AI governance and compliance with the EU AI Act
Know which AI tools run in your organisation, and under which rules.
AI is already in your company, whether declared or not. Employees use online assistants, software includes AI features without announcing them, and teams test tools outside any approved process. The first governance question is simple: do you know which ones, and with what data?
The European regulation on AI, known as the EU AI Act (Regulation (EU) 2024/1689), entered into force on 1 August 2024. Its obligations apply in stages. Since 2 February 2025, certain practices are prohibited, and companies that deploy AI systems must ensure a sufficient level of AI literacy among their staff (Article 4). Since 2 August 2025, the obligations concerning general-purpose AI models apply.
Valtieri helps you regain control. We inventory your uses, classify risks under the EU AI Act, draft an applicable acceptable use policy and produce documentation ready for a regulatory review or a client audit. The engagement lasts 3 to 6 weeks, coordinated with your GDPR obligations.
What you get
- An inventory of AI uses and tools, including those that had not been declared.
- A classification of each use under the EU AI Act risk levels, with your role (provider or deployer).
- An AI acceptable use policy: authorised tools, prohibited data, verification of outputs.
- A clear split of roles and an approval process for any new tool or new use.
- A register and documentation ready for a regulatory review or a client audit.
- A prioritised action plan, aligned with your GDPR compliance.
How it runs
Inventory
Interviews, a questionnaire and an analysis of the tools in place: we identify what is actually used, by whom and with which data.
Classification
Each use is qualified against the EU AI Act: prohibited practice, high risk, transparency obligation or limited risk. Your role is specified for each one.
Rules and roles
We draft with you a short, applicable acceptable use policy, appoint the owners and set up the approval process.
Documentation
The register, analyses and decisions are gathered in a maintained file that you can present to an auditor or a client.
Frequently asked
Does the EU AI Act apply to a company that does not develop AI?
Yes. The regulation also covers deployers, meaning organisations that use an AI system in their activity. The AI literacy obligation under Article 4 has applied to them since 2 February 2025.
What is the link between the EU AI Act and GDPR?
The two texts apply cumulatively. As soon as an AI system processes personal data, GDPR applies. The engagement addresses both together to avoid duplicate documentation.
Should consumer AI tools be banned?
Rarely. It is more effective to define which tools are authorised, for which uses and with which data. A ban without an alternative pushes usage into the shadows.
Further reading
- DPOs and the EU AI Act: 55% of data protection officers already handle AI compliance without a formal mandate4 October 2026
- EU AI Act Article 50: what the Digital Omnibus does not postpone29 September 2026
- Autonomous AI agents: what the 14 September incident changes for your EU AI Act obligations17 September 2026
In the same practice area : AI and automation
- AI shipped to production
A prototype does not survive production. We ship what does.
- Managed AI agents
Your agents in production, monitored and under control.
- Process automation
Repetitive work handed back to the machines.
- AI training and adoption
Teams that use AI well, and safely.
- AI assistant for your customers
An assistant that answers accurately, and knows when to hand over.
- AI systems security
Your agents and chatbots tested the way an attacker would test them.
Let us talk about your context.
Thirty minutes to qualify the need. The written scope follows within fourteen working days.
Request a call