Featured case study
Building an AI-Powered Wardrobe & Style Intelligence App
An AI-powered wardrobe intelligence app that helps people organize their clothing and understand their personal style.
Read the case study
AI Governance and EU AI Act Compliance Services
Policies, controls and records that let you use AI with confidence and show regulators you are in control.
Stack we work in
- MLflow
- Python
- Projects delivered
- 680+
- Clients served
- 310+
- Client retention
- 98%
- Certified engineers
- 20+
- Building since
- 2018
Figures as of Oct 2026
Trusted by
- Aralia
- Rosa Pistrina
- Lashbo
- Micromunchi
- Payroll Ninja
- POD
- Petdx
- Yokey
- Spin Up
- Starwear
- Udlins
- Vegpal
- Wander Wings
- Wish It
- Wisl
Why governance becomes urgent
As AI moves into products and daily work, organizations need to know which systems they run, what risks they carry and who is accountable for them.
Read the full overview
We help you set up practical AI governance: an inventory of AI systems, risk classification under the EU AI Act, policies and approval processes, technical controls such as logging, evaluation and human oversight, and documentation such as model cards and audit trails. We align the work with ISO/IEC 42001 and the NIST AI Risk Management Framework, and with UK and sector rules where they apply, so the effort counts toward certification and customer due diligence, not just a policy document.
Nobody knows what AI is in use
Teams adopt AI tools and features faster than anyone can track.
Customer questionnaires
Enterprise buyers ask detailed AI governance questions that slow or block deals.
Regulation arriving
EU AI Act duties are phasing in and it is unclear which systems they cover.
Policies without controls
An AI policy exists, but nothing in the systems enforces or proves it.
No owner
Responsibility for AI risk sits between IT, legal, data and the business.
Outcomes
What you get
- A complete view of where AI is used and who owns it
- Clear EU AI Act obligations for each system
- Policies people can follow, not just documents on a shelf
- Controls built into systems, with evidence to prove it
- Faster customer security and procurement reviews
- A path to ISO/IEC 42001 certification if you want it
What we deliver
What you receive
AI system inventory
Every AI system and model with owner, purpose, data, vendor and risk class.
Risk register and assessments
EU AI Act classification, impact assessments and mitigations per system.
Policy set
AI policy, acceptable use, vendor review and incident procedures.
Gap report
Position against the AI Act, ISO/IEC 42001 and NIST AI RMF, with a prioritized plan.
Technical controls
Logging, oversight, testing and monitoring added to priority systems.
Documentation pack
Model cards, technical documentation and evidence ready for audits and customers.
Typical situations
Software companies selling AI features
Answer customer due diligence and meet provider duties for AI in your product.
Learn moreHR and recruitment technology
Meet high-risk requirements for AI used in hiring and workforce decisions.
Financial services
Govern credit, fraud and customer AI under the AI Act and financial regulation.
Learn moreHealthcare and life sciences
Control AI that touches patient data or clinical workflows.
Learn moreOrganizations rolling out AI assistants
Policies and controls for staff use of Copilot, ChatGPT and internal assistants.
Companies seeking ISO/IEC 42001
Gap analysis and implementation support ahead of a certification audit.
AI inventory and risk classification
Know what AI you run and how risky it is.
- Register of AI systems, models, vendors and use cases across the organization
- EU AI Act classification: prohibited, high-risk, limited-risk and minimal-risk
- Provider and deployer roles identified for each system
- General-purpose AI model use and supplier obligations reviewed
- Risk and impact assessments, including data protection impact assessments
Built with
- EU AI Act
Policies and operating model
Decide who approves what, and how.
- AI policy, acceptable use policy and staff guidance
- AI governance committee, roles and approval workflow
- Vendor and third-party AI due diligence checklists
- Incident reporting and escalation process for AI failures
- AI literacy training for staff and leadership
Standards and frameworks
Build toward recognized standards.
- ISO/IEC 42001 AI management system gap analysis and implementation support
- NIST AI RMF mapping across govern, map, measure and manage
- ISO/IEC 23894 risk management and ISO 27001 alignment
- Readiness for external ISO/IEC 42001 certification audits
Built with
- ISO/IEC 42001
- ISO/IEC 23894
- NIST AI RMF
Technical controls
Put the policies into the systems.
