Who needs AI governance consulting?
Public bodies, municipalities, master developers and enterprises that deploy AI in services touching citizens, infrastructure or regulated data — particularly anyone placing or using AI systems in the EU market.
AI governance consulting · EU AI Act · GDPR · NIS2
AI you can defend in front of a regulator.
Independent AI governance consulting for governments, municipalities and enterprises: risk classification, oversight, documentation and operating models that let ambitious AI reach production and stay there.
Six areas of AI governance
01
EU AI Act readiness
Classify every AI use case by risk tier, document intended purpose, and build the technical file, conformity and human-oversight evidence obligations demand — before a regulator or procurement panel asks.
02
GDPR-aligned data protection
Lawful basis, purpose limitation, data minimisation and DPIAs applied to models and training data, so analytics and automation stay defensible across jurisdictions.
03
NIS2 resilience
Security governance, incident reporting and supply-chain assurance for essential and important entities running AI in critical services.
04
Agentic workflow accountability
Guardrails, escalation paths, audit logging and human-in-the-loop design for autonomous agents that act on real systems and real citizens.
05
Model and vendor assurance
Evaluation criteria, contractual controls and monitoring for third-party models, so accountability does not evaporate at the vendor boundary.
06
Operating model & training
An AI governance board, clear roles, decision rights and practical workshops that move policy from a document into daily delivery.
What you receive
Documents that survive audit.
Each engagement is scoped to your obligations and delivery calendar, not to a fixed template.
- AI use-case inventory with risk classification
- Gap assessment against the EU AI Act, GDPR and NIS2
- AI governance policy and decision-rights framework
- Human-oversight and escalation design
- DPIA and conformity documentation templates
- Board-level reporting and KPI set
- Procurement clauses for AI suppliers
- Implementation roadmap with owners and sequencing
EU AI Act deadlines
The Act applies in phases. The dates below follow the published regulation; EU proposals may adjust the high-risk timetable, so each roadmap is checked against the current official dates.
- 1 Aug 2024
The EU AI Act enters into force.
- 2 Feb 2025
Prohibited AI practices are banned and AI literacy duties begin for providers and deployers.
- 2 Aug 2025
Obligations for general-purpose AI models and national governance arrangements apply.
- 2 Aug 2026
Most remaining rules apply, including high-risk systems listed in Annex III and transparency duties.
- 2 Aug 2027
High-risk rules extend to AI embedded in products covered by EU safety legislation (Annex I).
How an engagement works
01
Assess
Inventory AI use cases, classify their risk tiers and map gaps against the EU AI Act, GDPR and NIS2.
02
Prioritise
Agree a roadmap with owners and sequencing, starting with the obligations and systems that matter most.
03
Design
Put in place the policy, decision rights, human oversight, documentation templates and supplier clauses.
04
Embed
Train teams, set up board-level reporting and review the framework as systems and rules change.
New to the topic? Read the AI governance framework guide for the public sector.
Why this advisor
Governance written by someone who has run the systems.
Thirty years across Europe, the Middle East and Asia: AI-enabled city control systems, a city operating brain, autonomous mobility in live service, and the governance framework for European blockchain infrastructure spanning fourteen member states. Policy and delivery, from the same hand.
See past projectsCommon questions
How does this differ from generic AI strategy work?
Strategy decides what to build. Governance decides how it stays lawful, auditable and operable once it is live — the part that determines whether a pilot ever reaches production.
Where does an engagement usually start?
With a short assessment: an inventory of AI use cases, their risk tiers and the concrete gaps against the AI Act, GDPR and NIS2, followed by a prioritised roadmap.
When do EU AI Act obligations apply?
In phases since the Act entered into force on 1 August 2024. Prohibited practices and AI literacy duties apply from February 2025, general-purpose AI obligations from August 2025, and most high-risk obligations from August 2026 or later. The timetable for high-risk systems may be adjusted by the EU, so plans should be checked against the current official dates.
Start with an AI governance assessment.
A concise, no-obligation Project Approach Brief covering your AI use cases, obligations and the first moves.