Inventory, risk classification and ISO/IEC 42001 readiness — mapped to the AI systems your teams actually run, with evidence an auditor can follow.
Trusted across Europe
Engineering teams in regulated, mission-critical industries — every engagement audited, documented, and production-grade.
PCI-DSS compliant payments and core banking infrastructure — sub-100ms p99 latency, end-to-end audit trail, and tokenization at the edge.
HIPAA-aware patient data pipelines
5G core network observability at scale
99.99% uptime during peak traffic events
Sovereign cloud with full audit trails
Real-time fleet tracking & IoT ingestion
What we deliver
From a complete AI inventory to audit-ready evidence, mapped to the frameworks regulators and customers ask about
You cannot govern what you have not listed. We build a register of every AI system you develop, buy or embed — including AI features switched on inside tools you already pay for — and classify each one under the EU AI Act: prohibited, high-risk, transparency obligations or minimal risk. Each entry records whether you act as provider or deployer, because the obligations differ.
AI system register · risk class per system · provider or deployer roleGovernance has to reflect how AI systems are actually attacked. We threat-model your models, RAG pipelines and agents against MITRE ATLAS tactics and techniques — prompt injection, data poisoning, model theft, exfiltration through tools — and turn the findings into controls with a named owner.
MITRE ATLAS · threat model per critical system · control ownersWe map your practices to the four functions of the NIST AI Risk Management Framework — Govern, Map, Measure, Manage — so decisions about AI risk follow a documented method instead of individual judgment. Useful when US customers or group policies ask for it, and a solid backbone for the EU work.
Govern · Map · Measure · ManageISO/IEC 42001 is the management-system standard for AI. We run the gap analysis, help you design the AI management system — scope, policy, roles, risk and impact assessment, controls — and prepare the evidence for the audit. Privum prepares your organization; the certificate itself is issued by an accredited certification body.
Gap analysis · AI management system design · audit preparationMost AI risk starts with a well-meaning employee and a free tool. We write the AI acceptable-use policy, the list of approved tools, the data categories that must never reach a prompt and the anonymization rules for everything else, plus the training that makes the policy stick — short enough that people actually read it.
Acceptable-use policy · approved-tool list · staff trainingEvery AI vendor processes whatever your teams send it. We review vendor contracts, DPAs, training-on-your-data terms, data residency and sub-processors, and map where personal data enters your AI systems — prompts, fine-tuning sets, RAG indexes, logs — so your DPIAs and records of processing reflect reality.
Vendor assessment · DPA review · DPIA inputOur engineers review your current setup and deliver a prioritized roadmap — no strings attached.
The four situations where an AI governance assessment usually pays back fastest.
You ship features built on LLMs or your own models and sell into the EU. We establish, system by system, whether you are the provider or the deployer, which risk class applies and what documentation that role demands.
You use AI in recruitment, credit scoring, education or access to essential services. Annex III obligations apply from 2 December 2027 — enough time to build risk management, data governance and human oversight properly, not enough to start late.
Your staff already use generative AI, sanctioned or not. We put an acceptable-use policy, an approved-tool list and reviewed vendor terms in place, so the productivity gain does not come at the cost of a GDPR breach.
A procurement questionnaire asks about your AI controls, or your board wants to know where AI is used and who is accountable. We give you the inventory, the policies and the evidence to answer in writing.
The EU AI Act applies in stages. The Digital Omnibus on AI, in force since 27 July 2026, postponed the high-risk deadlines — a delay, not a rollback. The prohibitions, the general-purpose AI rules and the transparency obligations already apply.
Governance only works when it is grounded in the systems you actually run. We start from a real inventory, classify against the regulation and leave you with controls and evidence your teams can maintain. This is not legal advice: where a question turns on legal interpretation, we work alongside your legal counsel and bring the technical facts they need.
Every AI system documented, classified and justified, so you can answer a regulator, an auditor or a customer with evidence rather than intentions.
Obligations mapped to the dates that actually apply to you, with a roadmap sequenced around them instead of a last-minute scramble.
Clear rules on tools and data let teams keep using AI productively, without customer data ending up in services that have no DPA.
We find every AI system in use — built, bought or embedded in SaaS — through interviews, procurement records and technical discovery, and record its owner, purpose and data.
Each system gets a risk class under the EU AI Act and a role (provider or deployer), plus a GDPR view of the personal data it processes.
We compare current practice with the obligations that apply, ISO/IEC 42001 and the NIST AI RMF, and threat-model critical systems with MITRE ATLAS.
A prioritized plan — policies, technical controls, vendor contracts, documentation — sequenced by risk and by the dates that apply to you.
We set up the register, the records and the review cadence that keep your evidence current as models, vendors and use cases change.
From first call to production — a proven 4-step engagement model that keeps the conversation transparent and the velocity honest.
We audit your current stack, identify gaps, and align on business goals.
A detailed roadmap with priorities, effort estimates, and quick wins.
Our engineers embed with your team and execute sprint by sprint.
Ongoing monitoring, optimization, and knowledge transfer to your team.
Adjacent practices that pair well with this one — most engagements blend two or three.
Practical answers about scope, timelines, and how engagements with our AI Governance team usually look.
Whether you're starting from scratch or scaling what you have, our engineers are ready to help.