AI governance is a set of rules, roles and processes through which an organisation ensures it uses artificial intelligence responsibly, securely and lawfully. With the EU AI Act in force, it is no longer just good practice but also a legal requirement.
The EU AI Act in brief
Regulation (EU) 2024/1689 on artificial intelligence entered into force on 1 August 2024 and applies in stages:
- from 2 February 2025 – prohibited AI practices and the AI literacy obligation for staff;
- from 2 August 2025 – rules for general-purpose models and governance;
- from 2 August 2026 onwards – the bulk of the requirements, including for high-risk systems, with longer deadlines for some categories that are subject to updates by the European institutions.
The regulation classifies AI systems by level of risk – unacceptable (prohibited), high, limited (transparency obligations) and minimal. Your obligations depend on whether you are a provider of an AI system or a deployer (an organisation that uses it).
What we do
Inventory and AI register
We identify all AI systems and tools in the organisation – including the “hidden AI” in purchased software and the tools employees use on their own – and describe them in a register.
Risk classification
For each system we determine your role and the level of risk under the EU AI Act and the obligations that follow.
AI usage policy
Clear rules for employees: allowed tools, prohibited data, verification of results, transparency towards customers, responsibilities.
Risk register
The risks of using AI – accuracy, bias, confidentiality, security, vendor dependency – with measures and owners, updated regularly.
Impact assessments
A data protection impact assessment (DPIA) under the GDPR and, where applicable, a fundamental rights impact assessment.
AI literacy
Training that meets the requirement of Article 4 of the regulation – tailored to each employee’s role.
Oversight by management
Quarterly reports to the board: what AI is used, what the risks, incidents and benefits are.
Our work is technical and organisational consulting. For legal opinions we work together with your lawyer or with partner law firms.
What the service includes
AI register
All AI systems and tools in one place.
Risk classification
Your role and obligations under the EU AI Act.
Policies
Clear rules for using AI.
Risk register
Risks, measures and owners.
AI literacy
Training under Article 4 of the regulation.
Management reports
Quarterly oversight and KPIs.
How the work is done
- 1
Quick assessment
Where you stand against the EU AI Act and the GDPR.
- 2
Inventory
A register of AI systems and data.
- 3
Policies and risks
Rules, classification, risk register.
- 4
Training
AI literacy for all employees.
- 5
Maintenance
Regular review and reports.
Technologies and tools
- EU AI Act (Regulation (EU) 2024/1689)
- GDPR
- ISO/IEC 42001
- NIST AI RMF
- DPIA
Frequently asked questions
Does the EU AI Act affect us if we only use ChatGPT?
Yes – as a deployer you have at least the AI literacy obligation. Further obligations depend on what you use AI for – for example, recruitment or creditworthiness assessment are high-risk.
What are the penalties?
The regulation provides for significant fines that depend on the type of infringement and the size of the organisation. More importantly, compliance reduces the real risks to the business.