# T3

> T3 (legal name T3 Consultants Ltd) helps financial services firms, technology companies and regulators adopt trustworthy AI. It designs and engineers AI controls, runs adversarial red teaming on models, LLM applications and AI agents, and implements end-to-end AI governance operating models aligned to the EU AI Act, ISO/IEC 42001 and the NIST AI RMF.

Where off-the-shelf GRC platforms stop, T3 builds the custom controls, integrations and assurance that fit each client's stack, models and regulator. Its services are organised as seven layers of AI governance, from AI inventory to compliance and audit.

Key facts:
- Name: T3. Legal name: T3 Consultants Ltd. Also known as T3 AI.
- Based in London, United Kingdom. Serves clients globally, with a focus on the UK, the US and the EU.
- Co-founders: Gwendoline Grollier (Co-founder and Head of AI Risk Management) and Lana Hampicke (Co-founder and Head of AI Assurance).
- Sectors: financial services, technology and the public sector.
- Contact: contact@t-3.ai, +44 20 8087 0917 (UK), +1 213 659 0224 (US).
- Book a call: https://calendly.com/contact-qfg/firstcall-invite
- LinkedIn: https://www.linkedin.com/company/t-3-ai/
- X: https://x.com/T3_Consult
- YouTube: https://www.youtube.com/@T3-AI-Channel
- Instagram: https://www.instagram.com/t3consultants

Standards contribution: members of the T3 team contributed to the development of the EU AI Act, ISO/IEC 42001 and the NIST AI RMF.

Awards and recognition:
- Winner, AI Leader of the Year 2025, Women in Governance, Risk and Compliance
- Winner, North America AI Leader of the Year 2025, Women in AI
- Top 33, Women Shaping the Future of Responsible AI for Social Impact 2025, She Shapes AI
- Nominee, Transatlantic Growth Awards 2025

Certifications and memberships:
- Cyber Essentials certified
- WEConnect International certified women-owned business
- Member of the Anthropic Claude Partner Network
- techUK member
- TechZero pledger

Clients and partners include Gov.UK, Google, AIMA, Remitly, Castle Trust Bank, The Conduit, Women of Business, MCM (Midland), Hexagon, Stanford and Compliance Week.

## About

- [About T3](https://t-3.ai/about-us/): who T3 is, why clients choose it, awards and clients
- [Our team](https://t-3.ai/our-team/): founders and team
- [Case studies](https://t-3.ai/project-partners/): AI governance, compliance and training work across healthcare, media, financial services, SaaS and gaming
- [Contact](https://t-3.ai/get-in-touch/): enquiries and contact details

## Services

T3's services are seven layers of AI governance. Each can be bought on its own; together they cover the AI lifecycle from discovery to audit. T3 extends a client's existing tools, frameworks and risk processes rather than replacing them, and is independent of platform vendors.

