EU AI Act
Risk-tier classification, prohibited-practice review, high-risk system obligations, transparency and human-oversight requirements, and the documentation regulators will actually ask for.
Services / Compliance
AI compliance that holds up under audit.
Practitioner-led AI compliance consulting for organisations preparing for the EU AI Act, ISO/IEC 42001, NIST AI RMF, and DORA. Built so your engineers, your risk function, and your auditors can read the same evidence and reach the same conclusion.
Frameworks
The standards we implement, mapped to your stack.
We don't pick a framework and force you into it. We pick the controls that satisfy multiple frameworks at once, so you implement them once and report against them many times.
ISO/IEC 42001
AI management system design, control selection, internal audit prep, and the running cadence that keeps certification alive after the auditor leaves.
NIST AI RMF
Govern, Map, Measure, Manage — operationalised inside your existing risk function rather than bolted on as a parallel process.
DORA + OWASP for LLMs
ICT resilience for AI workloads and threat coverage for prompt injection, model abuse, training-data poisoning, and the agentic failure modes your existing AppSec stack misses.
Outcomes
What changes after we work together.
Not a policy library nobody reads. A working compliance posture you can demonstrate in a board meeting, a vendor review, or an audit — same answer, same evidence.
- A defensible answer to 'are we EU AI Act ready?' — with evidence
- ISO 42001 controls mapped to your existing security and risk processes
- Audit packs your internal auditor or notified body will accept
- Policies your engineering teams will actually follow
- A running compliance cadence — not a one-off paper exercise
Why a practitioner
Law firms read the regulation. Big-Four consultancies templatise it. A practitioner ships it.
Engagements run by one accountable expert who has implemented AI controls inside regulated environments. Less abstraction, fewer hand-offs, and evidence that maps directly to the systems you actually run in production.
Start where the risk is loudest.
Most engagements begin with a governance assessment, so we're remediating real gaps — not the ones a generic checklist surfaced.