All services / AI governance & EU AI Act
AI governance and the EU AI Act
The EU AI Act applies in phases from 2025 and attaches obligations to roles: providers, deployers, importers and distributors. Most companies are several of these at once. I help you work out where you stand, what is actually required, and how to meet it without slowing product work.
EU AI ActGDPRGPAI Code of PracticeISO/IEC 42001Product Liability Directive
What I help with
- AI inventory and role mapping: which systems you provide, deploy or embed
- Risk classification per use case, with documented reasoning
- AI governance framework: policy, intake process, approval gates, registers
- High-risk system obligations: risk management, data governance, technical documentation, logging, human oversight
- Transparency duties for chatbots, generative content and emotion recognition
- General-purpose AI model obligations and the Code of Practice
- Vendor and model due diligence, and AI clauses in contracts
- Alignment with ISO/IEC 42001 and the NIST AI RMF where clients want certification
Typical engagements
- AI Act readiness assessment with a prioritised roadmap (fixed fee)
- Interim AI governance lead for a product or legal team
- AI use policy and intake process, rolled out with training
- Fractional 'AI counsel' for product teams, a few days a month
Who this is for
Scale-ups and corporates embedding AI in products, HR tech, fintech, marketplaces, health and public-sector suppliers, and vendors selling AI into the EU.
Frequently asked
Does the AI Act apply to us if we only use a vendor's model?
Usually yes, as a deployer. If you fine-tune the model, change its intended purpose or offer it under your own name, you may also be a provider. The role analysis is the first step.
When do the obligations apply?
In phases: prohibited practices and AI literacy from February 2025, general-purpose model duties from August 2025, and most high-risk obligations from August 2026, with product-embedded systems following later. Timelines have been the subject of legislative proposals; I track the current state.
Do we need a DPIA as well?
Often, yes. The AI Act does not replace the GDPR. See my note on what a DPIA for an AI feature should contain.
Have a regulatory question?
Send a short description of the matter. I reply within one working day, usually with a view on scope and a fixed fee where possible.