SVC.03.1
AI inventory and risk classification
Find every AI and automated decision system you run, classify it against the EU AI Act risk tiers, and name an owner for each one.
SVC.03
AI you can put in front of a regulator.
Most organisations cannot yet answer the first question an auditor will ask, which is what AI systems do you run and who is accountable for each one. As of April 2026, 78 percent of organisations had taken no meaningful steps toward EU AI Act compliance, and over half could not produce an inventory of the AI they operate. The Annex III high-risk deadline has moved to 2 December 2027, but the Article 50 transparency obligations have applied since 2 August 2026 and GPAI obligations since August 2025. The extension is time to get this right, not time to ignore it.
We are unusual in doing both halves of this. The governance work is done by people who build AI systems, and the build work is done by people who run management systems. Most firms can only do one.
Services
What we do
SVC.03.2
EU AI Act readiness assessment
Obligations mapped to your systems, gaps ranked by exposure, and a remediation plan with dates.
SVC.03.3
ISO/IEC 42001 AI management system
The certifiable governance framework, implemented and mapped to your existing ISO 27001 controls so you are not running two systems.
SVC.03.4
AI assurance review
Independent review of a model or agent already in production: data lineage, evaluation, human oversight, logging, failure modes.
SVC.03.5
AI proof of concept
A scoped use case taken to a working, measured prototype with the governance built in from the start.
SVC.03.6
Agent and automation deployment
Production AI systems for regulated workflows, with audit trails, evaluation harnesses and rollback.
SVC.03.7
AI policy and staff training
Acceptable use, review gates, and training for risk, audit and engineering teams.
Deliverables
What you get
- 01A complete AI system inventory with owners, risk tier and evidence of classification.
- 02An obligations map you can hand to your board, your auditor or your customer.
- 03Implemented controls, not a policy that engineering ignores.
- 04Evaluation and logging built into the system rather than bolted on afterwards.
- 05A path to ISO 42001 certification if you want one.
Engagements
Engagement
AI inventory and risk classification
Shape
Fixed fee, 3 to 4 weeks
From
from £12,000
Engagement
EU AI Act readiness assessment
Shape
Fixed fee, 4 to 6 weeks
From
from £18,000
Engagement
ISO 42001 AI management system
Shape
Fixed fee, 16 weeks
From
from £25,000
Engagement
AI assurance review of a live system
Shape
Fixed fee
From
from £15,000
Engagement
AI proof of concept
Shape
Fixed fee, 4 to 8 weeks
From
from £35,000
Engagement
Agent or automation deployment
Shape
Milestone based
From
from £80,000
Ranges are indicative. Every engagement is scoped and quoted as a fixed fee before it starts, so you are not managing a day rate.
Fit
Who this is for
01
You sell to regulated customers and their AI questionnaires are now blocking deals.
02
You have AI in production and nobody owns it.
03
You are pursuing ISO 42001 because a customer or a tender asked for it.
04
You want to deploy AI into a regulated workflow and need it to survive inspection.
FAQ
Questions, answered.
Next step
Start with a conversation, not a proposal.
Thirty minutes. We will tell you what we would do, what it would take, and whether we are the right firm for it.