Français
Nederlands
DeutschAI governance and the AI Act
ChatGPT, Copilot, recruitment or scoring tools: AI is already in your processes, often without a framework. We help you identify the uses that bring obligations under the AI Act and the GDPR, govern them and demonstrate it, with a consultant certified as ISO/IEC 42001 Lead Implementer and as a data protection officer.
Who it is for
- Organisations whose staff use generative AI tools, with or without written rules.
- Companies that build AI into a product or service sold to their customers.
- Employers, lenders, insurers, education providers and public services using AI in areas the AI Act classifies as high-risk.
- Organisations aiming for ISO/IEC 42001 certification.
What we put in place
Inventory of AI uses
AI tools, features and projects, including those adopted without approval, with the data they process and their suppliers.
AI Act classification
Your role (provider or deployer) and the risk level of each system: prohibited practice, high risk, transparency obligation or minimal risk.
AI acceptable use policy
Clear rules for staff: approved tools, data never to be entered, human review of outputs, incident reporting.
Impact assessments
Data protection impact assessment (DPIA) under the GDPR and, for certain deployers of high-risk systems (public bodies, public services, credit, life or health insurance), a fundamental rights impact assessment.
ISO/IEC 42001 management system
Implementation or consolidation, aligned with your ISO/IEC 27001 system if you have one, up to preparation for certification by an accredited body.
AI literacy and training
The staff training measures expected under Article 4 of the AI Act, and PECB certified training for your teams.
Our approach
A proportionate approach: most organisations mainly need an up-to-date inventory and clear rules; high-risk systems require more.
Inventory
Interviews and a questionnaire across departments, review of contracts and tools in use.
Classification and gaps
Role, risk level and applicable obligations for each use, then the gaps against the AI Act, the GDPR and ISO/IEC 42001.
Action plan
Acceptable use policy, controls, documentation and training, prioritised by deadline and approved by management.
Implementation and follow-up
Support for your teams, inventory updates and preparation for an audit or certification.
Frequently asked questions
Does the AI Act apply if we only use ChatGPT or Copilot?
Yes, to a limited extent. As a deployer, you must take measures to support the development of your staff's AI literacy and, in some cases, meet transparency obligations, for example if you publish generated images or videos that imitate real people. The GDPR applies as soon as personal data is processed.
Which obligations already apply?
The prohibited practices and the AI literacy obligation since 2 February 2025, the rules on general-purpose AI models since 2 August 2025 and the transparency obligations since 2 August 2026. The obligations for high-risk systems in Annex III will apply from 2 December 2027.
What did the Digital Omnibus change?
Regulation (EU) 2026/1744 postponed the obligations for high-risk systems and rewrote Article 4: you must take measures to support the development of AI literacy among your staff and others operating AI systems on your behalf, without having to guarantee a given level for each person. The obligation itself remains. The regulation also adds two prohibited practices, applicable from 2 December 2026.
Is ISO/IEC 42001 certification mandatory?
No. It is a voluntary standard, but it provides a recognised structure for governing AI: inventory, risk analysis, controls and continual improvement. It helps reassure your customers and prepare for the AI Act requirements.
How do the AI Act and the GDPR fit together?
Both apply together. An AI system that processes personal data must comply with the GDPR: legal basis, information to individuals and often an impact assessment. The AI Act adds AI-specific requirements without replacing the GDPR.