AI governance stand-up under the EU AI Act
Standing up AI governance from a blank sheet: role and classification first, then the management system, the impact work and the incident clocks.
Governance3 Sept 20265 min read
AI governance
Engagement patterns
The shape of the work, written from the standards.
Scope, phases, deliverables, roles, what an auditor or authority asks, and where the work goes wrong. Each pattern is built from a published text rather than from a client.
01 — Library
Four patterns
- ISO/IEC 42001:2023
- NIST AI 100-1
- Regulation (EU) 2024/1689
ISO 27001 first certification
The shape of a first certification cycle: scope, risk assessment and treatment, the operating record, and the evidence an accredited body reads.
Compliance3 Sept 20265 min read
- ISO/IEC 27001:2022
- ISO/IEC 27006-1:2024
NIS2 readiness for an important entity
How readiness is shaped for an entity in the important tier: the scope test, the Article 21 measures, the reporting chain and the evidence behind them.
Compliance3 Sept 20265 min read
- Directive (EU) 2022/2555
- ISO/IEC 27001:2022
Product cybersecurity under R155, ISO 21434 and the CRA
One product, three instruments. How the management system, the per-product file and the reporting clocks are built so a single evidence set answers all three.
Compliance3 Sept 20265 min read
Product & OT
- ISO/SAE 21434:2021
- Regulation (EU) 2024/2847
- UN Regulation No 155
02 — Scoping
How an engagement is scoped
Scoping starts with the instrument, not with a package. The obligations that bind an organisation decide which artefacts have to exist, and each pattern names them clause by clause. What is left to agree is sequence, ownership, and the point at which the work is handed back.
Advisory enquiries welcome.
Concrete method speaks louder than capability statements.