AI Governance Consulting
AI Governance Consulting and Vendor AI Risk Management 2026
AI is already in your business, in your own tools and in your vendors' products. We help you find it, assess it, set the rules and prove control to boards, auditors and regulators.
Who this is for
Who this is for
CISOs and security GRC
You own the control set. Yet AI tools arrive faster than your review process.
Compliance, legal and DPOs
You answer to regulators. So you need proof of who uses AI, why and under which rules.
Procurement
You sign the contracts. However, standard terms rarely cover how a vendor's AI uses your data.
The problem
The problem
No owner, register or policy.
AI is in use across teams. Often, nobody owns it and nothing records it.
Vendor AI changes between renewals.
Models, sub-processors and data practices shift without a new contract.
Questionnaires miss AI risk.
Generic checklists rarely test training on your data, logging or human oversight.
Deployer duties apply to you.
Under the EU AI Act, using a vendor's AI does not pass your duties to the vendor.
Services
What we deliver
AI inventory and register
You know every AI system in use, including vendor AI.
Deliverable: Live AI register
Risk tiering and EU AI Act role mapping
Each use case is tiered, and your provider or deployer role is clear.
Deliverable: Risk tier and role map
AI policy, governance structure and handbook
Staff know the rules, and decisions have named owners.
Deliverable: AI policy and governance handbook
ISO/IEC 42001 gap assessment and readiness
You see the gap to certification and the order to close it.
Deliverable: Gap report and readiness plan
DPIAs and AI impact assessments
High-risk uses are assessed before launch, not after a complaint.
Deliverable: DPIA and AI impact assessment
AI literacy training
People who use and oversee AI meet the literacy duty.
Deliverable: Role-based training and records
Board and regulator reporting
Leaders get a clear view of AI risk and progress.
Deliverable: Board-ready AI risk report
Vendor AI
Third-party AI risk
Most AI risk arrives through suppliers. Therefore, we assess it before you sign and keep watching after.
Vendor due diligence
We review each supplier against its risk tier, with an evidence request.
AI-specific questionnaire
Questions on data use, models, oversight and change that generic forms skip.
Contract and DPA review
No training on your data. Sub-processor and model-change notice. Audit rights. Incident timelines. Exit and deletion.
Ongoing monitoring
Scheduled reassessments, so changes are caught between renewals.
What we assess
| Domain | What we check |
|---|---|
| Data use and training | Whether your data trains the vendor's models, and how you opt out. |
| Security controls | Evidence such as SOC 2 and ISO 27001, mapped to the AI service. |
| Sub-processors and model supply chain | Which models and third parties sit behind the product. |
| Logging and retention | What is logged, for how long, and who can access it. |
| Human oversight | Where people review, override or stop AI outputs. |
| Incident notification | How fast the vendor tells you about AI incidents and data breaches. |
| Regulatory classification | The EU AI Act risk tier, and who is provider or deployer. |
| Exit and portability | How you leave, and how your data is returned and deleted. |
Method
How it works
- 1
Step 1: Discover and tier
We map your AI tools and suppliers. Then we tier them by risk.
Deliverable: AI Risk Register
- 2
Step 2: Assess
We run assessments and score the evidence.
Deliverable: Scorecards
- 3
Step 3: Contract and control
We close gaps in contracts, DPAs and internal controls.
Deliverable: Contract Position Paper and Handbook
- 4
Step 4: Monitor and report
We reassess on a schedule and track changes.
Deliverable: Quarterly Assurance Report
Sample deliverable
Sample deliverable
Illustrative example — a fictional vendor, not a real client.
| Domain | Risk | Finding |
|---|---|---|
| Data use and training | Medium | Opt-out exists but is off by default. |
| Security controls | Low | SOC 2 Type II report supplied. |
| Sub-processors and model supply chain | High | Model provider not named in the DPA. |
| Incident notification | Medium | No AI-specific notice period. |
| Exit and portability | Low | Deletion certificate on request. |
What applies when
EU AI Act timeline at a glance
| Date | What applies | Who it matters to |
|---|---|---|
| 2 Feb 2025 | Prohibited practices and AI literacy duty apply. | Everyone using AI. |
| 2 Aug 2025 | General-purpose AI model obligations apply. | Model providers and their customers. |
| 2 Aug 2026 | Article 50 transparency obligations apply. | Chatbots and AI-generated content. |
| 2 Dec 2026 | Two new prohibited practices apply (Article 5(1)(ba) and (bb): AI generating non-consensual intimate imagery and AI generating child sexual abuse material). Generative AI systems already on the market before 2 Aug 2026 must also meet the Article 50(2) marking obligation. | Everyone using AI. |
| 2 Dec 2027 | Annex III high-risk obligations apply (for example employment, credit scoring, education). | Deployers and providers of those systems. |
| 2 Aug 2028 | Annex I high-risk obligations apply to AI embedded in regulated products. | Product manufacturers. |
The Digital Omnibus on AI, Regulation (EU) 2026/1744, postponed the high-risk deadlines but did not remove the requirements. It was published in the Official Journal on 24 July 2026 and has applied since 27 July 2026. Last reviewed November 2026. This summary is not legal advice.
