Where it began
Glasgow’s own team understood their exposure better than any visitor could. What they were missing was the instrument that turns internal knowledge into sustained budget: university courts approve investment cases, not lists of worries, however well founded those worries are.
The approach
CyPro measured the current position against recognised frameworks, agreed a defensible target state, and expressed the distance between the two as a sequenced programme, each step costed and owned. Everything was then written twice: once in the language of practitioners and once in the language of the committee that signs, because analysis the decision-makers cannot read changes nothing.
Why it matters for AI governance
Most AI risk work dies exactly here: a register full of accurate findings that never becomes a funded workstream. The Glasgow pattern, findings ranked by organisational consequence and written for the audience that decides, is how our AI risk assessments and governance roadmaps are built. The board should finish reading with a decision to make, not a document to file.
