IN BRIEF
AI governance defines which AI applications an organisation uses, who is accountable for them and the rules by which they are assessed, including the risk classes of the EU AI Act. By AI harness, we mean the technical control layer around models and agents, with guardrails, evaluations, logging, monitoring, approvals and versioning. This connects responsibilities and policies with technical controls and their documentation.
When to involve us.
When AI applications emerge across several departments without a complete overview, or when a pilot is about to go into operation while questions of accountability, evidence and monitoring remain open.
We build an inventory of AI applications, make an initial classification against the risk classes of the EU AI Act and clarify roles, policies and approval processes; the legal assessment stays with your legal experts. For operation, we design the harness, meaning which inputs and outputs are checked, how models and prompts are versioned and evaluated before changes, and which logs and metrics feed monitoring. We also define how the effectiveness of the controls is tested and their remaining limitations are documented.
What the work produces.
We agree on the scope around your goals, starting point and available capacity. The following elements illustrate what an engagement can include.
WHAT WE ADDRESS
- AI inventory and risk classification
- Roles, policies and approval process
- Harness architecture with guardrails, evaluation and monitoring
- Logging and evidence concept for operation
POTENTIAL OUTPUTS
Defined responsibilities, a design for technical controls and an evidence plan with specified checks and documented limitations. These provide a basis for approving and regularly reviewing your AI applications.
A focused starting point.
An overview of existing and planned AI applications, where available, and current policies on IT, information security and privacy. IT, business units, information security, privacy and legal should all be involved.
The question first. Then the scope.
The first conversation clarifies the objective, deliverables and people involved. We agree whether the engagement covers design, pilot support or technical implementation, who takes on each task and how the deliverables will be assessed.
Discuss a starting point by emailIs an AI policy enough to comply with the EU AI Act?
A policy is a starting point. What matters is which obligations apply to your role and application, and how you put them into practice. According to the European Commission's timeline, the EU AI Act's transparency rules generally apply from 2 August 2026, with transitional provisions for certain existing offerings. High-risk rules apply from 2 December 2027 to systems covered by Annex III and from 2 August 2028 to systems embedded in products covered by Annex I (as of 2 October 2026). An AI inventory provides the basis for classification. We work with your responsible teams to define organisational and technical measures, such as logging, approvals and human oversight. Your legal experts assess the applicable requirements, including exceptions and transitional provisions.
Last updated:
