AI Compliance

Understand the requirements. Prioritise the gaps.

Relevant requirements, evidence gaps and prioritised actions.

I map how you use AI against the rules that apply to you and give you a prioritised list of what is missing.

This is for you if

Compliance readiness starts with your actual AI use. I review relevant requirements, supporting evidence and gaps, then prioritise practical actions with named owners. This is not legal advice or certification.

You sell into the EU.
You handle personal data with AI tools.
A customer has sent you an AI questionnaire.

What you get

A one-page summary for the board.
A gap list in priority order, with an owner against each item.
The evidence you already hold, filed in one place.

How it runs

List how you use AI.
Each tool, each job, and the data involved.
Work out which rules apply.
Not every rule applies to every firm. We start with the ones that do.
Compare use with the rules.
What you already do well, and what is missing.
Prioritise the gaps.
A list with an owner against each item, so it gets done.

Requirements and frameworks considered

Applicable data-protection requirements for your jurisdiction and sector. UK GDPR and the Data Protection Act where they apply; US requirements depend on the state, sector and use case and may require your qualified legal adviser.
The EU AI Act where your activities fall within its scope. Its duties arrive in stages and depend on the category of system and your role, so not every business is in scope. I check which duties apply to you and when, from the current official text, before we rely on any date.
Your sector regulator’s rules, where they exist.
Voluntary frameworks such as the NIST AI Risk Management Framework, where a client asks for one.