Governance & Regulation
AI Governance, ISO/IEC 42001 & EU AI Act Readiness
We help you build AI governance that works in practice — an inventory you trust, risk classification you can defend, controls that actually constrain agents — and align it to ISO/IEC 42001 and the EU AI Act without creating a parallel bureaucracy.
The challenge
Governance that lives in a policy document does not govern an agent.
AI governance often starts as a policy, a steering committee and a spreadsheet of use cases. That is a reasonable first step — but it does not tell you which agents can move money, who approved their access, or what happens when one does something it should not.
ISO/IEC 42001 gives you a recognised management system for AI. The EU AI Act sets legal obligations that depend on your role and on how your systems are classified. Neither, on its own, makes an agent safe to run.
We connect the two worlds. The management system provides accountability and evidence; the five tollgates provide the operational controls. Together they give your board — and your auditors — something they can actually test.
What you get
Outcomes, not reports.
- 01
An AI inventory you can rely on
Every AI system and agent recorded with owner, purpose, data, risk classification and EU AI Act role (provider, deployer or both).
- 02
A management system that fits
An AI management system aligned to ISO/IEC 42001, integrated with your existing ISMS, risk and privacy frameworks.
- 03
Controls that bite
Policy translated into the five tollgates — so governance constrains what agents can actually do, not just what people are told.
- 04
Readiness you can evidence
A clear view of gaps against ISO/IEC 42001 and applicable EU AI Act obligations, with a plan to close them.
How we work
Senior-led from scoping to sign-off.
-
Baseline
Inventory, classification and a gap assessment against ISO/IEC 42001 and the EU AI Act obligations that apply to your role and systems.
-
Design
Accountability model, AI policy set, risk and impact assessment method, and the technical controls that enforce them.
-
Implement
Hands-on support to embed the management system, integrated with your ISMS, privacy and model-risk processes.
-
Assure
Internal audit and pre-certification review, so external audit holds no surprises.
Deliverables
- AI system and agent inventory with risk classification
- ISO/IEC 42001 and EU AI Act gap assessment
- AI governance operating model and policy set
- AI risk and impact assessment method
- Implementation roadmap and pre-certification review
Who it’s for
- Organisations deploying AI in, or selling AI into, the EU
- Firms whose customers are starting to ask for ISO/IEC 42001 certification in procurement
- CISOs, CROs and DPOs asked to “own” AI governance without a clear operating model
- Boards wanting assurance that AI adoption is controlled and accountable
Aligned to
- ISO/IEC 42001:2023
- ISO/IEC 23894 & 42005
- EU AI Act (Regulation (EU) 2024/1689)
- NIST AI RMF
- UK Code of Practice for the Cyber Security of AI
Questions
Frequently asked.
What has changed in the EU AI Act timeline?
Under the Digital Omnibus provisionally agreed in May 2026, obligations for stand-alone high-risk systems are expected from December 2027 and for AI embedded in regulated products from August 2028. Transparency obligations still apply from August 2026, and prohibitions and general-purpose AI rules already apply. We confirm the position for your systems at the start of every engagement.
Do we need ISO/IEC 42001 certification?
Not necessarily. Many organisations align to the standard without certifying. We help you decide based on customer, regulatory and commercial drivers.
Can this sit inside our existing ISO 27001 ISMS?
Yes, and it usually should. ISO/IEC 42001 shares the same management system structure, so much of the governance machinery can be reused.
Often paired with
AI Agent Access Review
An independent review of every agent, service account and token acting on your behalf — who owns it, what it can reach, and whether it should.
Explore AI Agent Access ReviewBoard AI Risk Briefing & Director Training
Separate AI as a threat, AI to govern and AI you use — so directors can challenge with confidence.
Explore Board AI Risk Briefing & Director TrainingRegulatory Resilience & Control Assurance
DORA, GovAssure/CAF, CBEST, TIBER-EU, FedRAMP and ISO 27001 — assurance against the frameworks your regulators actually test.
Explore Regulatory Resilience & Control AssuranceStart with a confidential conversation.
A confidential conversation about AI Governance, ISO/IEC 42001 & EU AI Act Readiness with the senior practitioner who would lead the work. No sales team, no obligation.