AI Governance, Privacy & AI Security
Each AI system classified, its obligations assigned to an owner and the evidence ready when an authority asks.
The problem
The EU AI Act has been in force since 1 August 2024. Prohibited practices and the AI literacy duty apply since 2 February 2025, and obligations for general-purpose AI models since 2 August 2025. Many organisations still do not know whether they are a provider or a deployer, or which of their systems are high-risk.
Obligations depend on the role and the use case, not on the tool. The same model can be minimal risk in one department and high-risk in HR. A policy document alone does not show an authority what you decided for each system and why.
What we do
For each AI system we establish whether you act as provider or deployer, including cases where your own changes or branding may make you the provider.
We check every use case against Article 5, such as social scoring, emotion recognition at work and manipulative techniques, and stop what is not allowed.
We assess each system against Article 6 and Annex III, and identify where transparency obligations apply, for example chatbots or AI-generated content. The reasoning is recorded.
We set up what each role requires: for deployers human oversight, logs and informing workers; for providers risk management, technical documentation under Article 11 and Annex IV, and quality management.
We define the AI literacy your staff need under Article 4, by role, and set up training and records that show who completed what.
We introduce an intake and approval process, roles and policies, so that every new AI use is classified before it goes live.
How we deliver
Our consultants classify your AI systems, interpret the obligations for your role and design the governance model with your legal, compliance and IT teams.
Our team implements intake, oversight, logging and documentation in your environment, including Microsoft 365 and the AI platforms you use.
We keep classifications, obligations and evidence current as a managed service, and review new AI uses as they come in.
Frameworks
Platform
From December 2026 the Fidempli platform carries this forward: new AI uses are classified at intake, prohibited practices cannot be approved, and each obligation keeps its owner and evidence.
Explore the platform
Yes. As a deployer you have your own obligations, such as AI literacy, and for high-risk systems human oversight, monitoring and keeping logs. We establish your role for each system.
The timeline for high-risk obligations is subject to changes at EU level. We track the current status and plan with you, so the work done now counts either way. Prohibited practices and AI literacy already apply.
Usually not as general assistants. The risk category depends on the use case: the same tool used to screen job applicants can fall under Annex III. We classify by use, not by product.
Providers and deployers must take measures so that staff working with AI have sufficient AI literacy for their role and context. We define what that means for each group and how you record it.
GDPR applies alongside the AI Act whenever personal data is involved. ISO/IEC 42001 gives you a management system to run AI governance. We align the work so that one set of records serves all three.
Fidempli provides governance, risk and compliance advisory and works alongside your legal counsel. We do not provide legal advice.
A senior consultant replies within one business day. Or join the 3–5 design partners shaping the platform before launch.
