AI compliance and governance

Make AI evidence-based, controlled and accountable

OLING helps align the AI Act, GDPR, security and internal governance to deploy AI uses without compliance blind spots.

Discuss your AI project

AI compliance, governance and the AI Act

AI uses mapped and prioritised Controls, roles and evidence defined A practical compliance framework for teams

Scope of the service

When to structure compliance for AI uses

The engagement begins with an inventory of AI systems and uses, then distinguishes roles, risk levels and applicable obligations. It does not replace AI project management: it establishes the control and evidence framework.

Identify the relevant systems, models, assisted functions, users, data and suppliers.
Determine the organisation’s role in the value chain and classify each use according to its risk level.
Connect AI Act obligations with GDPR, cybersecurity, procurement, quality and internal control requirements.
Define the controls, human approvals, documents and evidence to retain throughout the lifecycle.

Objectives

Objectives agreed with your teams

AI uses mapped and prioritised
Controls, roles and evidence defined
A practical compliance framework for teams
Deliverables defined during project scoping.

AI compliance, governance and the AI Act

OLING helps organisations deploy AI without accountability blind spots by addressing the AI Act, data protection, human oversight, supplier management and compliance evidence.

We align governance, security, compliance, procurement and internal controls to make AI uses auditable and sustainable.

Scope of the engagement

AI compliance assessment and mapping of AI uses.
Assessment of risks, obligations and responsibilities.
Definition of policies, controls and human oversight principles.
Creation of an AI use register, evidence framework and supplier documentation.
Alignment of the AI Act, GDPR, security and internal governance.

Expected deliverables

AI use map and risk matrix.
AI policy and governance framework.
Compliance register and control points.
Compliance action plan.

Scope of our engagement

AI usage audit, inventory and system register
Identification of regulatory roles and risk classification
AI policy, permitted uses, responsibilities and committees
AI Act assessment, data protection and appropriate impact assessments
Supplier governance, access control and confidentiality
Human oversight, auditability, incident handling and controls
Support for an ISO/IEC 42001 management system

Deliverables and decision criteria

System register, obligations matrix, AI policy, risk assessment, control plan and evidence pack. Deadlines are established for each system according to its purpose, regulatory role and applicable provisions, with an accountable owner.

AI Act: classify obligations and deadlines

Regulatory reference checked on 23 October 2026: the AI Act generally applies from 2 August 2026, with specific provisions. Initial prohibitions and AI literacy apply from February 2025; GPAI obligations from August 2025. High-risk deadlines are 2 December 2027 (Annex III) and 2 August 2028 (Annex I products), under the updated rules. Each system still requires individual classification.

Prerequisites, controls and limitations

Compliance is not a label attached to a tool. It depends on use, data, actors and operations. ISO/IEC 42001 support is not certification. GDPR and cybersecurity obligations still require attention when a system is not classified as high-risk.

Discuss your AI project

Our method: from business need to measured value

Understand
Analyse the organisation, activities, people, data and IT landscape. Observe real work and pain points before selecting a solution.
Prioritise
Compare business value, feasibility and risk. Establish a baseline, a business owner and success criteria for each use case.
Design
Define the target process, architecture, interfaces, responsibilities, human approvals and performance indicators.
Experiment
Test a pilot on representative situations, including failure cases. Compare quality, cost and usefulness with agreed criteria.
Deploy
Integrate with applications, run acceptance and rollback checks, train users and support managers.
Measure
Track benefits, errors, costs, adoption and incidents. Regularly reassess models, data and controls.

FAQ

How can AI agents be deployed reliably?

Constrain tools and permissions, test adversarial and failure scenarios, require appropriate human approvals and monitor actions. An agent must be able to stop and hand a case to a person.

Bringing the right expertise together

Our role

Build the compliance framework, not the project backlog

AI Act advisory identifies obligations, responsibilities, risks, controls and documentation. AI project advisory remains responsible for defining functional requirements, managing the project, coordinating acceptance testing and deploying the use case.

Scope

Inventory and classification of AI uses

Internally developed AI, purchased solutions, embedded features, agents, general-purpose models or services provided to clients.
Purpose, affected population, data processed, decisions influenced and consequences of errors.
Provider, deployer, importer or distributor role and allocation of obligations with partners.
Prohibited practices, high-risk systems, transparency obligations and limited-risk uses.

Project stages

Bring AI uses under control

Gather actual use cases and compare declarations against contracts, tools, data flows and business practices.
Classify systems, document roles and analyse applicable requirements with legal, the Data Protection Officer and security teams.
Define controls for data, performance, human oversight, incidents, suppliers and information provided to individuals.
Implement the register, approvals, evidence collection, periodic reviews and action tracking.

Deliverables

AI Act governance deliverables

Inventory of AI uses, roles and risk classifications.
Matrix of obligations, gaps, responsible parties and deadlines.
AI policy, approval process and human oversight rules.
Register of controls, suppliers, incidents, decisions and evidence.

Project context

Required governance decisions

Authorise, conditionally approve, suspend or prohibit a use based on its risk and the available evidence.
Assign responsibilities across business teams, the IT department, data, security, the Data Protection Officer, legal, procurement and suppliers.
Set minimum requirements before a pilot, production launch or significant change.
Organise ongoing monitoring, incident reporting and system reassessment.

Your teams

Functions involved

Executive management and business owners for authorised uses, impacts and trade-offs.
Legal, compliance and the Data Protection Officer for roles, obligations, personal data and individual rights.
The IT department, data teams and cybersecurity for models, integrations, technical controls and incidents.
Procurement and suppliers for documentation, commitments, changes and the allocation of responsibilities.

Practical questions

Short answers

When should an organisation involve OLING?

OLING is relevant when an initiative affects information systems, processes, compliance or several stakeholders and requires independent scoping before decisions are made.

What deliverables can be expected?

Assignments produce diagnostics, scoping notes, roadmaps, decision matrices, action plans, steering materials and evidence tailored to the context.

Related expertise

Connect compliance with execution

The AI Act framework complements project management, GDPR compliance and cybersecurity governance without replacing these disciplines.

Related resource

Discuss your project

Assess AI uses, roles and obligations

The initial discussion covers existing or planned uses, suppliers, data, affected populations and current controls.

Review your AI uses and compliance