AI Act readiness
From AI Act classification to a board that can defend the programme, in one focused engagement.
The EU AI Act is the first regulation that governs AI systems directly, with obligations that scale to risk classification. Norwegian entities are in scope through the EEA. Here is what a provider or deployer of an AI system has to deliver, and how I run a programme that lets the board stand behind it.
What we deliver
-
ScopingClassifies each AI system against the AI Act risk categories — prohibited, high-risk, limited, or minimal — and clarifies the role as provider, deployer, distributor, or importer.
- Gap analysis against the core requirements
We assess your current AI systems and governance controls against the core AI Act requirements and produce a prioritised list of what needs to close before each application date.
-
Risk management and data governanceWe build the risk management system, the Annex IV technical documentation, the data quality controls, and the post-market monitoring that Articles 17 and 72 expect.
- Human oversight and transparency
We design the oversight mechanisms, user instructions, and transparency obligations that Articles 13 and 14 require for high-risk systems.
- Supply chain and GPAI
Maps obligations against GPAI models you depend on, and the duties that come with integrating those components further downstream.
- Board accountability
We design the board's reporting cadence for AI governance, run the required training, and document oversight so the management body can stand behind the programme.
How we deliver this service
- In a project
Classification, gap analysis, and roadmap with clear owners and dates.
- In a role at the customer
Programme owner inside the organisation through transposition and up to each application date.
- As part of a service
Included in the Secured by FM bundle as an ongoing AI-compliance programme.
Recent insights on AI Act readiness
- From compliance burden to competitive advantage
How leadership teams move from compliance uncertainty to documented control, evidence that holds up under investor, customer, or regulatory due diligence.
- How Nordic SMBs prepare for NIS2
Practical compliance steps for the new EU directive, what to do this quarter, and what can wait.