AI Governance, Privacy & AI Security
In 3–5 weeks: an inventory of all AI incl. shadow AI, EU AI Act classification per system, a privacy and security review, and a board-ready roadmap.
The problem
Most organisations cannot say how many AI systems they use. Copilots, chatbots, agents and AI features inside existing software spread across departments, and staff use tools nobody approved, often with customer or employee data.
The EU AI Act has banned certain practices and required AI literacy since February 2025, and GDPR applies to every prompt that contains personal data. Without an inventory, nobody can say which obligations apply, where the risks are or what to fix first.
What we do
We agree the business units and systems in focus, name the contacts on your side and set up read-only access to the data sources we need, such as Microsoft 365, Entra ID and Defender for Cloud Apps.
We find the AI tools, models, agents and AI features in use, approved or not, and record owner, purpose, users and the data each one touches.
For each system we determine your role as provider or deployer and the risk category: prohibited, high-risk, transparency obligations or minimal risk. The reasoning is written down.
We check legal basis, the need for a DPIA, data flows and transfers outside the EU, and review identities, permissions, data exposure and guardrails for the systems that matter most.
We turn the findings into a roadmap with owners, effort and quick wins, and present it to your management in a form they can decide on.
Packages
Price [Price]
Price [Price]
Price [Price]
The assessment fee is credited against a Fidempli platform subscription.
How we deliver
Our consultants run the assessment with your IT, security, data protection and legal teams and give you an independent view of where you stand.
Where a finding needs a quick fix, such as blocking a risky AI app or tightening Copilot sharing settings, our engineers implement it in your environment.
After the assessment, we keep the inventory and classifications current as a managed service, so the result does not go out of date.
Frameworks
Platform
The inventory and classifications load into the Fidempli platform when it launches in December 2026. Live connectors then keep them current, and new AI uses go through intake instead of slipping past.
Explore the platform
A sponsor, contacts in IT, security, data protection and the business units, and read-only access to the data sources in scope. We agree the details in the scoping call.
We analyse sign-in, cloud app and proxy data to see which AI apps staff actually use, and combine it with short interviews in the business units.
Essentials gives a fast, complete picture. Standard adds depth on privacy, permissions and Copilot. Standard + Red Team adds hands-on security testing for AI applications and agents you build or run yourself.
We classify each system against the Act and record the reasoning, so your legal team can review and confirm it. Borderline cases are marked as such.
You can work through the roadmap yourself, with our professional services, or with us running it as a managed service. The results also form the starting point in the Fidempli platform.
Fidempli provides governance, risk and compliance advisory and works alongside your legal counsel. We do not provide legal advice.
A senior consultant replies within one business day. Or join the 3–5 design partners shaping the platform before launch.
