← Solutions
DataTrending

AI governance and EU AI Act readiness

An AI inventory, risk classification and controls aligned to the EU AI Act and ISO/IEC 42001, so AI can scale without regulatory surprises.

Typical timing
8–12 weeks
Engagement
Fixed scope
Delivery framework
User researchDiscoveryAlphaBetaLive
Discuss this solutionData capability →

Objective

Put proportionate governance around the AI you build and buy. The EU AI Act’s transparency duties already apply, and obligations for high-risk systems follow in 2027 and 2028 after the Digital Omnibus deferral. We inventory AI use, classify risk, and implement controls and documentation aligned to ISO/IEC 42001 — useful well beyond the EU.

You may need this if

  • AI tools are in use across the business with no central register
  • You place AI systems on the EU market or use them for decisions about people
  • Customers or procurement are asking for your AI policy
How it runs

Activities, step by step

The plan follows our delivery framework. Steps that do not apply to this kind of work are left out rather than padded.

  1. 02 · Discovery2–3 weeks

    Inventory and classify

    • AI systems and use cases inventoried, including shadow AI
    • Risk classification under the EU AI Act
    • Roles determined: provider, deployer or both
  2. 03 · Alpha3–4 weeks

    Framework

    • AI policy and acceptable-use rules
    • Risk assessment and impact assessment templates
    • Human oversight, transparency and logging requirements
  3. 04 · Beta2–4 weeks

    Apply to priority systems

    • Assessments completed for higher-risk systems
    • Technical documentation and model records
    • Staff AI literacy training
  4. 05 · LiveOngoing

    Operate

    • New AI use cases reviewed through a light-touch gate
    • Monitoring and incident process for AI
    • Regulatory changes tracked

Deliverables

What you keep at the end.

  • AI system inventory and risk classification
  • AI policy and governance framework aligned to ISO/IEC 42001
  • Completed risk and impact assessments
  • Technical documentation for priority systems
  • AI literacy training

Outcomes

What it is built to change.

  • Confidence about which obligations apply and when
  • AI adoption that scales without regulatory rework
  • Credible answers for customers and procurement

Often combined with

Every engagement starts with a 45-minute working session with the SME who would own the work. No deck.

Discuss this solution