Are you in control of your AI?
Your AI systems are making decisions. Your people are making decisions with AI. Both create exposure.
Handrails tests how your team actually uses AI on real work and how your company responds when AI goes wrong.
A new risk, but growing exponentially.
You're accountable for what your AI does
Customers don't care that AI made the call. They care that your company sent it, said it or signed off on it. Accountability ends with you.
Controls only count if they hold under pressure
Boards and partners want escalation paths, override capability and evidence your people behave inside the policy you wrote. Your AI vendor doesn't provide either.
Proof, not policy
Boards, investors and customers have stopped accepting "we have a policy" as the answer. Regulators hold deployers as carrying obligations independent of providers. Simulations and behavioral evidence are how the answer gets evidenced.
Your AI fails. Your people fail. Both end with you.
- Finance pastes customer data into a public model
- Legal trusts an AI contract summary because the meeting starts in ten minutes
- HR can't reconstruct how a shortlist was made
- The training was completed. The behavior didn't follow.
- A copilot issues a refund outside policy
- A prompt injection slips through human review
- An agent commits a vendor renewal above its authority
- The control was in the policy. It was never operationalised.
The obligations behind your AI policy are growing.
High-risk AI must be designed and deployed to be effectively overseen by natural persons during use. Deployers carry obligations under Art. 26 independent of providers.
Establish, implement, maintain and continually improve an AI management system. Effectiveness testing of AI governance programmes, including the human element, is in scope.
Where AI vendors or copilots act as material service provider components, severe-but-plausible scenario testing applies. Simulations are the standard format.
The entity demonstrates commitment to integrity and ethical values. Standards of conduct around AI use are communicated and adherence is evaluated.
Built around your business. Run in three steps.
Map the risk surface.
Share your AI tools, workflows and AI usage policies. Holly builds realistic scenarios tailored to how AI is actually being used across your company.
Priya · CFO
Marco · AI leadHolly runs the simulations.
Short virtual sessions conducted over video. Holly walks each participant through realistic AI-related situations, probing decisions, escalation paths and judgment under pressure.
See where the gaps are.
Every session rolls into a consolidated view of behavioral risk, policy gaps, escalation failures and control weaknesses. Leadership sees exactly where intervention is required.
One risk map. Four artifacts.
Board-ready summary
One-page narrative for the board or leadership team. What was tested, where the team held, where they didn't, what we're doing about it.
System risk map
Which AI surfaces are exposed, which controls held under pressure and which broke down. Owners and target dates assigned.
Behavior risk map
Which teams are exposed and what the exposure pattern is. Data leakage, hallucination, IP exposure, decision auditability.
Trend line (on roadmap)
Quarter-on-quarter movement on the metrics that matter: scenarios passed, non-approved AI use, data control failures, AI output verification.
AI changes weekly. Annual training can't keep up.
Consultants + LMS videos
- Quote and workshop process takes weeks
- Generic AI risk scenarios delivered from a slide deck
- Training tracks completion, not real-world decision making
- Findings and reports produced after the session ends
- Policies reviewed annually while AI usage changes monthly
Continuous AI readiness testing
- Run simulations any day, any time
- Scenarios tailored to your actual AI tools & policies
- Test how employees respond in realistic situations
- Behavioral findings and evidence generated automatically
- Continuous testing that evolves as your AI usage changes
The first real test of your AI governance shouldn't be a live incident.
Stress-test your people, policies and escalation paths before reality does.