01
Bring it as it is
No finished brief or perfect category needed. Start from what is actually happening and what feels unclear.
AI Governance · Security Governance · Technology Risk
Turn ambiguous issues into something you can decide and act on.
- Rules and approval criteria for AI use
- How far to take security requirements
- How to judge a vendor's proposal
- Who decides during an incident, and who is told
Fragment Practice is an independent advisory firm that comes in while the technical, business, and governance questions are still tangled together — no finished brief required.
Fixing what to decide, who is responsible, how far work is delegated and where people review it — through to the conditions under which implementation and operation can continue.
02
Separate and decide
Untangle the mixed issues, name what must be decided, who is responsible, how far work is delegated, and where people review it.
03
Make it handoff-ready
Leave with decision material, explanation, and clear roles — enough for an internal implementation team or vendor to start, for management to approve, and for you to keep updating it yourself.
When people reach out
The situations people bring — as they arise in practice.
If one of these sounds close to what you are carrying, that is enough to start.
Often heard
AI use spread before the rules did
“People started using generative AI, but what can be entered, how output is used, and who checks it are still unclear.”
Generative AIUse rulesHuman review
Often heard
We want to set up governance, but no one owns the design
“We need to establish AI or security governance across the company, but there is no one inside who can design and run it.”
AI governanceRules and controlResponsibility
Often heard
We have no material to explain to management or vendors
“We need a brief for the management meeting, or a way to hand clear requirements to a vendor — and we do not have it yet.”
Management briefThird-party reviewRequirements
Often heard
We need to respond to an external requirement
“A client's security questionnaire, or a query from a regulator or parent company — and we have not settled what to decide or where our responsibility ends.”
External requirementsResponsibilityDecisions to make
Often heard
The PoC worked, but nobody designed what comes after
“The trial went fine. Moving it into real operation needs roles, review points, and stop conditions that no one has set yet.”
After a PoCOperating designReview and stop points
Often heard
The team pushing AI and the team managing risk talk past each other
“One side wants to move, the other wants control. The discussion stalls because no one has separated which decisions belong to whom.”
Adoption vs controlDecision rightsCross-functional
Practice notes
When AI performs the work, what has not been decided.
Notes written from engagements, generalized. They are the fastest way to see how a problem gets structured here — and the part of this site that can be read, forwarded, and argued with without a conversation.
Sept 2026
Faster Tasks Do Not Mean the Work Moves On
AI can produce minutes and drafts immediately, but if people still connect the judgment, verification, records, and handoff every time, the way the work as a whole moves changes very little. This Practice Note reframes maturity in AI use around whether work reaches its next step without a person reconnecting it.
Jul 2026
AI Delegation Reveals How Work Was Designed
Delegating work to AI does not create a new problem so much as make an old one impossible to ignore: the scope, completion conditions, and acceptance criteria that human-to-human work often left unstated. This Practice Note looks at what needs to be designed for people and AI to finish the same work safely.
Jul 2026
Design AI Governance as a Review Cycle
AI governance should not be treated as a fixed policy document. As AI products, usage patterns, and organizational conditions change, organizations need a review cycle that updates decision criteria, review points, responsibility boundaries, and handoff material.
Ways to work together
Three shapes, priced by scope.
Structuring requirements, comparing options, reviewing independently, and designing who decides and who approves — including where implementation is already under way. Start small: you do not need to pick the final shape before the first conversation.
Focused first step
Initial structuring session
From ¥300,000
Excl. tax · 1–2 sessions
When the issue is real but you cannot yet say what to decide.
One or two sessions to separate the situation, name the decisions, set priorities, and choose the next move.
Bounded sprint
Decision-material sprint
From ¥1,200,000
Excl. tax · 2–6 weeks
When a meeting, report, rule update, or handoff needs material soon.
Research, structuring, review, and drafting that leave decisions, options, risks, open questions, and responsibility ready to use.
Scoped advisory
Scoped advisory support
From ¥600,000 / month
Excl. tax · Monthly or biweekly cadence
When important decisions keep coming and you want an expert at the key points.
A defined cadence with agreed themes, review scope, and response expectations — without a resident PMO or daily operations.
Representative situations
A few recurring patterns.
Cases show what was unclear, what was structured, and what people could do next. No client names or confidential detail.
Generative AI governance
Rules and responsibility for expanding AI use
Use cases, input boundaries, output use, human review, and responsibility, turned into material legal, IT, security, and business teams can share.
Use rulesResponsibility
Practical AI-use rules
Turning a policy into criteria the front line can use
High-level rules become concrete review points: what can be entered, how output is used, who reviews, and what to escalate.
Review pointsFront line
Third-party review
Independent review of security policy or risk material
Existing policy, risk assessments, and assumptions reviewed from an outside perspective, with residual risks and next actions organized.
Security reviewRisk
What changes
What you can do after the work.
The point is not a stack of documents. It is that decisions, explanation, and responsibility become workable — and that what remains lets you keep them that way after the engagement ends.
Decide and Explain
Options, open questions, risks, and responsibility become clear, so management and stakeholders can decide and explain.
Clarify Roles and Delegate
Roles and authority across people, AI, automation, internal teams, and external support are set, so work can be delegated with clear boundaries.
Operate, Review, and Consult
Work moves forward with clear review points, conditions for not proceeding while uncertain, and a path to consult or return a decision to the right owner.
Measure Outcomes and Improve
Progress is judged not by usage or hours alone but by quality, decisions, business outcomes, and whether it can continue — then improved.
Continue, Update, and Hand Off
Documents, criteria, roles, and operation can be updated, handed to the next phase, and brought to an appropriate close.
Fit
When this fits — and when another partner is better.
Direct, so you can decide quickly.
Situations Fragment Practice supports well
- Decide what to tackle first when several teams and issues are tangled
- Move AI adoption and control forward in the same discussion
- Turn a policy or requirement into something the front line can use
- Build decision material for management or stakeholders
- Design roles and review points for what comes after a PoC
- Evaluate a vendor proposal or an existing policy from an independent view
- Get an expert at the key points, while decisions and operations stay in-house
Situations another form of support fits better
- A resident PMO, daily progress management, or running meetings
- Hands-on implementation, or high-volume request and exception review
- Audit assurance, certification, or standing in for legal judgment
- Filling an employee position, or always-on work with no defined end conditions
When another form of support fits better, we say so in the initial conversation — and still help clarify the roles and the way forward.
Background
An independent practice, applied across a few connected areas.
Founded by Yasuhiro Shinsho after work across BIPROGY, KPMG Consulting, and Nomura Research Institute / NRI Secure Technologies. The same structuring is applied wherever AI, security, and governance issues arrive mixed together.
Where it applies
AI governanceSecurity and control for AI useSecurity governanceTechnology riskHuman–AI roles and operating designIncident response and IT continuityRegulatory and industry requirementsService concept and viabilityManagement and stakeholder explanation
Next step
Start from what needs to become clear — not from a service name.
If the issue already needs specific support, start with Contact. To compare shapes first, Services explains the options; Cases shows similar situations. To structure it yourselves, Products holds reusable working material. A polished brief is not required.