Governance obligations do not ask whether your model is good. They ask what it is for, what data it uses, who can override it, what it logged, and who is accountable. Most teams cannot answer those questions about systems already in production.
Aug 2026
Transparency obligations operational
Dec 2027
High-risk AI obligations (revised)
11–14%
Of enterprise AI pilots reach production scale
AI adoption did not go through architecture review. It arrived through individual teams, vendor features and API keys on a corporate card. The result is a set of systems making real decisions, with no inventory, no owner, no documentation and no log of what they did. Governance starts with finding them.
Team-level and vendor-embedded AI never reaches a central register, so it is never assessed.
A policy exists. Nothing technically prevents it, and nobody is monitoring whether it happens.
Someone can override the system in theory. In practice the override is never used and no one is accountable for the outcome.
Inputs and outputs are not retained, so when a decision is challenged there is nothing to examine.
A complete register of AI systems and use cases, including the ones nobody declared, each with a named accountable owner.
Each system assessed against a defined framework, with a pre-deployment gate so new use cases are classified before they go live.
Technical enforcement of what data may enter a model, plus the ability to honour an erasure request across a pipeline.
Technical documentation that survives an audit, and human oversight with real authority rather than a nominal sign-off.
Event logging retained and queryable, post-deployment monitoring for drift and biased outcomes, and a defined incident path.
Frameworks keep changing and models keep drifting. Documentation and evidence have to be maintained, not written once.
| Tier | Typical Examples | What It Requires |
|---|---|---|
| Prohibited | Social scoring, manipulative or exploitative systems | Cannot be deployed |
| High risk | Hiring, credit, education access, essential services, biometrics | Risk management, technical documentation, logging, human oversight, post-market monitoring |
| Limited risk | Chatbots, generated content | Disclosure that the user is interacting with AI or AI output |
| Minimal risk | Internal productivity tooling, spam filtering | No specific obligations, but inventory and data controls still apply |
Most organisations discover at least one system in a higher tier than they assumed. Classification is confirmed with your counsel; we assess and evidence it.
Start small if you need to prove the value internally first. Most clients begin with a sprint and move up.
Two weeks
One business unit
Find every AI system actually running, classify it, and produce a prioritised risk list. Credited in full against a full assessment booked within 30 days.
Four weeks
Organisation-wide
Full inventory, risk tiering, data lineage review, documentation and oversight gap analysis, and a remediation plan sequenced against your deadlines.
Eight to sixteen weeks
Then ongoing operations
Implementation of controls, documentation and logging, then continuous governance operations so evidence stays current as models and rules change.
Every system, owner, model dependency and risk tier.
The assessment and its reasoning, ready to defend.
Purpose, data, limitations and testing per high-risk system.
Who can override what, and how that is evidenced.
What is captured, retained and queryable.
Two pages your directors will actually read.
Companies selling into the EU or the UK, regulated sectors where a model influences decisions about people, enterprises whose customers have started sending AI governance questionnaires, and any organisation running AI over personal data of Indian users.
How we inventoried the models in use, classified them, and built the logging and oversight needed to evidence every decision.
Read the case studyFifteen questions across inventory, risk classification, data controls, oversight and monitoring. You get a score, a sector benchmark and a two-page report. No call required.
Free · 5 minutes · results on screen