AI governance and EU AI Act readiness
Most organisations already run AI systems they have not inventoried. This engagement establishes what exists, classifies it by risk, and puts a review gate in front of new use cases that engineers can pass in days rather than quarters.
Updated
Workstreams
- AI system inventory: internal builds, embedded vendor AI, shadow usage discovered through egress and SaaS data. Each record names the business owner, technical owner, intended use, model or provider, data classes, integrations and user groups.
- Risk classification aligned to the EU AI Act risk categories and internal impact criteria, with the decision recorded for the system and the use case rather than assumed from a vendor label.
- Acceptable-use policy for employees that is short enough to be read and specific enough to be enforced, including approved tools, prohibited data, account rules and escalation paths.
- Review gate: a lightweight intake questionnaire that routes low-risk use cases straight through and escalates the rest to the people who can assess security, privacy, procurement and operational risk.
- Evidence: system documentation, approval records, logging, supplier records and human-oversight arrangements that can be located and explained during an audit or incident review.
The operating model is simple: keep a living register with named owners, assess intended use, affected people, data, autonomy and downstream action, then route only higher-risk cases to a deeper review. Put the gate where work starts — procurement, architecture, product delivery or access to a sanctioned tool — and keep the decision with the system record.
Why sanctioned paths beat bans
Banning AI tools moves usage to personal accounts where nothing is logged. Providing a sanctioned, monitored path with clear rules is what actually reduces exposure — the same pattern that took shadow IT to near zero in my previous in-house role.
Frequently asked questions
Is this a policy document project?
Policy is one artifact. The substance is the inventory, the classification criteria and the review gate that keeps the inventory accurate.
We are not a high-risk AI provider. Do we need this?
You still need to know which systems you run, what data they touch and who signed off. That is most of the work regardless of tier.
Related
AI security assessment
Security assessment of GenAI and LLM systems: prompt injection, tool and agent abuse, data leakage, model supply chain and monitoring gaps.
Compliance
Turning DORA, NIS2, ISO 27001, GDPR and the EU AI Act into one control set with reusable evidence and aligned reporting clocks.
EU AI Act readiness
A practical sequence for AI Act readiness: inventory, classification, obligations mapping, documentation and human oversight evidence — plus the current state of the Digital Omnibus timeline changes.
AI governance checklist
A printable checklist for establishing AI governance: inventory, classification, policy, review gate and evidence, mapped to the EU AI Act and NIST AI RMF.
Compliance readiness
Gap assessment and remediation planning for DORA, NIS2, ISO 27001, GDPR and the EU AI Act — mapped to controls and evidence, not paperwork.
AI security
How to secure GenAI, LLM and agentic AI systems: current OWASP threat classes, layered controls, agent authority, retrieval isolation and monitoring.