AI governance and compliance services, also called AI assurance services, are the testing and documentation work that proves an AI system does what its owner claims. From Dhaka, Eicra Soft Limited delivers that work for international companies: model testing, code audit, EU AI Act documentation, risk and traceability records, oversight of payroll, accounts payable (AP) and employer of record (EOR) work, and incident logs. Each one ends in a document an auditor, a customer or a regulator can read.
Book a 30-minute scoping call See the six services
Tested in your own repositories, model endpoints and ticketing · Confidentiality and data processing agreements signed before any data moves · Overlap hours agreed at kickoff
Our AI governance and compliance services are six separate engagements within our AI services range, each with its own scope and price. Testing and audit produce the evidence, and the documentation services turn it into the records a reviewer asks for. Oversight and incident work keep the record true after go-live, when models, prompts and data start to change in production.
A structured evaluation set built from your cases, accuracy, precision, recall, hallucination and bias checks, red-team prompts and a written result report you can show a reviewer.
A review of AI-written source code for security holes, licence risk, dead paths and untested logic, with a prioritised fix list and the re-test results.
Technical documentation, risk management records, post-market monitoring plans and human-oversight descriptions mapped to the articles that apply to your system and its role.
Risk register, model cards, data lineage, decision logs and an audit trail of sign-offs, written so a reviewer can follow every step from data to decision.
Human-in-the-loop reviewers with payroll and finance experience check AI output on payslips, invoices and contracts against your rules, and record every exception. Testing shows how a model behaves; human-in-the-loop review records who approved each live decision.
Incident templates, severity and escalation rules, root-cause write-ups and a register you can hand to a customer or insurer after a failure.
AI governance and compliance services turn a test into a record in one order. Your system is measured on your own cases first, the risk and documentation files are written from those results, and a named owner signs them. Every run is then kept dated, so a reviewer can repeat it.
The AI governance and compliance service you need depends on who is asking. An engineer needs testing or a code audit; a customer’s security team needs risk and governance documentation; counsel or a regulator needs EU AI Act documentation; and an incident needs a written record. Payroll and finance teams need trained reviewers on the output itself.
| Your situation | What you need | Where we start |
|---|---|---|
| You cannot say how accurate the model actually is | AI Model Testing Services | Test set built from your own cases and scored |
| AI wrote large parts of the codebase | AI Generated Code Audit | Repository scan, a fix list and a re-test |
| Your system falls under an Annex III use case | EU AI Act Documentation | Classification check against the Act, with your counsel |
| A customer’s due-diligence form asks about AI | Risk and Traceability Documentation | Gap review of what you already hold, document by document |
| AI touches payslips, invoices or contracts | AI Oversight for Payroll, AP and EOR | Calibration sample on your real payroll or invoice output |
| Something went wrong and nobody recorded it | Error and Incident Documentation | Incident register, severity rules and a first write-up |
The fit check asks five questions about your AI system and who is asking about it. Read across your answer and note the service named; the one that appears most often is where to start. If testing appears twice or more, start there, because every document, from the risk register to the technical file, rests on measured evidence.
| Question | Option A | Option B | Option C |
|---|---|---|---|
| 1. Can you state your model’s accuracy today? | Yes, measured on a held-out set → EU AI Act Documentation | Only the vendor’s benchmark → AI Model Testing Services | No number at all → AI Model Testing Services |
| 2. How much of the codebase did AI write? | A little, fully reviewed → AI Model Testing Services | A lot, reviewed quickly → AI Generated Code Audit | Nobody has counted → AI Generated Code Audit |
| 3. Who has asked you about AI risk? | Nobody yet → Risk and Traceability | A customer or insurer → Risk and Traceability | Counsel or a regulator → EU AI Act Documentation |
| 4. Does AI touch pay, invoices or contracts? | No, internal drafts only → AI Model Testing Services | Yes, with a human check → AI Oversight for Payroll, AP and EOR | Yes, unchecked → AI Oversight for Payroll, AP and EOR |
| 5. What happens when AI output is wrong? | Logged with a root cause → EU AI Act Documentation | Fixed quietly in a chat thread → Error and Incident Documentation | Nobody records it → Error and Incident Documentation |
AI assurance work runs in one order: measure, then document, then keep the evidence dated. Data governance sits underneath all three. Each rule below is applied in that order, and we say so when the cheaper step is the one you need. Skipping a step means paying for it twice, once to write it and once to rewrite it.
A risk register written before anything was tested records opinions, not facts. The first question a reviewer asks is how you know, and a policy document cannot answer it.
