02 / Compliance and certification
The AI Act, starting with knowing what AI you run
We help you find the AI systems in your organisation, sort them by the risk the regulation assigns, and build the governance, documentation and security that the higher tiers require.
Overview
What the AI Act asks of you
The Artificial Intelligence Act, Regulation (EU) 2024/1689, takes a risk-based approach. A short list of practices is prohibited. High-risk AI systems, such as those used in certain areas of employment, credit, education or critical infrastructure, carry the heaviest obligations. Some systems, such as chatbots and generators of synthetic content, carry transparency obligations. Most of the rest is left alone. General-purpose AI models have rules of their own.
What you owe depends on your role. Providers who develop or place a system on the market carry most of the obligations for high-risk systems: risk management, data governance, technical documentation, logging, human oversight, accuracy, robustness and cybersecurity, and conformity assessment. Deployers who use those systems have duties of their own. The obligations apply in stages, so check the current text for what applies when.
Black Fox is not a lawyer, a notified body or a market surveillance authority. We help with the inventory, the classification work, the governance and the security of the systems. Legal classification questions belong with your counsel.
Who it is for
Organisations that develop AI systems for the EU market, and those that deploy AI in decisions about people, such as hiring, lending or access to services. Also teams that have adopted AI tools quickly and now need to know what they have.
The work, from scoping to evidence.
What we do
AI system inventory
We find the AI in use across your organisation, including features inside products you buy, and record what each system does, who owns it and what data it touches.
Classification support
For each system we work through the categories of the regulation and your role, and record the reasoning, so prohibited, high-risk and transparency cases are flagged early.
Governance
Roles, policies and approval steps for building, buying and changing AI systems, sized to how much AI you actually run.
Documentation
Help with risk management records, technical documentation, logging arrangements and instructions for use, where the system is high-risk.
Security of AI systems
Testing of AI systems and the applications around them, for example prompt injection, data leakage, insecure integrations and abuse of model outputs.
AI management system
Where you want a management system around all of this, we align the work with ISO/IEC 42001 so one effort serves both.
How the engagement runs
Kickoff
We agree the scope, the business units and the people involved, and sign an NDA first if you need one.
Inventory
Interviews, questionnaires and a look at your systems and contracts to find the AI in use.
Classification
Each system is assessed against the risk categories and your role, with open questions set aside for your counsel.
Gap assessment
For systems in the higher tiers, a review of governance, documentation and controls against the obligations, ending in a ranked gap list.
Testing and remediation support
Security testing of the systems that matter most, and work with your owners on the gaps.
Handover
Recommendations, a business report with the risk assessment and a technical report, then a closing meeting for your feedback.
What you receive
- AI system inventory with owners and data flows
- Classification record with reasoning for each system
- Gap assessment for high-risk and transparency cases
- AI governance policy and approval process
- Security test report for selected AI systems
- Prioritised action plan
Black Fox prepares and supports you, and does not issue certificates, attestation reports or official assessments itself. Where a certificate or report is the goal, we coordinate the audit with our long-standing certification partners or a body of your choice, so the work runs end to end in one engagement.
Questions
Does the AI Act apply to us if we only use AI tools?
It can. Deployers have obligations of their own, especially for high-risk systems and for some transparency cases. Using a supplier's model does not take you out of scope. An inventory is the first step to knowing which obligations reach you.
Who decides whether a system is high-risk?
The classification follows the rules in the regulation, and the provider is responsible for getting it right. We help you work through the criteria and record the reasoning. Where the answer turns on legal interpretation, your counsel should have the last word.
How does ISO/IEC 42001 relate to the AI Act?
ISO/IEC 42001 is a certifiable standard for an AI management system. It does not equal conformity with the AI Act, but a working management system makes the regulation's governance and documentation obligations much easier to carry.
Do you test AI systems for security?
Yes. We test AI systems and the applications around them the way we test other software, with attention to the attacks specific to AI, and report with proofs of concept.
Related services
- Compliance and certificationISO/IEC 42001ISO/IEC 42001 support from Black Fox Security: AIMS scoping, AI risk and impact assessment, Annex A controls, internal audit and certification audit preparation.
- Compliance and certificationGDPRGDPR support from Black Fox Security: records of processing, DPIAs, security of processing, processor agreements, breach handling and data subject requests.
- Advisory and responseDevSecOps and secure developmentDevSecOps from Black Fox Security: secure SDLC, threat modelling, code review, security in CI/CD, dependency and secret scanning, and developer training.
- Governance and riskSecurity risk assessmentInfrastructure, network and application risk assessment by Black Fox Security: probability versus severity, a risk register your owners use and treatment options.
Start with the inventory
Tell us where you build or use AI. We will help you find the rest of it and sort out what the regulation expects.