EU AI Act / governance / audit
The EU AI Act applies to the AI you already run.
Anduril is an advisory firm specialised in AI compliance and governance. We inventory, audit and remediate the AI systems of large organisations, then support their deployment. You leave with a position you can defend and the evidence behind it.
- AI systems audited
- 250+
- Organisations supported
- 25+
- Regulatory frameworks covered
- 5
The situation
AI enters the organisation faster than it gets recorded: models in production, vendor tools bought by the teams, automations nobody registered. The Act covers those systems, not only your future projects, according to the role you play and the risk tier of each one.
Our stance
Compliance is not a brake on deployment. It is what lets you put a system into production and defend that decision before a risk committee, a client or a supervisory authority. Every conclusion we issue rests on evidence that can be checked.
Exposure
Two questions decide your obligations.
The Act binds you according to the role you play and the risk tier your system falls in. Buying an AI tool does not make you a simple deployer: put your name on it, or fine-tune it on your own data, and you may have become a provider, with the documentation and conformity burden that carries.
Unacceptable risk
Banned practices, with no compliance route. This is the heaviest penalty tier in the Act, at up to 7% of worldwide annual turnover.
Social scoring, untargeted facial scraping, and emotion inference in the workplace, which catches more HR and productivity tooling than most buyers realise.
High risk
Risk management system, data governance, technical documentation, event logging, human oversight, accuracy and robustness requirements, and conformity assessment before the system goes to market.
Recruitment and worker management, creditworthiness, education, access to essential services, life and health insurance pricing, and AI embedded in regulated products.
Limited risk
Disclosure duties that attach to the deployer too. People must know when they are dealing with a machine, and synthetic content must be marked as such.
Customer-facing assistants, emotion recognition, biometric categorisation, generated text, image, audio and video.
Minimal risk
No system-specific obligation, but two things still apply: AI literacy for the staff who use or oversee the system, and your own ability to prove the classification was made deliberately.
The tier most organisations assume they are in. It is also the one they are least able to evidence.
General-purpose models sit on a separate track, with obligations that pass to anyone who substantially modifies them. The classification is not a formality: it fixes every duty that follows, and it is the first thing an auditor, a client or a regulator will ask you to justify.
AI compliance
From inventory to evidence, a journey in six steps.
Each service stands on its own. You engage at the step that matches your maturity.
AI system inventory and registry
Every AI system in the organisation in a single registry, shadow AI and vendor-embedded AI included: owner, purpose, data used, role under the Act, risk tier. Nothing downstream holds without it.
2 · Assess Lead engagementAI system compliance audit
The audit of one given system, on compliance and on risk: classification, bias, robustness, explainability, human oversight, data governance. You receive a formal opinion, the evidence behind it and a remediation roadmap, with no access to the model required.
3 · RemediateAI Act remediation
Execution of the post-audit plan: technical documentation, classification, provider and deployer duties, human-oversight design, compensating controls, through to a position you can defend.
4 · StructureAI governance framework
The standing apparatus: committee, policy corpus, RACI, decision and escalation paths, incident management. One control set answers the AI Act, ISO/IEC 42001, NIST AI RMF and your sector rules at once.
5 · EquipAI governance platform selection
Requirements matrix, RFP, comparative proof of concept and a total-cost case. The decision rests on tested evidence rather than on a demo.
6 · TrainTraining and AI literacy
Paths by audience, executives, business teams, data and legal teams, that discharge the AI literacy duty of Article 4, with a before-and-after assessment and a register of attestations.
Vertical
AI in human resources. CV screening, candidate scoring, profile matching, internal mobility: these uses fall under high risk. A dedicated audit for HR and HRIS leaders, covering the AI Act, GDPR and employment law together. See the HR audit
In focus
The AI system compliance audit.
Our lead engagement, and often the best entry point: a third-party diagnostic that tells you where you stand and what is left to do.
- Duration
- 2 to 6 weeks
- Access required
- None to model weights
- Frameworks
- AI Act, ISO/IEC 42001, NIST AI RMF
- Output
- Formal opinion and roadmap
Why a third-party view
The Act allows a self-assessment of conformity for most high-risk systems. A self-assessment is hard to defend the day an authority, a client or a committee challenges it. A formal opinion, following the logic of a financial audit, is what makes your position defensible.
What we examine
Eight pillars, from risk management to regulatory alignment, and not as a checklist of documents: what we test is whether each one actually holds in practice.
How the audit works →For providers established outside the EU
Reaching the EU market without being established in it.
A provider established outside the Union cannot deal with EU authorities directly. The Act requires it to appoint a representative inside the Union first, and the obligation sits on the provider, not on its distributors or its customers.
Standing mandate
EU authorised representative
We take the mandate. We hold the technical documentation and the declaration of conformity for its duration, act as the named point of contact for market surveillance and national competent authorities, cooperate with them on request, and keep the mandate registered and current.
A mandate is not a mailbox. The representative carries duties of its own and is required to end the mandate where it considers the provider to be acting against its obligations. We therefore check the file before signing, and tell you what is missing then rather than when an authority asks.
- Who it binds
- Providers outside the EU
- Legal basis
- Articles 22 and 54
- Covers
- High-risk systems, general-purpose AI models
- Form
- Written mandate, held annually
AI delivery
Deploy, not only control.
A compliant system that never reaches production serves no one. We provide AI product owners and AI project directors who take your projects through to deployment, with compliance requirements built in from scoping.
AI product owner
Carries the product vision, arbitrates the backlog and holds the line between business, data teams and compliance.
AI project director
Runs the programme: milestones, risks, budget, committees and reporting to leadership.
Scoping and prioritisation
A portfolio of use cases ranked by value and by feasibility, regulatory feasibility included, before budget is committed.
The firm
A senior team, specialised in AI compliance.
We work with regulated groups carrying several compliance regimes at once, where a single AI decision has to satisfy the Act, a sector supervisor and an internal risk function simultaneously.
Strategy and delivery
Practitioners who have run enterprise AI programmes end to end.
Law and regulation
AI regulation, data protection and sector rules.
Operational compliance
AI compliance run day to day, inside large listed groups.
An opinion is only worth what it survives.
Opinions we can defend. Every conclusion is traceable to the evidence that produced it, and we say so when the evidence does not support one.
No access to the model. Our assessment runs black box. That matters when the system is a vendor product, when the provider will not open it, or when the team that built it has moved on.
Practitioners, not only reviewers. The team builds models, data pipelines and agents itself. It audits with a working grasp of the technology, not just of the documentation.
Frameworks
One control programme, several frameworks.
Rather than run parallel compliance exercises, we build a single set of controls that answers all of them at once.
EU AI Act
The binding regulation: risk classification, provider and deployer obligations, technical documentation, human oversight.
ISO/IEC 42001
The AI management-system standard, and the only one of the three offering third-party certification, increasingly requested to qualify a vendor.
NIST AI RMF
The most widely adopted risk framework, useful as a common control language across teams and countries.
A single human-oversight control satisfies all three. We map each control back to the obligations it discharges, GDPR and sector rules included, so the same evidence serves every audience.
Next step
Start with one system.
Pick the AI system that would be hardest to defend if a supervisory authority, a client or your own internal audit asked tomorrow. We will scope an audit of it and tell you exactly what closing the gap involves.