The EU AI Act, NIS2 and GDPR all come with dates and fines. Consudo gets your data governance, AI governance, privacy and security in shape on a fixed plan, led by senior specialists.
Trusted by teams at
What already applies, and what comes next, for companies that operate in the EU. In Sweden, NIS2 has applied through the Cybersecurity Act since 15 January 2026.
GDPR applies across the EU
In forceEU AI Act: banned AI practices and AI literacy
In forceEU AI Act: general-purpose AI rules
In forceNIS2 in Sweden: the Cybersecurity Act in force
In forceEU AI Act high-risk obligations apply (Annex III)
NextEU AI Act: AI inside regulated products (Annex I)
LaterFour questions, one minute. You get a score and the first step we would take. No email needed.
? / 4
Answer all four to see your score. 0 of 4 answered.
0 / 4
Starting from scratch. That is common, and fixable fast.
Where we would start
EU AI Act Readiness Sprint
Know where you stand under the EU AI Act, and what to fix first. AI Governance services
Data Governance Blueprint
An operating model you can switch on, starting with your most important data. Data Governance services
Privacy-by-Design Review
Find and fix the privacy gaps in your most important systems. Data Privacy services
Security Posture Assessment
A clear picture of your security risk and a plan to reduce it. Information Security services
Ongoing assurance and 24/7 response
Keep it working and prove it to auditors, with reporting the board can rely on.
Your answers point to one of our fixed-scope sprints.
Book a 30-min introAI governance
Do you have a list of every AI system you use or build, with a named owner?
Data governance
Does each critical data set have an owner and agreed quality rules?
Data privacy
Can you show where personal data lives and how long you keep it?
Information security
Have you mapped what NIS2 requires of your organisation?
01
AI governance is the set of policies, roles and controls that keep AI systems safe, lawful and aligned with business goals. In practice it means knowing which AI you use, how risky each system is under the EU AI Act, who is accountable for it, and how you monitor it from design to retirement.
02
Data governance is the set of roles, rules and processes that make data accurate, owned and usable. It decides who is accountable for each data set, what good quality means, how data is classified and where it may flow, so every report and every AI model runs on data you can defend.
03
GDPR consulting turns the regulation into processes your teams can follow: a record of what personal data you hold and why, DPIAs for risky processing, privacy by design in new products and AI, retention and consent that work, and clear answers when regulators or customers ask questions.
04
NIS2 requires essential and important entities to manage cybersecurity risk, report significant incidents quickly and make management accountable. In Sweden it applies through the Cybersecurity Act, in force since 15 January 2026. Compliance means a risk-based security programme, incident reporting, supplier security and board oversight.
Start with a fixed-scope assessment, build the controls with your teams, then keep them working.
01
Know where you stand in weeks, not months.
02
Put the controls in place, inside the tools your teams already use.
03
Keep it working, and prove it to the board and regulators.
Every sprint has a start date, an end date and deliverables you keep. Get a proposal within 48 hours.
AI system inventory · Risk class per system · Gap report and 90-day roadmap
Get a proposal →Operating model and roles · Critical data domains · Quality and lineage plan
Get a proposal →Data map of key systems · DPIAs where required · Consent and retention fixes
Get a proposal →Threat model · NIS2 and zero-trust review · Prioritised remediation plan
Get a proposal →10+
years securing critical systems
0
material incidents across managed clients
48h
from first call to a written proposal
24/7
response and advisory availability
The specialists who scope the work do the work. No junior hand-offs, no slideware.
Data, AI, privacy and security share the same foundations, so we design them once instead of four times.
Policies, controls and evidence your people run without us, with knowledge transfer built into every engagement.
Bans on prohibited AI practices and the AI literacy duty have applied since 2 February 2025, and rules for general-purpose AI since 2 August 2025. High-risk obligations for Annex III systems apply from 2 December 2027, and AI inside regulated products follows on 2 August 2028.
AI governance is the set of policies, roles and controls that keep AI systems safe, lawful and aligned with business goals. With the EU AI Act in force, you need to know which AI you use, how risky it is and who is accountable.
Data governance makes data accurate, owned and usable. Data privacy makes sure personal data is handled lawfully. They share the same foundations, which is why we design them together.
In Sweden, NIS2 applies through the Cybersecurity Act, in force since 15 January 2026. It mainly covers medium and large organisations in listed sectors, and some smaller ones. We can confirm your scope in a 30-minute intro.
Tell us your objectives and you get a right-sized, senior-led proposal within 48 hours.
