AI assurance
EU AI Act and ISO 42001 readiness. Gap analysis, documentation, and controls.
The problem
The EU AI Act applies in stages. Prohibitions and general-purpose model duties are already in force; transparency duties for AI that interacts with people apply from 2 August 2026; Annex III high-risk obligations apply from 2 December 2027 and Annex I from 2 August 2028 under the 2026 omnibus. Organisations building or deploying AI need to know which obligations apply, what evidence regulators will expect, and how to close gaps before their date. Waiting for enforcement guidance is too late.
What we deliver
We conduct a gap analysis against EU AI Act requirements and ISO 42001 controls. The output is a prioritized list of gaps, a roadmap to close them, and draft documentation that your compliance team can finalize.
We focus on evidence: what proof of control will an auditor accept? We do not write policies that sit on a shelf. We document what the system actually does, how risks are mitigated, and where human oversight occurs.
What we assess
- Risk classification: is your system high-risk under Annex III?
- Data governance: can you prove training data provenance and quality?
- Human oversight: where and how do humans intervene?
- Transparency: can you explain how the system makes decisions?
- Robustness: how do you detect and handle model drift, adversarial input, or unexpected behaviour?
What this solves
You get a clear view of compliance status and a plan to close gaps. The documentation we produce is audit-ready. If your system is not yet compliant, you know exactly what needs to change and in what order.
Engagement model
Assessment typically takes 2–4 weeks depending on system complexity. Deliverables: gap analysis, control documentation, roadmap, and recommendations for remediation. We can also conduct ongoing compliance reviews as your system evolves.
Related services: Self-hosted AI · Technical due diligence