- [Services overview](https://t-3.ai/service/): the seven layers of AI governance, how they fit together and where to start
- [AI Inventory](https://t-3.ai/service/ai-inventory/): AI inventory and shadow AI discovery. T3 finds every AI system, model, agent and AI-enabled supplier service in the estate, risk-tiers each one and names an owner.
  - Deliverables: AI Inventory Register; Shadow AI Assessment, with an approve, replace or block decision for each tool; EU AI Act risk classification, including provider or deployer role; model registry setup; AI use case intake process.
  - Timeline: a first register in about six weeks, then a quarterly discovery check.
  - Works with existing tools such as Microsoft Purview, ServiceNow, MLflow, Amazon SageMaker, Azure ML and Google Vertex AI.
  - Aligned to: EU AI Act, DORA, NIST AI RMF, ISO/IEC 42001.
- [AI Risk Management](https://t-3.ai/service/ai-risk-management/): AI risk management frameworks that hold up with regulators. T3 extends the client's enterprise risk framework to AI, sets AI risk appetite and thresholds, and runs the first assessments on the highest-risk systems. Depth follows risk.
  - Deliverables: AI Usage Policy; AI Risk Assessment method and template; AI Risk Register linked to the inventory; AI Impact Assessment; Human Oversight Design.
  - Timeline: a working framework in about eight weeks, with optional annual independent challenge on the highest-risk systems.
  - Aligned to: EU AI Act (Articles 9, 14 and 27), NIST AI RMF, ISO/IEC 42001, ISO/IEC 23894, DORA, PRA SS1/23, FCA Consumer Duty and SM&CR.
- [AI Security](https://t-3.ai/service/ai-security/): defensive and offensive AI security. T3 reviews configuration and access first, then threat models and red teams LLM applications and AI agents, and re-tests every fix.
  - Deliverables: LLM Configuration Review, including Microsoft Copilot and SaaS AI features; AI Threat Model; AI Access Control Design; Prompt Injection Testing, covering direct and indirect injection, jailbreaks and data extraction; AI Vendor Security Review of model providers, plugins and MCP servers.
  - Timeline: from review to re-test in about six weeks, leaving a re-runnable attack suite.
  - Aligned to: OWASP Top 10 for LLM Applications, OWASP Top 10 for Agentic Applications, MITRE ATLAS, NIST AI 100-2, the UK AI Cyber Security Code of Practice (ETSI TS 104 223), EU AI Act Article 15, ISO/IEC 27001 and ISO/IEC 42001.
- [AI Implementation](https://t-3.ai/service/ai-implementation/): AI implementation built to pass risk, audit and the regulator first time. T3 takes AI from idea to production through agreed gates, with risk and security involved from the first week.
  - Deliverables: AI Use Case Prioritisation, with a build, buy, partner or stop recommendation for each idea; AI Architecture and Control Design; Enterprise AI Rollout of Microsoft Copilot, Claude or ChatGPT Enterprise; Pilot-to-Production Gate; AI Operating Model.
  - Timeline: from idea to production in about twelve weeks.
  - Aligned to: NIST AI RMF, ISO/IEC 42001, OWASP Top 10 for LLM Applications, EU AI Act Articles 26 and 50, DORA third-party risk, PRA SS1/23, FCA SM&CR.
- [AI Agents](https://t-3.ai/service/ai-agents/): AI agent governance and assurance. T3 registers every agent, maps its blast radius, enforces least agency at the tool boundary, red teams the agent loop and sets up continuous evaluation.
  - Deliverables: Agent Register and tool and MCP connector map; identity model and guardrail specification; human oversight design and trace logging standard; adversarial testing findings, remediation plan and re-test certificate; regression eval suite and observability dashboard.
  - Timeline: about ten weeks across three phases, then ongoing assurance.
  - Aligned to: EU AI Act, ISO/IEC 42001, NIST AI RMF.
- [AI Model Assurance & Testing](https://t-3.ai/service/ai-model-assurance-testing/): independent evidence that AI models are fit, fair and safe, not a good demo. T3 agrees pass and fail thresholds before testing, builds a repeatable evaluation suite, runs independent red teaming and fairness testing, and keeps the evidence current after launch.
  - Deliverables: AI Red Team Report, covering jailbreaks, prompt injection, data extraction and harmful output; LLM Evaluation Suite for accuracy, grounding, over-refusal and consistency, built to run in the client's pipeline; Model Cards; Bias & Fairness Audit; Drift Monitoring Setup.
  - Timeline: from scope to approved evidence in about eight weeks, then the evaluation suite runs on every model change.
  - Aligned to: EU AI Act (Articles 10, 15 and 72), NIST AI RMF, NIST AI 600-1, ISO/IEC 42001, MITRE ATLAS, PRA SS1/23, FCA Consumer Duty.
- [AI Compliance & Audit](https://t-3.ai/service/ai-compliance-audit/): one control set for every AI regime. T3 maps each AI system to the obligations that apply under the EU AI Act and other regimes, then builds the evidence an auditor, regulator or client will ask for.
  - Deliverables: EU AI Act Gap Assessment, extended to other regimes that apply, such as Korea, Colorado or MAS; ISO 42001 Readiness Assessment, with a roadmap to certification; AI Literacy Training for the board, senior managers, developers and users; Annex IV Technical Documentation for high-risk systems; AI Audit Trail.
  - Timeline: from regulatory map to audit-ready in about eight weeks.
  - Aligned to: EU AI Act (including Annex IV), ISO/IEC 42001, ISO/IEC 42005, NIST AI RMF, Colorado and other US state AI laws, AI rules in Korea, MAS Guidelines on AI Risk Management, DORA, PRA SS1/23, FCA Consumer Duty and SM&CR, GDPR.

