AI governance and EU AI Act compliance
EU AI Act, GDPR, DORA and NIS2 obligations, mapped to each AI system in use.
Overview
Lindstead's AI governance work maps each AI system to its obligations under the EU AI Act, GDPR, DORA and NIS2. It ends with a framework the organisation can maintain.
- ResultApplicable duties, responsible owners and evidence needed per AI system.
- InputAI register, contracts, data flows and existing risk or privacy assessments.
Key questions
- Are we a provider or deployer under the EU AI Act, and for which systems?
- Which AI systems are high-risk, and from when?
- Who can access our data at each AI provider, under which law?
- Can we exit each AI provider as DORA and NIS2 require?
Approach
- AI system inventory Every AI system in use or planned, with purpose, data, provider and owner.
- Data-flow and access review Where data goes, who can access it and which jurisdictions apply, including non-EU access laws.
- Regulatory mapping AI Act role and risk class, GDPR basis and DORA or NIS2 duties per system, with deadlines after the Digital Omnibus.
Deliverables
- AI system register Every AI system with owner, purpose, data and provider.
- Regulatory map Obligations per system under the AI Act, GDPR, DORA and NIS2, with dates.
- Governance framework Roles, controls and review cadence the organisation runs itself.
Frequently asked questions
-
After the Digital Omnibus (Regulation (EU) 2026/1744), obligations for Annex III high-risk systems apply from 2 December 2027. For AI in products covered by Annex I, they apply from 2 August 2028. Article 50 transparency obligations apply from 2 August 2026.
-
An AI system inventory, a data-flow and access review, obligations per system and a governance framework.
-
No. The reasons are data control, DORA and NIS2 exit requirements, and non-EU data-access laws.
Related
Discuss regulation and risk with Lindstead.
A 30-minute meeting covers the use case, the requirements and a first plan.