AI Governance and EU AI Act Readiness
What you take away
An AI governance framework that maps to the EU AI Act risk tiers and your own risk policy, and that works inside your delivery process rather than being added at audit time.
What we cover
AI inventory and risk classification
We map your AI use cases against the EU AI Act risk categories, namely unacceptable risk, high risk, limited or transparency risk, and minimal risk, alongside your own internal risk policy. The result is a maintained AI register that your technology and risk functions can both rely on.
Governance framework design
A practical framework covering policy, roles and responsibilities, design and review controls, data quality and lineage, transparency obligations, incident response, and ongoing monitoring, designed to fit how your delivery teams actually work.
EU AI Act readiness
For high-risk use cases, we help you put in place the risk management, data governance, technical documentation, human oversight, conformity assessment, and post-market monitoring the regulation requires. For limited-risk use cases, such as AI that interacts with people or generates content, we help you meet the transparency obligations.
Operating model
Clear decisions on who approves what gets built, who reviews it, and who signs off, with a lightweight checkpoint pattern that lets many teams ship without each inventing its own approach. We also help you decide where the AI governance owner sits in your organisation.
Vendor and model governance
Standards for assessing model providers and AI software, covering security, data residency, intellectual property terms, notice of model updates, and exit. We assess providers evenly, because we do not develop our own foundation models.
Operationalising controls in delivery
Design-stage risk reviews, build-stage evaluation, pre-release human-oversight checks, and post-release monitoring and incident response, built into your normal delivery rhythm rather than running alongside it.
Why this matters now
- The EU AI Act is in force and applying in stages. Prohibited practices have applied since February 2025, and obligations for general-purpose AI models since August 2025.
- Most remaining obligations apply from August 2026, while obligations for high-risk systems have been rescheduled by the Digital Omnibus to take effect from December 2027 for standalone systems and August 2028 for AI embedded in regulated products.
- The Act applies beyond the EU. It can cover organisations outside Europe where an AI system is placed on the EU market, used by people in the EU, or where its output is used in the EU.
- Boards and audit committees increasingly want an AI position they can defend, and customers and partners increasingly ask for governance evidence during procurement.
- Building governance in from the start is considerably less costly than retrofitting it to AI that is already in production.
How we work
Diagnostic
An AI inventory, a first-pass risk classification, a gap analysis against the EU AI Act and your own risk policy, and a prioritised remediation list. This typically takes one to two weeks.
Framework build
A governance framework, operating model, controls, templates, and training, sized to your organisation rather than a long policy document that no one reads. This typically takes three to six weeks.
Embed and maintain
Ongoing support, including regular reviews, regulatory tracking, support for new use cases, and incident response.
Why organisations work with us
End-to-end delivery
We combine advisory, architecture, implementation, and operational support in one collaboration model. What we recommend, we are able to deliver, which means our governance advice reflects how AI is actually built and run.
Technology-neutral approach
We do not develop our own foundation models. This keeps our advice on vendors and models independent and lets us help you choose, integrate, and govern the technologies that best fit your needs.
Practical and proportionate
Our focus is on governance that teams can actually follow, with controls built into delivery rather than a parallel review process that slows everything down.
Collaborative approach
We work closely with your technology, risk, and legal teams throughout, keeping business goals, technology decisions, and compliance requirements aligned.
About Novicell
Novicell is a digital consultancy that helps organisations strengthen commerce, digital experience, and operational performance.
We work across strategy, platforms, architecture, development, marketing, and data, helping organisations integrate AI into their existing business and technology environments in a practical and measurable way. Our teams combine strategic advisory with hands-on implementation.
We work with CIOs, CTOs, heads of risk, heads of legal, and boards on both advisory and implementation engagements.
Whether you are classifying your AI use against the EU AI Act for the first time or strengthening governance you already have, we help you put practical, defensible controls in place without slowing delivery.
Get in touch to discuss your AI governance and EU AI Act readiness.
Get in touchRead more about related topics
Optimize your internal processes to ensure high quality, compliance, and efficient data management.
Build an AI-ready data foundation with governed, connected data that powers AI agents, AI search, and intelligent business applications.
Unlock the value of AI in your marketing stack. We help you activate, govern, and measure AI across CRM, automation, and content.
Prepare your commerce architecture for AI agents and AI search with a practical blueprint that prioritises technology, data, and governance