## Assessments and fixed-scope offers

- [5-Day AI GRC Diagnostic](https://t-3.ai/5-day-ai-governance-risk-compliance-diagnostic/)
- [1-Week AI Vendor Evaluation](https://t-3.ai/1-week-ai-vendor-evaluation/)
- [AI Readiness Assessment](https://t-3.ai/ai-readiness-assessment/)
- [AI Maturity Assessment](https://t-3.ai/ai-maturity-assessment/)
- [AI Red Teaming Assessment](https://t-3.ai/ai-red-teaming-assessment/)
- [Bias, Fairness & Jailbreak Testing Clinic](https://t-3.ai/bias-fairness-jailbreak-testing-clinic/)
- [ISO 42001 Certification](https://t-3.ai/iso-42001-certification/)

## Claude (Anthropic) services

- [Claude Trust & Safety](https://t-3.ai/claude-trust-safety/)
- [Claude Enterprise Training](https://t-3.ai/claude-enterprise-training/)
- [Claude Use Cases](https://t-3.ai/claude-use-cases/)
- [AWS Cloud Migration & Claude AI Automation](https://t-3.ai/aws-cloud-migration-claude-ai-automation/)

## Training

- [Courses](https://t-3.ai/courses/): all T3 training programmes
- [Responsible AI Training & AI Literacy](https://t-3.ai/ai-literacy-modular-training/): modular responsible AI and AI literacy training

## Products

- [CompareYourAI](https://www.compareyourai.com/): AI vendor discovery, comparison and evaluation software built by T3. Procurement, IT, security and AI assurance teams match a use case to vendors, compare security and compliance evidence, and export the comparison.

## AI regulation by jurisdiction

- [EU AI Act](https://t-3.ai/eu-ai-act/)
- [Global AI Regulation](https://t-3.ai/global-ai-regulation/)
- [United Kingdom AI Regulation](https://t-3.ai/united-kingdom-ai-regulation/)
- [United States AI Regulation](https://t-3.ai/united-states-ai-regulation/)
- [Colorado AI Act](https://t-3.ai/colorado-ai-act/)
- [Canada AI Regulation](https://t-3.ai/canada-ai-regulation/)
- [Australia AI Regulation](https://t-3.ai/australia-ai-regulation/)
- [Japan AI Regulation](https://t-3.ai/japan-ai-regulation/)
- [Switzerland AI Regulation](https://t-3.ai/switzerland-ai-regulation/)
- [Responsible AI & AI Regulation](https://t-3.ai/responsible-ai-regulation/)

