AI governance · EU AI Act readiness
AI governance consulting, ready before the EU AI Act deadlines.
Ship AI with confidence and prove it is under control. We find the AI you build and buy, classify it under the EU AI Act, and put the policy, guardrails and board reporting in place.
What is AI governance?
AI governance is the set of policies, roles and controls that keep AI systems safe, lawful and aligned with business goals. In practice it means knowing which AI you use, how risky each system is under the EU AI Act, who is accountable for it, and how you monitor it from design to retirement.
EU AI Act deadlines
EU AI Act: banned AI practices and AI literacy
In forceEU AI Act: general-purpose AI rules
In forceEU AI Act high-risk obligations apply (Annex III)
NextEU AI Act: AI inside regulated products (Annex I)
Later
What we do
AI inventory and risk assessment
Find every AI system you build, buy or embed, including shadow AI, and assess each one against the EU AI Act risk categories.
AI policy and risk taxonomy
An AI policy and risk taxonomy that engineers can follow day to day and auditors can test.
Model lifecycle and guardrails
Controls from design to retirement: testing, approval, human oversight, monitoring and incident handling, built into your release pipeline.
Board training and reporting
AI literacy for leadership, and reporting that shows the board AI risk and progress at a glance.
How it works
- 01
Inventory
List every AI system, its owner, its purpose and the data it uses.
- 02
Classify
Assign an EU AI Act risk class and your role: provider, deployer, importer or distributor.
- 03
Close the gaps
Policy, documentation, human oversight and controls for the systems that need them.
- 04
Monitor
Ongoing checks, incident handling and reporting to the board.
What you get
- A complete, current AI inventory with named owners
- A clear EU AI Act risk class for every system
- Faster releases with fewer late surprises
- Board reporting you can stand behind
The standards we work to
- EU AI Act
- GDPR
Start with a fixed-scope sprint
Know where you stand under the EU AI Act, and what to fix first.
EU AI Act Readiness Sprint
AI system inventory · Risk class per system · Gap report and 90-day roadmap
Get a proposal →Why teams choose Consudo for AI Governance
Senior people, start to finish
The specialists who scope the work do the work. No junior hand-offs, no slideware.
One plan across four disciplines
Data, AI, privacy and security share the same foundations, so we design them once instead of four times.
Built for your teams to own
Policies, controls and evidence your people run without us, with knowledge transfer built into every engagement.
AI Governance: frequently asked questions
When do the EU AI Act high-risk rules apply?
Obligations for stand-alone high-risk AI systems listed in Annex III, such as AI used in hiring, credit scoring or education, apply from 2 December 2027 after the 2026 Digital Omnibus amendment. High-risk AI built into regulated products under Annex I follows on 2 August 2028.
Which parts of the EU AI Act already apply?
The ban on prohibited AI practices and the duty to ensure AI literacy have applied since 2 February 2025. Rules for general-purpose AI models have applied since 2 August 2025. If your staff use AI tools today, the AI literacy duty already covers you.
What is ISO/IEC 42001?
ISO/IEC 42001 is the international standard for an AI management system. It sets out how an organisation governs AI through policy, roles, risk assessment and continual improvement. It is voluntary and certifiable, and it gives a solid structure for meeting many EU AI Act duties.
How long does EU AI Act readiness take?
The readiness sprint has a fixed scope and end date, agreed in the proposal, and ends with an inventory, a risk class per system and a roadmap. Closing the gaps depends on how many high-risk systems you have, but most teams can be ready well before 2 December 2027.
Designed to work together
Questions first? Email info@consudo.com and get a right-sized, senior-led proposal within 48 hours.