Just ask GEORGE™
AI governance mapping for UK regulated firms.
When the regulator asks how your AI is governed, the answer is a chain: obligation, risk, control, evidence. Just ask GEORGE™ builds it from your data and shows you where it breaks.
Built for UK regulated services: Banking, London Market, Consumer Insurance, Legal and Gambling.
01 · Chain
One chain. Every AI use case.
Your estate is the map. A chain is any path walked through it: trace any obligation forward to its evidence, or any evidence back to the obligation it serves. No reconstructing it by hand when the supervisor writes.
- 01
Obligation
FCA, PRA, ICO, SRA, Gambling Commission, EU AI Act, internal policy.
- 02
Risk
What could go wrong for customers, markets, the firm.
- 03
Control
Preventive, detective, corrective. Owned and operated.
- 04
Evidence
The artefact in your evidence systems (Confluence, Jira, GRC, SharePoint) that demonstrates the control operated.
02 · The difference
Your data is the map.
Most governance engagements fit your firm onto their model and end with a report. Just ask GEORGE™ works the other way round: your use cases, your controls and your evidence set the structure, and our maintained regulatory architecture completes it. That architecture is reviewed by practising industry specialists before every release. Where your records leave a gap, we fill it, and everything we add is visibly marked as ours until you confirm it.
The map stays live through your client login, maintained as the rules move.
Not a report you file. A chain you can walk.
The architecture is already built.
Five sector configurations. More than 4,100 governance elements connected by more than 8,600 mapped relationships across Banking, London Market, Consumer Insurance, Legal and Gambling; the Banking configuration alone holds over 1,000 elements. The coverage runs from SS1/23, the EU AI Act, Consumer Duty, DORA, BCBS 239 and SMCR to the sector codes, SRA Standards to the Gambling Commission LCCP. Every number above is real, and you can count for yourself in the walkthrough.
03 · The approach
We start where the supervisor will start.
AI governance often reads beautifully on paper and fails under scrutiny. Creegle, the assurance practice behind Just ask GEORGE™, is built on decades of experience inside regulated firms. We know what good evidence looks like, what fails a review, and where the gaps hide before a supervisor finds them.
Creegle works inside your team, not above it. Our practitioners bring the assurance discipline; Just ask GEORGE™ brings the structure, the evidence architecture, and the regulatory fluency, in language your second and third lines can actually defend. Your people stay accountable throughout: we build the map with you, we do not take decisions for you.
Governance is only real when it is traceable.
04 · The stakes
This is personal liability, not corporate risk.
Under SMCR, the named Senior Manager is personally accountable for AI governance failures in their remit. Not the firm. Not the committee. The individual whose name is on the form. No AI-specific rulebook is required for that accountability to attach; the remit is enough.
A Section 166 does not ask whether your firm had a policy. It asks whether the policy was implemented, evidenced, and tested. The gap between those two questions is where personal accountability becomes personal exposure.
Just ask GEORGE™ gives the named individual a defensible, traceable record before the examination, not a remediation plan after it.
The FCA's own notices make the point. In December 2025 it fined Nationwide Building Society £44,078,500 for failings in its financial crime systems and controls; three years earlier it fined Santander UK £107,793,300 for serious and persistent gaps in its anti-money laundering controls. Behind every one of those penalties sits a named Senior Manager whose conduct can be examined long after the firm's fine is paid.
A Section 166 skilled person review is paid for by the firm. The FCA puts the average cost at around £500,000, and firms collectively incurred £44.7 million of skilled person costs in 2024/25 alone. The question is not whether your firm can afford Just ask GEORGE™. It is whether it can afford not to have the evidence ready.
The same logic holds outside financial services. A law firm's COLP and a gambling operator's Personal Management Licence holder answer personally to their regulators. Different regulator, same question: where is the evidence that your controls operated?
“The regulator will not read your policy. They will ask for the evidence it operated.”
05 · What you get
Findings, not opinions.
Just ask GEORGE™ reports what is observable. It names what is absent and stops there. No adequacy judgements, no consultancy opinion dressed as fact. That restraint is what makes the output defensible in front of the people who will ask.
- Control with no named owner.
- Evidence not yet attached.
- Obligation with no mapped control.
- Use case logged but chain incomplete.
And not every gap is a failure. Where you choose not to close one, it is recorded as a position: an owner, a rationale, a date. Under SMCR, a documented decision is evidence of oversight. An undocumented one is a finding waiting for the regulator to make it for you.
Fixed scope. Fixed fee.
It starts with a half-day scoping call under NDA. We confirm the AI in scope, which obligations bear on it, and which of your systems hold the evidence. You leave the call with a defined turnaround, and a fixed quote follows the same day. No open-ended retainer, no discovery phase that becomes the engagement.
The deliverable is a prioritised gap report: for each obligation in scope, whether the obligation-to-evidence chain is complete, partial or broken, the specific gap named, and each gap ranked by materiality. You can take it straight into your next audit or board meeting.
From there, your choice. Close the gaps with your own teams using the report. Extend the scope upward into governance and assurance coverage. Or keep the map alive through your client login.
06 · Written for
One map. Multiple lenses.
The Senior Manager
Your name is on the accountability map. The evidence should match it.
The Chief Risk Officer
You need a defensible evidence chain, not another assurance presentation.
Head of Internal Audit
You are being asked to test controls that were never properly documented.
Chief Compliance Officer
Your policies are sound. The question is whether their operation can be demonstrated across the estate.
The COLP
You must self-report what the firm gets wrong. Better to see it mapped before the SRA does.
The PML Holder
Your licence is personal. The evidence chain behind it should be too.
07 · Provenance
The Architect
Just ask GEORGE™ was designed and built by Cri Quentin, founder of Creegle Ltd: twenty years in programme quality and regulatory test strategy across UK Tier 1 banking and London Market insurance. The architecture took shape on MiFID II, in the gap between what the rules required and what firms could actually evidence.
Classically trained in test discipline, qualified in AI testing. BCS Certified AI Tester (ISTQB) and ISEB Practitioner.
Every first engagement begins with the architect. The map is scoped by the person who built it, then delivered by a practice that works to the same standard.
“Her independent review gave leadership a clear, evidence-based go/no-go decision and a credible recovery path.” Head of Platforms, UK Private Bank
Before the regulator asks,
just ask GEORGE™.
A 30-minute guided walkthrough configured for your sector, on our data, not yours. Nothing confidential changes hands in either direction, so there is no paperwork to sign first. Tell us which seat you sit in, and we will pick the obligation that keeps that seat awake and trace it through risk, control, and evidence before the call ends.
Scoping conversations that touch your estate run under mutual NDA.