- Logging and audit trails for model inputs, outputs and decisions
- Human oversight and override steps in AI workflows
- Evaluation, bias and robustness testing before release and on a schedule
- Guardrails, content filters and personal data controls
- Model monitoring for drift and quality in production
Documentation and evidence
Be ready when someone asks.
- Model cards and system cards for each AI system
- Technical documentation and record-keeping for high-risk systems
- Transparency notices for users interacting with AI
- Evidence packs for customer due diligence, auditors and regulators
Built with
- Model cards
Why teams choose Equitysoft for AI governance
Policies and the technical controls
We write the policies and also implement the logging, oversight steps, guardrails and monitoring that make them true in production.
Mapped to the standards auditors ask about
ISO/IEC 42001, NIST AI RMF, ISO/IEC 23894 and ISO 27001 alignment, with gap analysis you can act on.
Evidence you can hand over
Model cards, system cards, technical documentation and evidence packs ready for customer due diligence and regulators.
Clear about what we are not
We are not a law firm. We work alongside your counsel and are explicit about where legal advice is needed.
Done by an AI engineering team
Governance reviews are run by people who build AI systems, so controls fit how the systems actually work.
Recent work from our team
How we work
Discover
We find AI systems in use, including vendor tools and shadow AI, and collect existing policies.
You receive AI inventory
Classify and assess
Each system is classified under the EU AI Act and assessed for risk and impact.
You receive Risk register
Gap analysis
We compare current practice with the AI Act, ISO/IEC 42001 and NIST AI RMF.
You receive Gap report and plan
Design governance
We draft policies, roles, approval workflows and the controls each risk level needs.
You receive Governance framework
Implement controls
We add logging, oversight, testing and documentation to priority systems.
You receive Controls and evidence
Monitor and review
We set review cycles, metrics and audit readiness, and support you through audits.
You receive Ongoing governance plan
Tech stack
Technologies we use
AI and machine learning
Data platforms
Pipelines and orchestration
Languages
Cloud and DevOps
Other tools
Next step
Need evidence your AI is safe and accurate?
Governance needs test results. Our AI testing and red teaming service produces them.
Questions, answered
It depends on how many AI systems you run, how many are high-risk, whether you build or only buy AI, the frameworks you want to align with and how much of the technical control work we do. As a guide, an AI inventory and gap assessment usually costs $8,000 to $20,000, and a full governance program with policies, controls and documentation $25,000 to $80,000 or more (USD).
It can. It applies to providers placing AI systems on the EU market and to deployers using AI in the EU, and in some cases to non-EU companies whose AI output is used in the EU. We check your role for each system.
The Act entered into force in August 2024. Bans on prohibited practices and AI literacy duties have applied since February 2025, and rules for general-purpose AI models since August 2025. Most high-risk obligations follow on a phased timetable that the EU has proposed to adjust, so we plan against the dates in force when we work with you.
Mainly use in areas listed in the Act, such as recruitment and HR, credit scoring, education, essential services, critical infrastructure and law enforcement, or AI that is a safety component of a regulated product. High-risk systems need risk management, data governance, documentation, logging, human oversight and accuracy controls.
The international standard for an AI management system. It sets out how an organization governs, develops and uses AI responsibly, and can be certified by an accredited body. It fits alongside ISO 27001 if you already have it.
Yes, though lighter. You still need an acceptable use policy, data handling rules, vendor review, staff AI literacy and a record of where AI is used. As a deployer you may also have AI Act duties for some uses.
No. We provide technical and operational governance work. For legal interpretation we work alongside your legal counsel or can recommend specialist firms.
Yes. As a development company we add logging, human approval steps, evaluation pipelines, guardrails and monitoring to your AI systems, so the evidence comes from the systems themselves.
An inventory and gap assessment usually takes 3 to 6 weeks. A full program with controls on priority systems typically takes 3 to 6 months.
Book a call, and we talk through the goal, the systems involved and any constraints under NDA. You then get a short written proposal with scope, timeline and estimate. We need a list of the AI systems and tools in use, who owns them, your existing policies, and access to the people who run the main use cases.
Yes. Regulation, models and your own use cases change, so we offer scheduled reviews, re-testing after model or data updates, and help keeping the AI register and evidence packs current.
Need to show your AI is under control?
Book a call. We will review your AI use and outline the governance and compliance steps that apply to you.