EU AI Act readiness and AI governance that people actually follow
Your team is already using AI. Banning it just pushes it underground. I build the acceptable-use rules, the data boundaries and a sign-off process fast enough that people use it, and I map the tools you actually use against the EU AI Act so you know what’s in scope well before the high-risk rules land in December 2027.
Haden McAlpine · CISSP · ISO/IEC 27001 Lead Auditor · 25 years in IT, cyber and infrastructure
The real problem is shadow AI
In most mid-sized companies, AI arrived before the policy did. Someone pasted a customer contract into a chatbot to summarise it. Someone else connected an AI note-taker to every sales call. A developer gave a coding assistant access to the whole repository. None of it was malicious, and most of it was useful. But nobody decided what data was allowed to leave, which tools were approved, or who checks the output before it goes to a customer.
That’s the gap I close first, because it’s where the actual risk is today: confidential data and IP walking out the door in a prompt, not a regulator knocking.
Where the EU AI Act fits
The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in stages:
- Since 2 February 2025: prohibited AI practices are banned, and organisations using AI must take measures to support their staff’s AI literacy (an obligation the 2026 Digital Omnibus softened from “ensuring” a sufficient level).
- Since 2 August 2025: obligations for providers of general-purpose AI models apply.
- From 2 December 2027: the main obligations for high-risk AI systems listed in Annex III apply, following the 2026 Digital Omnibus amendments that moved the original date back.
Most mid-market companies aren’t building AI models. They’re deployers: they use AI systems that someone else built. For everyday tools like chat assistants and copilots, deployer obligations are light. They get much heavier when AI is used in high-risk areas such as recruitment and staff management, credit decisions, or access to essential services, and that’s exactly where off-the-shelf HR and finance tools are quietly adding AI features.
The Act also reaches outside the EU. A UK company can be caught if it places an AI system on the EU market or if the system’s output is used in the EU. Penalties for prohibited practices go up to €35 million or 7% of worldwide turnover.
What I deliver
Shadow AI discovery
An inventory of the AI tools actually in use, from network and licence data and from talking to people, plus what data each one touches.
Acceptable use and data boundaries
A short, readable policy: which tools are approved, what data can go into them, and what has to be checked before AI output reaches a customer.
AI Act risk classification
Each AI use mapped to its AI Act risk category and your role, provider or deployer, with the obligations that follow and their dates.
Fast sign-off process
A lightweight risk assessment for new AI tools that takes days, not months, so teams ask first instead of going around it.
LLM data and IP safeguards
Contract and configuration checks on your AI vendors: training on your data, retention, residency, and who owns the output.
AI literacy
Practical training for staff and leadership that covers the Act’s literacy duty without turning into a compliance lecture.
I designed and built an AI governance framework from a standing start, for a business already using commercial AI tools faster than anyone had written a policy for it: acceptable use standards, real data handling boundaries, and a sign-off process fast enough that people actually used it.
> 0 → 1 framework established; shadow AI resolved without slowing development
Fitting AI governance into what you already have
AI governance works best as part of your existing security and privacy management rather than as a separate programme. If you already run, or are building, an ISO 27001 management system, AI risks and controls slot into it directly. ISO/IEC 42001, the management system standard for AI, uses the same structure, so it’s a natural next step if customers start asking for it. The data protection side overlaps heavily with GDPR, and I handle the two together.
Common questions
Does the EU AI Act apply to UK companies?
It can. The Act applies to providers that place AI systems on the EU market, and to providers and deployers outside the EU where the AI system’s output is used in the EU. A UK company selling into Europe, or using AI to make decisions about people in the EU, should check its position.
We only use tools like ChatGPT and Microsoft Copilot. Do we have obligations?
A light one. Since February 2025, organisations using AI systems must take measures to support their staff’s AI literacy. Beyond that, general productivity use is usually low risk under the Act. The bigger exposure for most companies is data leakage and unvetted use in high-risk areas such as hiring, which is why the inventory comes first.
When do the high-risk AI rules apply?
The main obligations for high-risk systems listed in Annex III, which include AI used in employment, credit and access to essential services, apply from 2 December 2027 following the 2026 Digital Omnibus amendments. Prohibited practices and AI literacy already apply.
Should we just ban AI tools until we have a policy?
I wouldn’t. Bans rarely hold. People keep using the tools on personal devices and accounts, and you lose visibility of what data is going where. A short acceptable-use policy and a list of approved tools, put in place quickly, gets you more control than a ban.
Do we need ISO 42001 certification?
Usually not yet. It’s worth considering if your customers start asking for it or if you build AI into products you sell. The governance I put in place is structured so it can grow into ISO 42001 without starting again.