Sectors
Built for regulated and data-intensive organisations
Financial services
Credit, fraud and advice tools that affect customer outcomes.
Healthcare and life sciences
Clinical and patient-facing AI using health data.
Recruitment and HR
Screening tools, bias exposure and worker rights.
SaaS and technology
AI features in your product and the models behind them.
Retail
Personalisation, chatbots and pricing tools using customer data.
Why Formiti
Why Formiti
One team for privacy and AI.
We already act as DPO and representative for clients across several jurisdictions.
Contract-ready outputs.
Findings become clauses, risk acceptances and board summaries.
Platform-backed.
Your register and evidence can run in Privacy360, not a spreadsheet.
Local presence.
Birmingham, Dublin, Zug and Thailand.
Qualified DPOs.
Work is led by named, qualified data protection officers.
Working with us
Ways to engage
Readiness assessment
From £2,250
Fixed scope. A clear view of your AI governance gaps and next steps.
Discuss your requirementsFractional AI governance lead
Retained. A named lead runs your AI governance programme.
Discuss your requirementsIncluded with our Global DPO service
AI governance as part of your outsourced DPO support.
Discuss your requirementsFree download
AI governance checklist
A 30-question self-assessment for CISOs, compliance leads and DPOs. It covers your own AI and the AI your vendors supply.
- Score each practice Yes, Partly or No.
- Total each section to see where the gaps are.
- Takes about 20 minutes.
Technology
We can use the Privacy360 AI Governance module to run your register and assessments. It supports the consulting work; it does not replace it.
Frequently asked questions
AI governance consulting: your questions answered
Are we a provider or a deployer under the EU AI Act?
If you use an AI system under your own authority, you are a deployer. You can become a provider if you rebrand a system, change its intended purpose or substantially modify it. We map the role for each use case, because it decides which duties are yours.
What should we ask an AI vendor before signing?
Ask where data goes and whether it trains their models. Ask which sub-processors are involved and what is logged. Also ask how model changes are notified, how incidents are reported and how you exit. We turn these into a scored questionnaire with an evidence request.
What did the Digital Omnibus change?
It moved the Annex III high-risk deadline to 2 December 2027, and Annex I to 2 August 2028. Article 50 transparency duties were not delayed. The requirements remain, so governance work should start now.
Does the EU AI Act apply if we are not based in the EU?
It can. It applies where an AI system's output is used in the EU, or where you provide AI systems to EU users. Like GDPR, it reaches beyond the EU's borders.
Do we need ISO 42001?
It is not a legal requirement. However, buyers and auditors increasingly ask about it. Our gap assessment shows what certification would take, so you can decide whether it is worth it.
What if a vendor trains its models on our data?
That is a contract and GDPR question. We check the vendor's terms, the DPA and any opt-out. Then we recommend clauses or controls, or advise against the tool if the risk cannot be managed.
How is this different from our existing third-party risk process?
Traditional vendor risk asks whether a supplier is secure, reliable and solvent. AI adds questions about model behaviour, data use, human oversight and change. We extend your process rather than replace it.
What is the difference between AI governance and AI vendor risk?
AI governance covers all the AI you build, buy and use: the register, policy, roles and reporting. AI vendor risk is one part of it. It focuses on the AI that suppliers provide to you.
What do auditors expect as evidence?
They expect a current AI register, an approved policy and named owners. They also look for risk assessments, DPIAs where needed, training records and proof of vendor review. We build each item so it stands up to audit.
Can you work with our internal team and tools?
Yes. We can run the work for you, train your team to run it, or support your existing GRC platform. Our Privacy360 platform is also available as a standalone product.
How long does a readiness assessment take?
It depends on how many AI systems and vendors you have. We agree the timeline at scoping, so you know the duration before work starts.
What does AI governance consulting cost?
Cost depends on scope: a fixed-scope readiness assessment, a retained governance lead or per-vendor assessments. Book a call and we will give you a written quote.
Related guides
- The Operational AI DPIA and Inventory Guide 2026: Managing Generative and Agentic Risk
- Build an AI Compliance Roadmap That Works
- How to Document AI Decisions for Compliance
- How to Run a Defensible AI Vendor Risk Assessment Under the EU AI Act
- AI Act Readiness Checklist for Businesses
- AI Governance Framework for Businesses
Ready to bring AI under control?
Tell us where AI is used in your business. We will show you where the risk sits and what to do first.
Book a 30-minute AI governance call