AI Governance & Compliance
Many organisations need clear ownership, documentation, and readiness for the rules that apply to their AI systems. That often includes the EU AI Act, but it can also include GDPR or a variety of different rules that are more sector-specific (for example HIPAA).
These services cover focused checks through to putting lasting governance in place. For EU AI Act timelines, Irish regulators, and a checker for what applies to your use of AI, see our EU AI Act in Ireland guide.
Services
Which service is right for you?
Five services for organisations that need clear ownership, documentation, and readiness for the rules that apply to their AI. Each covers a different situation. Click or tap to see full details.
Not sure which fits where you are right now? That is completely fine, and it is exactly the kind of thing a free intro call is for.
A full inventory of AI in use, including tools staff adopt informally and systems embedded by vendors. For each system we determine risk tier and organisational role (provider, deployer, importer, distributor), then map obligations and deadlines. The output is a gap assessment and a prioritised remediation roadmap. Classification is technical and governance analysis; legal edge cases are flagged for counsel. This is not the free directional readiness assessment on app.clearlead.ai.
Deliverables
- AI system register with risk tier and role per system
- Obligation and deadline matrix
- Gap assessment and prioritised remediation roadmap
- Board-ready exposure summary
- Readout with clear next steps
Timeline
Typically five to eight senior consulting days over two to three elapsed weeks, depending on system count.
When to choose this
You need a clear answer on AI regulatory exposure, often prompted by a customer questionnaire, procurement requirement, insurer, or board question.
An inventory of customer-facing AI touchpoints (owned and vendor-supplied), mapped against disclosure and labelling duties such as chatbot disclosure, machine-readable marking of AI-generated content, and related labelling rules. You get a gap report with concrete remediations and a vendor responsibility map. This is not a legal opinion and not a full organisation-wide exposure assessment.
Deliverables
- Customer-facing AI touchpoint inventory
- Per-touchpoint gap assessment against transparency duties
- Prioritised remediation list with example disclosure or labelling copy
- Vendor questions and contractual points to raise
- One-page summary suitable for the board or a customer asking about compliance
Timeline
Typically two to three senior consulting days over one elapsed week.
When to choose this
You use AI in front of customers or the public and need a concrete fix list before transparency deadlines, not a full governance programme.
An inventory of how staff actually use AI, role-based literacy requirements matched to the systems each group touches, practical training, and a documentation pack (records, policy skeleton, maintenance schedule). Under the EU AI Act, Article 4 is about supporting literacy development; there is no direct fine for missing training records. The point is a practical, proportionate programme, not certification (none exists under Article 4), and not selling fear around fines.
Deliverables
- AI tool and usage inventory
- Role-based literacy requirements matrix
- Delivered training session(s) with materials you keep
- Documentation pack: records, policy skeleton, refresh schedule
- One-page attestation summary for the board
Timeline
Typically a half-day to one-day workshop per audience group, plus inventory and documentation work.
When to choose this
Staff already use AI, documentation is thin or absent, and you want a proportionate programme you could point to if asked what measures you took.
For systems that fall in a high-risk category (for example Annex III under the EU AI Act), most conformity routes are internal self-assessment, not a Notified Body sign-off. The substance is ML engineering evidence inside regulatory documentation: evaluation results, data governance, human oversight, quality management, and post-market monitoring. We can start with a gap assessment as a bounded entry, then scope the fuller documentation build. Not a legal opinion; the provider retains responsibility and liability.
Deliverables
- Gap assessment against high-risk documentation and oversight requirements
- Technical documentation build-out scoped to the engagement
- Human oversight design and evidence
- Quality management and post-market monitoring plans as agreed
- Preparation support for self-assessment and declaration (legal counsel reviews the declaration itself)
Timeline
Multi-month when taken end to end. The gap phase can be sold standalone over one to two weeks.
When to choose this
You provide or deploy a high-risk AI system and need preparation before the relevant deadline, with proper engineering evidence rather than paperwork alone.
Helping you put standing governance in place, or assessing what you already have. That can include acceptable-use policy, ownership and escalation, documentation standards, and oversight rhythms. Scoped to your starting point: establish from scratch, assess an existing framework, or guide improvements. Complements strategy and roadmap work; it is the compliance and oversight delivery home, not a full AI strategy engagement.
Deliverables
- Assessment of current governance posture (where relevant)
- Proportionate policy and oversight recommendations
- Documentation and ownership model matched to your systems
- Practical implementation guidance for your team
- Clear boundaries on what needs legal counsel versus operational setup
Timeline
Scoped to starting point and organisation size. Often a short establish or assess engagement rather than an open-ended retainer.
When to choose this
You need standing governance structures, not a one-off Act deadline check, matched to how the organisation actually operates.
Each one above sketches what that service typically involves, not a fixed menu. Many start with a focused check and only expand if the inventory shows a wider gap.
If your situation looks different, get in touch and we will talk through what fits.
Is this for you?
Who this is for
Organisations that use AI in ways that raise governance or regulatory questions: customer-facing systems, staff use of generative tools, high-risk applications, or a board that needs a clear picture of exposure.
We are based in Ireland (within the EU), but we work with companies globally. The same approach applies: clear ownership, documentation, and readiness for the rules that actually apply.
If you need direction and a roadmap more than compliance delivery, start with AI Strategy. Governance belongs in that plan; this page is where the compliance work lives.
When something else fits better
These services are for oversight and regulatory readiness. If you need something else:
- EU AI Act timelines, regulators, and a self-serve checker: EU AI Act in Ireland
- Strategy, roadmaps, and programme view: AI Strategy
- Already have AI and need to prove or scale it: Scaling & Proving AI
- New to AI: Getting Started with AI
FAQ
Common questions
Is this legal advice?
No. This is technical and governance analysis: inventories, classifications, documentation, and practical remediation lists. Legal interpretation and sign-off sit with your counsel. Where an edge case needs a legal opinion, we flag it rather than guessing.
Do you only work on the EU AI Act?
No. The EU AI Act is a common driver for this work, and Ireland and the EU are our primary market. The same approach applies to other rules that affect you, including GDPR and sector requirements such as HIPAA where they are relevant. For Act-specific timelines, regulators, and a checker, see our EU AI Act in Ireland guide.
Will you scare us with fines for missing AI literacy training?
No. Under the EU AI Act, Article 4 literacy duties are about supporting staff development. They are not in the fine schedule. Literacy work is about good practice: if a regulator asked what measures you took, could you show them? Claiming fines for missing training records is incorrect.
What if we are already compliant?
That is a valid outcome. A Transparency Check or Exposure Assessment can conclude that you are already in good shape, with little or nothing to change.
How does this relate to AI Strategy?
Strategy covers direction, roadmaps, and programme view, including building governance into the plan. This page is the home for compliance delivery and standing oversight work. Many organisations need both; they answer different questions.
Need clearer AI governance?
Book a free intro call and we will talk through what fits.