AI Governance & Regulatory Advisory
EU AI Act readiness, from inventory to evidence.
Prepare AI programmes against the EU AI Act alongside NIST AI RMF and ISO/IEC 42001: know which AI systems you run, how the regulation applies to each, and what evidence you will need to show.
- Practice
- AI Governance
- Regulation
- EU AI Act
- Alongside
- NIST AI RMF · ISO 42001
- Delivery
- Senior, direct
What is EU AI Act Readiness?
The EU AI Act sets obligations for organisations that develop, deploy, import or distribute AI systems in the European Union, scaled to the risk each system presents. Readiness means knowing which of your systems are in scope, what role you play for each, and whether your governance, security and documentation would stand up to scrutiny.
We approach it as a security and governance engagement rather than a paperwork exercise: the controls the regulation expects, such as risk management, data governance, human oversight, accuracy, robustness and cybersecurity, are the same controls that make an AI system hard to misuse.
Who it is for.
- Organisations offering AI-enabled products or services in the EU
- Teams that need to classify their AI systems and understand their obligations
- Companies building AI governance on ISO/IEC 42001 or NIST AI RMF
- Risk, compliance and legal teams who need technical input on AI controls
What we do.
AI system inventory
Find and record the AI systems you develop, deploy or buy, including those embedded in third-party tools.
Risk classification support
Work through how each system is likely to be classified and what role you hold for it, with your legal counsel making the final call.
Gap assessment
Governance, risk management, data, transparency, human oversight and security controls against what the regulation expects.
AI security testing
Robustness and cybersecurity tested in practice: prompt injection, data exposure and agent misuse.
Roadmap and evidence
A prioritised plan, and the documentation and records needed to demonstrate control.
What actually arrives.
An engagement that ends at a slide deck leaves you with an opinion. These are the artefacts this one produces.
AI system register
Every in-scope system with its owner, purpose and likely risk category.
Gap assessment report
Where each system stands against the regulation's expectations, and what closes the gap.
Framework mapping
Requirements mapped across the EU AI Act, NIST AI RMF and ISO/IEC 42001, so one control set serves all three.
Readiness roadmap
Prioritised actions with owners, sequenced by risk and obligation.
Frequently asked questions.
- Do you provide legal advice on the EU AI Act?
- No. We provide the security, governance and technical assessment, and work alongside your legal counsel, who should confirm how the regulation applies to you.
- Does the EU AI Act apply to organisations outside the EU?
- It can, where AI systems or their outputs are placed on the market or used in the EU. Whether it applies to you depends on your systems and role, which is what the inventory and classification work establishes with your counsel.
- How does this relate to ISO/IEC 42001?
- ISO/IEC 42001 gives you an AI management system that covers much of the governance the regulation expects. We map both, so the same controls serve each.
- Where should we start?
- With an inventory of the AI systems you develop, deploy or buy. Every later obligation depends on knowing what you actually run.
Next step
Talk to us about EU AI Act Readiness.
Start with a scoping conversation.
Describe the system and the decision you need to make. You will get a practitioner's view of where the risk actually sits, and what the engagement should cover, before anything is scoped.