AI governance that helps you decide, build and prove.
Eshalu is an AI governance and responsible AI practice. We independently assess AI systems, advise organisations on how to use and implement AI responsibly, and build internal capability through practical training. Those roles are kept separate where independence matters.
Evidence over assertion
A policy document is not proof. Every conclusion we publish is traceable to an evidence item, a reviewer decision and the assessment version that produced it.
A person decides
Nothing becomes a finding without an authorised human. Automated analysis is bounded; the client sees the reviewer's conclusion, never the machine's.
What “independent” means
Independent assessment means Eshalu has not designed or implemented the system or control work being assessed. If Eshalu materially advises on, designs or helps implement that work, we will not then present ourselves as its independent assessor. This is not a statutory audit and not certification.
Honest about limits
We report coverage and gaps. We do not certify compliance, we do not give legal advice, and we say so on every output rather than in the small print.
Who you will actually be working with
Raghuram Saripalli
Founder & Principal Assessor, Eshalu
Eshalu was built around a single conviction: that the hard part of AI governance is not writing the policy, it is proving that the control behind it exists, that someone owns it, and that an independent person checked it. Most organisations can list their AI tools. Far fewer can show the evidence.
That conviction came from twenty-three years inside enterprise transformation programmes — at organisations including AstraZeneca, Roche, GSK, Takeda, Jaguar Land Rover, British American Tobacco, Philips, Walgreens Boots Alliance, Sandvik Mining and Oxford University Press, and alongside Deloitte, EY, IBM, Infosys and TCS, across more than fifteen countries. The same gap appeared everywhere: critical decisions were being made in workshops, spreadsheets and assumptions, while the evidence that would actually settle them sat untouched inside enterprise systems and day-to-day process behaviour.
Raghuram founded Eshalu to close that gap with a governed record rather than a document — ten controls, an evidence trail with custody, and an authorised reviewer whose decision is the one the client sees. He leads the methodology, the reviewer standard and every client engagement personally.
- 23 years in enterprise systems, architecture and governance, across large-scale ERP and business transformation programmes in more than fifteen countries.
- ISO/IEC 42001 Implementer — PECB, issued August 2026.
- ISO/IEC 27001:2022 certified organisation — giving clients added confidence in how Eshalu protects information and manages security risk.
- AI: Law, Policy and Governance — The London School of Economics and Political Science.
- IAPP AIGP — in progress. CIPP/E — planned.
The commitments behind the engagement
We start with the right scope
The first engagement is deliberately contained — one AI system, one advisory problem or one defined training need — with a clear deliverable before you decide whether to extend further.
Scope is written down
Every engagement begins with a written scope and a fixed proposal: systems, evidence assumptions, reports, templates, workshops and review cycles. Nothing is described as unlimited.
You stay accountable
The client approves its policies, assigns roles, operates controls, makes implementation decisions and obtains legal advice where required. Where Eshalu provides consulting support, that work is kept outside Eshalu independent-assessment scope.
Your data is treated as the product
Client evidence is never used to train models, access is tenant- and workspace-scoped, and what was withheld from an external pack is recorded rather than silently dropped. Eshalu Technologies Ltd is the data controller for client evidence held in the platform, registered with the Information Commissioner's Office under reference ZC225309.
Capacity is stated, not implied
Engagements are taken on in a sequence, not treated as unlimited access. Scope, workshops, review cycles and specialist support are agreed up front, and additional work is discussed before it is incurred.
The record stays yours
The governed record — controls, evidence references, reviewer decisions and issued reports — is exportable at any point during or after an engagement. Nothing about the assurance you have built depends on staying a client.