AI consulting for European rules

01

Do you work with organisations across the EU?

Yes. We work remotely with clients across the European Union, the EEA, the UK, and Türkiye, and travel for workshops and on-site assessments where the engagement calls for it. Engagements are delivered in English.

02

What does EU AI Act readiness actually involve?

It starts with classifying each of your AI systems against the Act's risk tiers, because the obligations that follow depend entirely on that classification. From there we map the required controls — technical documentation, data governance, logging, human oversight, and transparency to affected people — against what your systems do today, and give you a prioritised list of the gaps that matter most.

03

Are you a consultancy or an engineering team?

Both, deliberately. The people who write the assessment are the people who can implement it. That constraint keeps our recommendations to things that can actually be built, and it means you are not paying a second firm to interpret the first firm's deck.

04

Does NIS2 apply to my organisation?

NIS2 covers a much wider set of sectors than the directive it replaced, and scope depends on your sector, size, and the criticality of the service you provide. Determining whether you fall in scope as an essential or important entity is the first step of our gap assessment, before any remediation work is proposed.

05

Are you certified under ISO 27001 or NIS2?

No, and we say so plainly. We are a consultancy, not a certification or accreditation body: we hold no certification under these frameworks and cannot issue one to you either. What we do is the preparation work — assessing your controls against what those frameworks require, closing the gaps, and assembling the evidence so that the accredited auditor or the regulator finds what they need when they arrive.

06

Can you keep our data inside the EU?

Yes. For regulated workloads we design around EU-region infrastructure and, where a third-country model provider is not acceptable, self-hosted open-weights models running on infrastructure you control. Which of those applies is a decision we make with you during the architecture phase, not a default we impose.

07

We already have AI in production — is it too late?

No, and this is the more common case. Systems that are already live are exactly what a readiness review is for: we classify what you are running, find where it falls short of what the Act and your own risk appetite require, and sequence the fixes so the system keeps serving while the gaps close. Starting from a running system is usually faster than starting from a blank page, because the hard decisions have already been made.

08

How does an engagement usually start?

With a short call to establish what you run, what you are accountable for, and what is actually urgent. Most clients then take a scoped assessment — AI readiness or security gap analysis — that produces a prioritised roadmap. Delivery work follows only if you want us to do it.

Something not covered here? Ask us directly.