AI governance and compliance
Know what runs, and be able to show that it holds
Once AI is part of your processes, the questions follow: which systems do we use, who is responsible, what may an agent decide by itself, and what does the EU AI Act ask of us? We help you record and set that up, in the systems themselves and not only on paper.
What we set up
AI inventory
A register of the AI systems and tools used in your organisation, including the tools staff have started using on their own. What they do, with which data, and with which vendor.
Role and risk assessment
Are you a provider or a deployer, and which risk class does an application fall into? Prohibited and high-risk applications belong on the table early, not afterwards.
Policy and agreements
A usage policy for AI: which data may and may not go into which tools, who checks output, and when a person decides.
Technical measures
Logging, access rights, human oversight in the workflow, transparency towards people who interact with an AI system, and locally hosted models where personal data is involved.
AI training
AI literacy for your staff
The EU AI Act asks that staff who work with AI have sufficient knowledge of it. That obligation sits with you as the employer. We help you meet it with tailored training: what AI can and cannot do, what may and may not go into a tool, and how to check output. Aligned with the systems your staff actually use, not with AI in general.
What it is and is not
Honest about our role
- Not legal advice. We support the technical and process side. The legal review belongs with your lawyer or data protection officer, and we are glad to work with them.
- The responsibility stays with you. As the deployer, you decide how AI is used. We make sure you have the means and the records to carry that responsibility.
- Where we stand ourselves. ISO/IEC 42001, the standard for AI management systems, is planned for us and not achieved. Our security and compliance page states exactly where we stand per regime.
FAQ
Probably, even if you only use AI and do not develop it. Staff who work with AI must have sufficient knowledge of it, for example. How heavy the other obligations are depends on the application. We help map that; your lawyer draws the legal conclusion.
Yes. It is then an advisory engagement: we assess what runs on the basis of the information and access we are given, and report within the agreed scope.
You do. AI output can be wrong, so where an outcome affects people, or is published or given to third parties, a person checks it first. We build that oversight into the workflow.
Tell us which work takes too much time
That is usually the most useful first conversation. Whether the answer is a new system, an AI agent, an integration between what you already have, or nothing at all, you get an honest assessment.