Case study · Education & career services
Case Study: How an AI-first education business turned AI governance into a selling point
A lightweight, ISO/IEC 42001-aligned framework that supported growth instead of slowing it, with no certification programme required.
Epocha worked with QualitaX to govern its AI use and meet customer and regulatory requirements. The framework surfaced missing controls early, brought AI, privacy, security and regulatory risk into one view, and turned AI assurance into a selling point.
- Missing critical controls surfaced early
- One integrated risk view
- Business-sized risk controls
The challenge
Governance was seen as a brake on growth
Epocha was redesigning its whole business around AI and planned a more aggressive go-to-market strategy. Its concern: an ISO/IEC 42001-aligned framework would slow down both priorities.
Meanwhile, security and AI-assurance questions were starting to appear in procurement and funding questionnaires, especially in education.
Our approach
Baseline first, then build
- Phase 1
Set the baseline
An evidenced picture of where AI is used in Epocha, what to govern and where the gaps are.
- AI-footprint process map and AI & systems register
- Supply-chain role determination (producer, deployer, customer, subject)
- Build scope with a fixed-price proposal
- Phase 2
Build the core foundations
Risk controls, records and evidence to answer stakeholders’ AI-assurance questions.
- One integrated AI × privacy × infosec risk register
- Controls aligned to ISO/IEC 42001 and ISO/IEC 27001
- Evidence-backed, role-scoped self-assessment
Flexible by design: Epocha could stop after phase one, and the phase-one fee was credited to the build.
The results
Governance that helps the business scale and sell
- Missing critical controls surfaced earlyFound by the integrated risk register, and Epocha was able to fix it at that moment rather than after an incident affecting customers.
- One integrated risk viewAI, privacy, regulatory and information-security risk in one place.
- Business-sized risk controlsA framework aligned to ISO/IEC 42001 and 27001, sized to the business.
- A tailored AI policyBuilt around Epocha’s regulations, objectives, AI tools, data and services.
- Evidence for questionnairesReal answers for buyer and funder AI-assurance questions.
- An AI roadmap Epocha ownsSequenced, and already being put into practice.
“Working with QualitaX helped Epocha approach AI governance with greater clarity. Their guidance deepened our understanding of risk exposure and the importance of accountability, transparency, and human oversight. I value their practical approach to connecting responsible AI principles with decisions that shape our technology strategy and educational mission.”
Facing AI-assurance questions from buyers or funders?
Start with a QualitaX AI Exposure Review: a clear baseline and a fixed-price plan.