AI Governance, Risk & Compliance

EU AI Act Readiness

The Act applies differently depending on what a system does and what role you play. We classify your systems, establish which obligations follow, and identify the gaps while there is still time to close them without stopping delivery.

Discuss Your AI Initiative Consulting

The business problem

Most of the anxiety is about the wrong systems

The Act is risk-tiered, so the majority of enterprise AI attracts limited obligations while a small number of systems carry substantial ones. Without classification, organizations either treat everything as high risk, which stops useful work, or treat nothing as high risk, which is a problem deferred. Both are expensive. The classification is also not obvious: the same technology can be minimal risk in one deployment and high risk in another.

What we do

Classify, then close the gaps that matter

We establish your role for each system, provider or deployer, since the obligations differ, and classify by risk tier against the actual deployment context rather than the technology. From there we assess what exists against what is required: technical documentation, risk management, data governance, human oversight, transparency, accuracy and logging. The output is a gap list with effort attached, sequenced against the dates the obligations bind.

EU AI Act Readiness

Capabilities

Risk Classification
AI Inventory
Conformity Gap Analysis
Technical Documentation
Human Oversight Frameworks
Transparency Obligations
Post-Market Monitoring

Common use cases

Establish which of your AI systems fall into which risk tier, with the reasoning documented.
Determine whether you are a provider or a deployer for a vendor-supplied AI feature.
Build the technical documentation a high-risk system requires before it is needed.
Give a board a defensible position on readiness and residual exposure.

How we deliver

Inventory

Establish what AI is in use across the organization, including what nobody approved.
Classify

Assign a risk tier to each system and derive the obligations that follow from it.
Close gaps

Documentation, oversight, transparency and logging brought up to the required standard.
Sustain

Hand over the policies, roles and review cadence that keep it true after we leave.

Technology

ISO/IEC 42001
ISO/IEC 27001
EU AI Act
NIST AI RMF
GDPR
DORA

Security & governance

The output is evidence, not assurance: a system inventory, a risk classification per system, the technical documentation each tier requires, records of human oversight, and a review cadence with named owners. That is the material a regulator or an auditor actually asks for, and it is what an internal audit function needs to sign anything off.

Independently audited against

Engagement models

AI Advisory

Expert consultants provide strategy, architecture, assessment and transformation guidance.

AI Project

We take responsibility for designing and delivering a defined AI solution.

AI Transformation Program

A multi-workstream enterprise programme spanning consulting, engineering and organizational change.

Why TeamExtension.ai

We translate obligations into engineering work

Legal analysis tells you what is required. The harder question is what that means in a codebase: what to log, how to evidence oversight, what documentation must exist and who produces it. We work in both registers, which is why our gap lists have effort estimates rather than only findings.

Selected clients

Frequently asked questions

Are we a provider or a deployer?

It depends on whether you place a system on the market under your own name or use one supplied by someone else, and it can change if you substantially modify a system or use it under your own branding. Establishing this per system is part of the work, because the obligations differ significantly.

Does this apply to us outside the EU?

It can. The Act reaches systems whose output is used in the EU, regardless of where the provider is established. Geography of your servers is not the deciding factor.

What if we use a general-purpose model from a large vendor?

The vendor carries obligations as a model provider, but you carry your own as a deployer, and building on their model does not transfer those to them. Vendor documentation is an input to your compliance, not a substitute for it.

How does this relate to ISO/IEC 42001?

The standard gives you a management system; the Act gives you legal obligations. They overlap substantially, and an organization running 42001 properly will have much of the evidence the Act expects, though not automatically all of it.

Related capabilities

AI Governance, Risk & Compliance

AI Governance

Establish the policies, controls and responsibilities required to deploy AI safely at enterprise scale.

Learn more

AI Security

AI Security Consulting

Threat-model AI systems and design the architecture, controls and boundaries that contain their risk.

Learn more

AI Strategy & Transformation

AI Strategy

Decide where AI belongs in your business, what it is worth, and in what order to build it.

Learn more

Discuss Your AI Initiative

Classify your AI systems, map the obligations that follow, and close the gaps before they become binding.

Talk to an AI Expert Start an AI Assessment