Service Overview
The EU AI Act high risk obligations apply from 2 December 2027. ISO/IEC 42001 and NIST AI RMF set the bar auditors use today, and sector regulators expect an AI inventory, risk classification, data quality, testing, monitoring, documentation and independent review. Most organisations have an AI inventory nobody trusts, or none, and generative AI in daily use without oversight. This service builds the governance your auditor asks for and your engineers can live with: named accountability per AI application, controls that run inside the delivery pipeline, audit trails with confidence intervals, and a tested manual fallback for every AI dependent process.
What's Included
- AI inventory and risk tiering across the enterprise, named owner per application
- Policy set and control library mapped to the EU AI Act, ISO/IEC 42001, NIST AI RMF and your sector regulator's guidance
- Governance operating model: roles, first and second line, committees
- Audit trail, explainability and manual fallback design, monitoring KPIs for internal audit
- Shadow AI policy, third party and GenAI vendor due diligence pack with contract clauses
What you get
- One inventory
- One classification logic
- Audit ready evidence
- A governance model that scales to agents
Format
Working sessions with risk, IT and internal audit: inventory and classification, control library, evidence design. Buyer is typically the CRO, CIO or Head of Internal Audit.
Who it is for
CRO, CIO, CTO, Chief Data Officer, Head of Compliance, Internal Audit