AI governance and EU AI Act readiness
The EU AI Act’s obligations are phasing in through 2028 — the 2026 Digital Omnibus (Regulation (EU) 2026/1744) moved several high-risk deadlines later — and fines for the most serious infringements can reach €35 million or 7% of worldwide annual turnover. Drawing on hands-on experience assessing the risks and controls of large language models from development to business use, we help you understand what applies to you and build governance that works in practice.
Who it’s for
- Companies building, buying or deploying AI systems in the EU
- Teams that need an inventory of their AI use and a view of which systems are in scope
- Firms whose clients or regulators are asking how their AI is governed
- Organisations that need senior AI governance capacity without a full-time hire
Documents you’ll usually need
- List of AI tools and systems in use or in development
- Descriptions of intended purpose and users
- Vendor contracts and documentation for third-party AI
- Existing risk, data-protection and information-security policies
- Any prior risk or impact assessments
What we handle
EU AI Act readiness assessment
Inventorying your AI systems, classifying them by risk category and role, and mapping the obligations and dates that apply.
Governance programme design
Policies, roles, approval gates, committees and reporting for AI across the organisation.
Model risk and control assessment
Assessing risks and controls across the AI lifecycle — design, development, testing, deployment and monitoring.
Use-case reviews
Structured review of proposed AI use cases before launch, with documented decisions and conditions.
Third-party AI due diligence
Questions and evidence to request from AI vendors, and how to assess their answers.
AI literacy and training
Practical sessions so that staff who use or oversee AI understand the risks and their responsibilities.
Fractional AI governance support
Ongoing part-time support to run your AI governance programme, committee and reporting.
Last reviewed: Legal basis: Regulation (EU) 2024/1689 (AI Act) · Regulation (EU) 2026/1744 (Digital Omnibus on AI)
Frequently asked questions
When does the EU AI Act apply?
The AI Act entered into force in 2024 and applies in stages. Prohibited practices and AI-literacy duties have applied since February 2025, general-purpose AI obligations since August 2025, and most remaining obligations, including many for high-risk systems, were postponed by the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) to dates in 2027 and 2028. Because dates have moved before, check the current position.
What are the fines under the EU AI Act?
Fines for the most serious infringements, such as using prohibited AI practices, can reach €35 million or 7% of worldwide annual turnover, whichever is higher. Lower ceilings apply to other infringements, and there are adjustments for SMEs and start-ups.
Does the EU AI Act apply to companies outside the EU?
It can. The Act applies to providers placing AI systems on the EU market and to deployers in the EU, and in some cases to providers and deployers outside the EU when the system’s output is used in the EU. Your role and where the AI is used both matter.
What is an AI governance framework?
It is the set of policies, roles, processes and controls an organisation uses to decide which AI to build or buy, how to manage its risks and how to monitor it once in use. A good framework is proportionate to the risk and produces evidence that it is working.
What does a fractional AI governance lead do?
A fractional lead provides senior AI governance expertise part-time: running the inventory and risk assessments, chairing or supporting the governance committee, and reporting to leadership. It suits organisations that need the capability before they need a full-time role.
Tell us what you need
One short form. We'll route it to the right service and reply within two working days.