, then build
Set the baseline: An evidenced picture of where AI is used in Epocha, what to govern and where the gaps are.
- AI-footprint process map and AI & systems register
- Supply-chain role determination (producer, deployer, customer, subject)
- Build scope with a fixed-price proposal
Build the core foundations: Risk controls, records and evidence to answer stakeholders’ AI-assurance questions.
- One integrated AI × privacy × infosec risk register
- Controls aligned to ISO/IEC 42001 and ISO/IEC 27001
- Evidence-backed, role-scoped self-assessment
Flexible by design: Epocha could stop after phase one, and the phase-one fee was credited to the build.
Governance that helps the business scale and sell
Missing critical controls surfaced early: Found by the integrated risk register, and Epocha was able to fix it at that moment rather than after an incident affecting customers.
One integrated risk view: AI, privacy, regulatory and information-security risk in one place.
Business-sized risk controls: A framework aligned to ISO/IEC 42001 and 27001, sized to the business.
A tailored AI policy: Built around Epocha’s regulations, objectives, AI tools, data and services.
Evidence for questionnaires: Real answers for buyer and funder AI-assurance questions.
An AI roadmap Epocha owns: Sequenced, and already being put into practice.
Why it matters for education providers
Education buyers and funders are asking more about security and AI assurance. Few providers can answer with evidence yet, so a governed, documented position stands out in competitive bids, without the cost or time of a full certification programme.