## Key insights

- [Knowledge hub](https://t-3.ai/knowledge/): all T3 articles and guides
- [EU AI Act Compliance Checklist: A Step-by-Step Guide](https://t-3.ai/eu-ai-act-compliance-checklist-a-step-by-step-guide/)
- [EU AI Act High-Risk Deadlines: 2026 vs 2027 Clarified & Evidence](https://t-3.ai/eu-ai-act-high-risk-deadlines-2026-vs-2027-clarified-evidence/)
- [ISO 42001 Implementation Roadmap: A Step-by-Step Guide](https://t-3.ai/iso-42001-implementation-roadmap-a-step-by-step-guide/)
- [ISO 42001 & EU AI Act: Do You Need Both?](https://t-3.ai/iso-42001-eu-ai-act-do-you-need-both/)
- [ISO 42001 AI Vendor Assurance for Procurement vs. ISO 27001](https://t-3.ai/iso-42001-ai-vendor-assurance-for-procurement-vs-iso-27001/)
- [A Practical Approach to FS AI RMF 230 Control Objectives](https://t-3.ai/a-practical-approach-to-fs-ai-rmf-230-control-objectives/)
- [AI Risk Management Frameworks: A Comprehensive Guide](https://t-3.ai/ai-risk-management-frameworks-a-comprehensive-guide/)
- [The Complete AI Asset Inventory Checklist for Regulated Organisations](https://t-3.ai/ai-asset-inventory-checklist-ai-compliance-guide/)
- [Agentic AI Governance Frameworks: Accountability & Runtime Control](https://t-3.ai/agentic-ai-governance-frameworks-accountability-runtime-control/)
- [How to Risk-Tier Custom AI Agents Under ISO 42001](https://t-3.ai/how-to-risk-tier-custom-ai-agents-under-iso-42001/)
- [Agentic AI Red Teaming Best Practices: Expert Methodologies & Guidance](https://t-3.ai/agentic-ai-red-teaming-best-practices-expert-methodologies-guidance/)
- [A Definitive Framework for Prompt Injection Enterprise Defense](https://t-3.ai/a-definitive-framework-for-prompt-injection-enterprise-defense/)
- [AI Security for AI Agents: What Are the Best Defenses?](https://t-3.ai/ai-security-for-ai-agents-what-are-the-best-defenses/)
- [AI Solutions for DORA Compliance in Financial Services](https://t-3.ai/ai-solutions-for-dora-compliance-in-financial-services/)

## Resources

- [Events](https://t-3.ai/events/)
- [Partners](https://t-3.ai/partnerships/)
- [Book a call](https://calendly.com/contact-qfg/firstcall-invite)

## Optional

- [AI Governance & Risk Management](https://t-3.ai/ai-risk-management-governance/)
- [AI Risk Framework](https://t-3.ai/ai-risk-framework/)
- [AI Tool Evaluation & Vendor Due Diligence](https://t-3.ai/ai-tool-evaluation-vendor-due-diligence/)
- [AI Red Teaming & Adversarial Testing](https://t-3.ai/ai-red-teaming-adversarial-testing/)
- [AI Security, Privacy & Red Teaming](https://t-3.ai/ai-red-teaming-llm-security/)
- [AI Bias, Fairness & Explainability Testing](https://t-3.ai/ai-bias-explainability-testing/)
- [AI Testing](https://t-3.ai/ai-system-testing/)
- [AI Strategy & Use Cases](https://t-3.ai/ai-strategy-ai-use-case/)
- [AI Adoption](https://t-3.ai/ai-adoption/)
- [Human Oversight & AI-Driven Decisions](https://t-3.ai/human-oversight-ai-driven-decisions/)
- [Post-Deployment AI Monitoring & Governance](https://t-3.ai/post-deployment-ai-monitoring-governance/)
- [LLM Controls & Residual Risk](https://t-3.ai/llm-controls-residual-risk/)
- [Responsible AI Certification](https://t-3.ai/responsible-ai-certification/)
- [Prompt Engineering for GenAI](https://t-3.ai/prompt-engineering-for-genai/)
- [Responsible AI Foundation (customised to sector and roles)](https://t-3.ai/responsible-ai-foundation-customised-to-sector-roles/)
- [Responsible AI Advanced (customised to sector and roles)](https://t-3.ai/responsible-ai-advanced-customised-to-sector-roles/)
- [EU AI Literacy: Executive Track](https://t-3.ai/eu-ai-literacy-executive-track/)
- [EU AI Literacy: Foundations](https://t-3.ai/eu-ai-literacy-foundations/)
- [EU AI Literacy: Non-Technical Specialists Track](https://t-3.ai/eu-ai-literacy-non-technical-specialists-track/)
- [EU AI Literacy: Technical Team Track](https://t-3.ai/eu-ai-literacy-technical-team-track/)
- [AI Usage Pulse](https://t-3.ai/ai-usage-pulse/): asset management AI usage survey with Altallo
- [Careers](https://t-3.ai/apply-here/)
- [Privacy Policy](https://t-3.ai/privacy-policy/)
- [Cookie Policy](https://t-3.ai/cookie-policy/)
- [Terms and Conditions](https://t-3.ai/terms-and-conditions/)