Is Your AI Ready for the EU AI Act?

01 What is AI governance consulting?

Help to keep track of the AI your business builds and uses: who owns each system, what could go wrong, which rules apply and how they are followed. Our readiness assessment turns that into a model inventory, a risk register, a draft AI policy and a plan to close the gaps.

02 Is this legal advice?

No. The assessment prepares you: it lists your AI, its likely risk tier and the gaps, and the questions to ask. Whether a rule applies to you, and what you must do about it, is for your counsel to decide. Legal sign-off stays with them.

03 Does the EU AI Act apply to my business?

That depends on what your AI does and where it is used, and your counsel makes the call. The Act sorts AI systems into four tiers: unacceptable, high, transparency and minimal risk. The assessment places each of your AI uses against them and lists the open questions.

04 What counts as high-risk AI?

The European Commission lists uses such as AI in recruitment, for example CV-sorting software, credit scoring, education and critical infrastructure. High-risk systems carry duties such as risk management, documentation and human oversight. The assessment flags any of your uses that may fall here.

05 Will you certify us for ISO 42001?

No. ISO/IEC 42001 sets out how a business should manage its AI (an AI management system), and a certificate comes only from an independent assessor. We can compare your current practice with the standard and list the gaps, so you know the gaps to close if you choose to seek certification.

06 What is in the assessment, and what is not?

In: a model inventory, a risk register, a draft AI policy, an EU AI Act readiness note and, if you want it, an ISO 42001 gap list, plus a handover. Not in: legal advice, a certification, or building the controls, which we can do as a separate step.

07 How long does the assessment take?

It depends on how many teams, products and AI vendors are in scope. We agree the scope and timeline at the discovery call, before we start, so you know when the documents will arrive.

08 What does a readiness assessment cost?

It depends on how much AI is in scope. Tell us which AI tools your teams use and which AI you build, and within two working days we come back with an approach, a rough timeline and a rough number. The assessment is priced up front.

09 What do you need from us?

An owner on your side, short interviews with the teams that use or build AI, and the vendor terms for the AI tools you pay for. We work only in the accounts you invite us into, with an NDA first on request.

10 Who owns the documents?

You do. The inventory, register, policy and readiness note are yours to keep, share with customers or investors, and update as your AI changes.

11 How is this different from AI guardrails and testing?

Governance is policy, the risk register and regulation: what you have, what could go wrong and which rules apply. Guardrails and testing are technical: checking how an AI system behaves and protecting it. The assessment may recommend tests; it does not run them.

12 What happens after the assessment?

You take the readiness note to your counsel and work through the plan. If the register calls for technical controls, such as an approval step, a log or answer tests, we can build them, priced up front.

13 Do you work with teams in the UK, EU and US?

Yes. We set calls and team interviews to fit your working day. We work only in the accounts you invite us into, with an NDA first on request, and you own every document, to keep, share and update.