3 · Remediate

AI Act remediation.

We execute the post-audit action plan and close the gaps it identified: technical documentation, classification, provider and deployer duties, human-oversight design, compensating controls. The engagement ends on a file a third party can review.

Duration: 2 to 6 months
Starting point: A gap analysis or an audit report
Frameworks: AI Act, ISO/IEC 42001, NIST AI RMF
Output: Inspection-ready file

Scope a remediation

A gap found is not a gap closed

An audit report says what is missing. It does not produce the technical documentation, the human-oversight procedure or the evidence that a control works. Remediation is that execution work, carried out with your teams until every gap is either closed or accepted in writing.

In order of exposure

Actions are taken in the order that reduces your exposure fastest, not in order of ease. Where a gap cannot be closed, a compensating control is designed and the residual risk goes into the register, with the name of the person who accepts it.

Scope

What remediation covers.

The workstreams opened depend on your role, provider or deployer, and on the risk tier of each system.

Classification and role. The classification of each system is confirmed and justified in writing, as is your qualification as provider or deployer.

Technical documentation. The documentation set out in Annex IV of the Act, written from the system as it actually runs and kept up to date.

Risk management system. Identification, assessment and treatment of risks, with gates before go-live and monitoring afterwards.

Data governance. Origin, quality and representativeness of the data, and a record of the choices made.

Human oversight. Who supervises the system, with what information, and how that person intervenes or overrides it.

Logging. Which events are recorded, how long they are kept and how they are produced on request.

Transparency. Instructions for use, information given to the people affected and the marking of generated content.

Deployer duties. Use in line with the instructions, relevance of input data, retention of logs and information of workers.

How we run it

Five steps, from the action plan to a reviewed file.

Taking over the diagnosisWe start from the existing gap analysis, ours or a third party’s. Where there is none, the engagement opens with two to four weeks of assessment.
Remediation planEach gap gets an action, an owner, a deadline and a closure criterion.
ExecutionThe documentation is written and the controls and procedures are designed, with the teams who operate the system.
VerificationEach control is tested, and the evidence that it works goes into the file.
File and decisionThe compliance file, the residual-risk register, and the decision of the person accountable: accept, mitigate or withdraw the system.

Deliverables

What you receive.

Tracked remediation plan Technical documentation (Annex IV) Risk management system Human-oversight design Model, use-case and agent cards NIST AI RMF control mapping Compensating controls Residual-risk register Post-deployment monitoring plan Inspection-ready file Executive summary

Who remediation is for

Compliance, risk and legal leaders, and owners of AI systems who already hold a diagnosis and now have to close the gaps and report on it to their executive committee.

Before and after remediation

Remediation follows the audit and prepares governance.

Before · Assess

AI system compliance audit

The audit establishes the gaps and puts them in order. Remediation starts from that plan.

After · Structure

AI governance framework

The standing apparatus that spares you a fresh remediation for every new system.

Next step

Close the gaps.

Send us your gap analysis or your audit report. We will come back with a remediation plan, a duration and a fixed fee.

Write to us