Point of view
AI Governance & Risk
Regulatory compliance
Readiness assessments and control mapping against emerging AI regulation and frameworks such as the EU AI Act, NIST AI RMF and ISO/IEC 42001.
Overview
AI regulation is moving from principle to obligation. The EU AI Act sets risk-based requirements for providers and deployers of AI systems, sector regulators are applying existing rules to AI, and ISO/IEC 42001 gives organizations a certifiable management system standard for AI. Rules such as DORA for ICT risk in EU financial services and HIPAA for health information in the US also apply where AI systems support regulated processes or handle regulated data.
We help organizations understand which requirements are likely to apply, assess readiness and close gaps. That includes classifying AI systems against regulatory categories, mapping obligations to controls, identifying documentation and evidence gaps and building a prioritized remediation plan.
Where possible, we map one set of controls to multiple frameworks, so evidence produced once serves several purposes. We also help you prepare for internal audit, external assessment or ISO/IEC 42001 certification audits. Our work supports, but does not replace, advice from your legal counsel.
What you receive
- 01Inventory and regulatory classification of AI systems
- 02Readiness assessment against applicable regulations and standards
- 03Obligation-to-control mapping across frameworks
- 04Prioritized remediation roadmap
- 05Evidence pack and audit preparation support
Technologies we work with
- EU AI Act
- NIST AI RMF
- ISO/IEC 42001
- GDPR
- DORA
- HIPAA
- ServiceNow
- OneTrust
We are technology-agnostic: tools are chosen to fit your requirements and existing investments.
Questions we often hear
Does the EU AI Act apply to organizations outside the EU?
It can. The Act may apply to organizations that place AI systems on the EU market or whose AI outputs are used in the EU, wherever they are based. We help you assess exposure, and your legal counsel can confirm the position for your circumstances.
Should we pursue ISO/IEC 42001 certification?
It depends on your customers, markets and regulatory exposure. Certification can provide independent assurance to clients and regulators, and even without certification the standard is a useful structure for an AI management system.
Insights
Related thinking
Let’s build what’s next, together.
Tell us about your goals. We’ll connect you with the right experts, usually within one business day.