Enterprise AI Transformation
AI Governance & EU AI Act Readiness
Govern every agent. Prove it to any regulator.
Most companies can’t answer three simple questions. What AI are we running? Which of it is high risk? And who signed off on what it’s allowed to do? We help you answer all three, put the controls in place, and keep the evidence ready, so governance speeds up your AI instead of blocking it.
The short answer
It’s the rules, roles and controls that decide which AI you use, what it’s allowed to do and how you prove it behaved. A list of every AI system you run. A risk rating for each. Human sign off where it matters. And a record of every decision an agent made.
The EU AI Act turns much of that into law. But even without a regulator, you need it. It’s how a board gets comfortable enough to let AI scale past the pilot.
Where the EU AI Act stands, October 2026
In July 2026 the EU amended the AI Act through the Digital Omnibus on AI. It pushed back the high risk obligations and left most other duties where they were. Here’s the current timeline.
Aug 2024
Act in force
The AI Act becomes EU law, with obligations phased in over the following years.
Feb 2025
Prohibited practices
Banned AI uses become illegal. AI literacy duties begin.
Aug 2025
Rules for providers of general purpose models apply.
Jul 2026
Digital Omnibus
Amendment enters into force and resets the high risk dates.
2 Dec 2027
High risk, Annex III
Stand alone high risk systems, like hiring, credit and critical infrastructure.
2 Aug 2028
High risk, Annex I
High risk AI built into regulated products, like machinery and medical devices.
A delay, not a pause.
Fourteen months is roughly the time it takes to inventory your AI, classify it, design the controls and produce the documentation a high risk system needs. Companies that start in 2027 will be doing it under pressure.
Risk classification
The same model can be minimal risk in one workflow and high risk in another. Screening CVs is high risk. Summarising meeting notes isn’t. That’s why classification starts with an inventory of use cases.
Unacceptable
Prohibited
Banned outright. Social scoring, manipulative techniques, most emotion recognition at work, and certain biometric uses.
Fines up to €35m or 7% of global turnover
High risk
Strict obligations
Risk management, data governance, technical documentation, logging, human oversight and conformity assessment.
Hiring, credit scoring, insurance pricing, critical infrastructure
Limited risk
Transparency
People must know when they’re dealing with AI, and AI generated content must be identifiable.
Chatbots, voice agents, generated images and text
Minimal risk
No new duties
Most internal AI falls here. Good practice still applies, and AI literacy for staff is expected.
Spam filters, document search, meeting summaries
Why agents change the problem
Most governance frameworks were written for models that answer questions. Agents act. They read your ERP, send emails, approve refunds and hand work to other agents. So governance has to cover what they do, not just what they say.
Permissions per agent
Each agent gets only the systems, data and actions its job needs. Nothing more.
Human approval for risky steps
Payments, contract changes or decisions about people stop for a person to approve.
Every handoff logged
When one agent passes work to another, the context, decision and reason are recorded.
Third party agents in scope
Vendor and partner agents that plug into your workflows follow the same rules as your own.
Continuous testing
Agents are checked for accuracy, drift, bias and unsafe actions after go live, not just at launch.
What we do
01
AI inventory and risk classification
We find every AI system and agent in use, including the ones bought by teams without IT, and classify each against the Act and your sector rules.
02
Governance framework and policies
Roles, decision rights, an AI policy people can actually follow, and a risk appetite your board signs off.
03
Controls and human oversight
Approval points, permission boundaries, escalation paths and kill switches, designed into the workflow rather than added on top.
04
Documentation and conformity prep
Technical documentation, data governance records, risk management files and logging set up for high risk systems.
05
AI literacy programmes
Role based training so staff understand the tools they use, the risks and when to escalate.
06
Validation and monitoring
Ongoing checks on accuracy, bias, drift and incidents, built on our Validation First Framework.
Governance built into the platform
Policies on paper don’t stop an agent at 3am. Cortex, our enterprise AI agent platform, enforces them in production. Every agent is registered, every permission is set in one place, and every action is logged so you can show a regulator exactly what happened.
Agent registry
Owner, purpose, risk tier and data access for every agent.
Policy enforcement
Permissions and approval steps applied at run time.
Full audit trail
Every prompt, tool call, decision and handoff, kept and searchable.
Monitoring and alerts
Drift, errors and unusual behaviour flagged as they happen.
How it runs
STEP 01
Map
Inventory every AI system and agent, who owns it and what data it touches. Classify each by risk.
STEP 02
Design
Write the framework, policies and controls, sized to your risk. Light for minimal risk, thorough for high risk.
STEP 03
Embed
Build the controls, logging and approvals into your workflows and platform. Train the people who use them.
STEP 04
Run
Monitor, test and report. Keep the evidence current as models, agents and rules change.
Deliverables
EU AI Act
ISO/IEC 42001
NIST AI RMF
GDPR
DORA
Sector regulators
A complete register of your AI systems and agents, with owners and risk tiers
An EU AI Act gap analysis, use case by use case
An AI governance framework and policy your board can approve
A control design for each high risk use case, including human oversight
Technical documentation templates and logging set up for high risk systems
An AI literacy plan by role
A monitoring and incident process, with a regular board report
AI governance and the EU AI Act, answered
What is AI governance?
AI governance is the set of rules, roles and controls that decide which AI you use, how it is allowed to act and how you prove it behaved. It covers an inventory of every AI system, risk classification, human oversight, testing, logging and accountability when something goes wrong.
When do the EU AI Act high risk rules apply?
After the Digital Omnibus on AI, which entered into force on 27 July 2026, obligations for stand alone high risk systems listed in Annex III apply from 2 December 2027. High risk AI built into products regulated under Annex I, such as machinery or medical devices, follows from 2 August 2028.
Was the whole EU AI Act delayed?
No. Only the high risk deadlines moved. Prohibited practices have applied since February 2025, rules for general purpose AI models since August 2025, and most transparency duties stay on their original track. Companies still need to know what AI they run and how it is classified today.
Does the EU AI Act apply to companies outside the EU?
Yes, in many cases. It applies to providers placing AI on the EU market and to deployers using AI in the EU, and it can reach companies elsewhere whose AI output is used in the EU. A business in the UAE or South Africa serving EU customers should check its exposure.
Which AI systems count as high risk?
High risk systems are those used in sensitive areas listed in the Act, such as hiring and worker management, credit scoring, access to essential services, education, critical infrastructure and law enforcement, plus AI that is a safety component of regulated products. Classification depends on the use, not the model.
What are the fines under the EU AI Act?
The highest fines, for using prohibited AI practices, reach 35 million euros or 7% of worldwide annual turnover, whichever is higher. Other breaches carry lower tiers. Fines for smaller companies are capped at the lower of the two amounts.
How is governing AI agents different from governing models?
Agents take actions, call tools and hand work to other agents, so you have to govern what they do, not just what they say. That means permissions per agent, limits on which systems they can touch, human approval for risky steps and a full log of every action and handoff.
Is this legal advice?
No. We design and build the governance, controls and evidence that compliance needs, and we work alongside your legal and compliance teams or external counsel, who give the legal opinion.
This page summarises the EU AI Act as amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744, as of October 2026. It is general information, not legal advice.
Know what AI you’re running before a regulator asks
We’ll walk through your current AI use, flag what’s likely high risk and show you what it would take to be audit ready by December 2027.