So testing comes first: a test set from your own cases, written guardrails, a recorded result and a date. The documents are then descriptions of something real.
Assurance documents are not marketing. The reader is an auditor, a customer’s security team or your own counsel, and each of them is looking for the gap you did not mention.
So we state limits plainly: what was tested, what was not, what remains open and who owns it. A stated gap survives review; a hidden one does not. It also costs more when a customer finds it.
Evidence that cannot be repeated is an anecdote. Models change, prompts change and data drift sets in, so a result without a date and a method is worth very little six months later.
You receive the test set, the scripts, the run dates and a change log. Your team can then repeat the same test after the next model upgrade and compare the two results line by line.
AI governance and compliance work is judged by the first reviewer who challenges it, so every record we write starts from measured evidence. Our files follow the EU AI Act article by article and map risks, including bias and drift, to the National Institute of Standards and Technology (NIST) AI Risk Management Framework (NIST, 2023), and we write the control descriptions in the form an ISO/IEC 42001 management-system review expects.
| Item | Without | With EICRA |
|---|---|---|
| Model accuracy | “We use a leading model” | Measured on a held-out test set built from your own cases, with precision and recall |
| Bias and safety | Assumed handled by the vendor | Tested against written guardrails with documented prompts and a recorded pass or fail |
| AI-written code | Merged because it runs | Audited for security, licence and untested paths, with a fix list and a re-test |
| EU AI Act | A blog post and a hope | Documentation mapped article by article to your system’s role; legal positions stay with your counsel |
| Traceability | Screenshots in a chat thread | Dated records, model cards, data lineage, an audit log and named sign-offs |
| Payroll and finance output | Spot-checked when someone remembers | Human reviewers on a written rubric, every exception logged with its cause and fix |
| Incidents | Fixed quietly, never recorded | Severity and escalation rules, a root-cause write-up and a register you can share |
| Contracts | A freelancer invoice | Company contract with General Data Protection Regulation (GDPR) Article 28(3) processor terms where they apply |
Pricing opens the list; timing, data handling, switching provider and what assurance cannot prove follow.
Reviewed by Asma Sultana Minu, Local Corporate Counsel. Informational only, not legal advice.
More answersEach service has a fixed price agreed in writing after a free 30-minute scoping call. For documentation, the two-week diagnostic and the four-week pilot pack carry the prices shown at the top of this page; testing, code audits and oversight are scoped the same way, with every deliverable and its acceptance check listed before you approve anything.
AI governance and compliance services give an organisation the evidence and records that show its AI is controlled: tested models, audited code, a risk register, policies, data governance records, documentation mapped to laws such as the EU AI Act, and traceability records for oversight and incidents. They turn good intentions into dated files a reviewer can check and repeat.
Two weeks for the documentation diagnostic and four weeks for one AI system's pack, as the top of this page shows; testing and code audits are scoped in the same free call. Most time goes into collecting records, so we list every repository, model endpoint, owner and approval we need at kickoff.
No. Testing measures how a model behaves on a defined set of cases and produces a result with a date and a method. An audit reviews whether the records, controls and sign-offs around that model hold up for a third party. We do the first with AI model testing and prepare the second through documentation; a formal audit opinion stays with an accredited auditor.
Under a non-disclosure agreement (NDA) and a data processing agreement (DPA), signed first. As a Bangladesh-based team we use least-privilege named access that is removed at handover, prefer synthetic or masked test records to personal data, and write the retention policy and deletion date into the contract.
Through the transfer mechanism written into the DPA. Bangladesh has no EU adequacy decision, so where personal data must leave the EU at all, the DPA carries the European Commission's standard contractual clauses and the transfer safeguards your counsel asks for. Where the work allows, we avoid the transfer entirely by testing on synthetic or masked records, or by working inside your own environment under named access.
Yes, after a gap review. We read what you already hold, document by document, mark what is dated, sourced and signed, and list what is missing or contradicts the live system. Records that pass are kept and referenced; only the gaps are rewritten, so you do not pay twice for the same file.
A test set is only as good as the cases you give us. If the sample is small, stale or unrepresentative of production, the result is a measured fact about that sample, not a guarantee about every future input. We state the sample, its date and its limits in every report, and where the underlying records are inconsistent we point you to data quality and cleansing work before testing starts.
Send us one AI system and the question your auditor asked. We will tell you which records are missing and which test comes first.
Request A QuoteBook a 30-minute scoping callYour request is subject to our Terms and Privacy Policy.
