Home/Services/AI governance and the AI Act

Add-on to the strategy

AI governance and the AI Act

Control of AI and agents without slowing down. We build on what already exists, such as information security and GDPR.

Duration

4-6 weeks

Pricing model

Add-on or standalone

You end up with

An overview of all AI use, clear rules and controls for agents that can be verified.

For you if you

Cannot say how many AI solutions are in use. Have employees using free AI tools with company data. Need to put the first agent into operation. Or have a board asking about the AI Act without a clear answer.

Price and payment

As part of the strategy (+3-4 weeks in the Design phase), standalone (4-6 weeks together with a lawyer) or as a 2-week register and risk check.

What it includes

01AI register with an owner and risk class for every solution

02Risk classification under the AI Act and internal risk

03Governance model with four forums and a RACI

04One-page AI policy: permitted, requires approval and prohibited

05Seven controls for agents and an approval flow from idea to operation

06Operating plan with owners and quarterly measurement

Why AI governance now

Legal requirements

The AI Act applies in stages from 2025 to 2028. Prohibitions and the AI literacy requirement already apply.

Agents act on their own

Agents access systems and carry out actions. That requires permissions, logging and a stop button.

Overview

Employees use AI tools nobody has approved. Shadow AI is a risk to data and reputation.

Speed with safety

Clear rules make it faster to say yes. 42% want to give agents real decision authority by 2030, but only 5% have the controls.

The AI Act on one page

The class determines the requirements, and AI literacy applies to everyone. Simplified overview, not legal advice.

ProhibitedSocial scoring, manipulation and emotion recognition in the workplace. Must not be used. Applies from 2 Feb 2025.

High riskRecruitment, credit scoring and education (Annex III) and AI in regulated products (Annex I). Risk management, logging, oversight and documentation. From 2 Dec 2027 and 2 Aug 2028.

Limited riskChatbots and AI-generated content. Users must know it is AI. From 2 Aug 2026.

Minimal riskForecasts, quality inspection and most internal assistants. No special requirements; the AI policy applies.

Six steps from overview to governance in operation

Duration as a standalone engagement. As part of the strategy, the steps run in parallel with the Design phase.

Week 1-21. Map AI useInterviews, a survey and licence data find the solutions, including shadow AIAI register

Week 2-32. Classify riskEach solution gets an AI Act class and an internal riskRisk class per solution

Week 33. Governance modelForums, roles and decision rights described in a RACIModel and RACI

Week 3-44. AI policyPermitted, requires approval and prohibited. On one pageOne-page AI policy

Week 4-55. Controls for agentsSeven controls and an approval flow from idea to operationControl set and flow

Week 5-66. Governance in operationOwners are appointed, the register is kept up to date, and measurement happens every quarterOperating plan and owners

How we can work together

Part of the strategy

In the Design phase

+3-4 weeks on top of the strategy

AI register and risk classes, governance model and AI policy, controls for the first agents.

Outcome: Governance is ready when the roadmap starts

Standalone

The full add-on

4-6 weeks, together with a lawyer

All six steps, controls for up to three agents and a plan for governance in operation.

Outcome: Control of AI and the AI Act across the company

Door opener

Register and risk check

2 weeks

Mapping of AI use, first risk classification, top 5 risks and next steps.

Outcome: An overview for the executive team and board

GovernanceSeven controls before an agent may act on its own ExampleSee an example of a data and AI strategy →

Next add-on →Use case sprint

Facing a decision on digital, data and AI?

A new CIO, a new group strategy, an ERP change, many pilots and few in production, or a board asking about AI. Call when the decision is approaching.

Book an introductory meeting