Frequently asked questions
Where should we start?
List the AI tools and systems used in your organisation, their purposes, data and owners. AI Check can help with orientation; actual scope and risks require verification of the inputs.
Can we prepare our own rules?
Yes, if you have the knowledge and capacity. Start with the first steps and choose resources for the task. For help with preparation or review, see support for your situation.
What exactly will we receive?
Depending on the scope, materials for the inventory, AI use, responsibilities, learning and next steps. The outputs guide explains their purpose. The confirmed offer specifies the list, formats and review scope; it is not the same set of nine documents in every situation.
What must our organisation provide?
Information about actual tools, processes and data, participation by responsible people, input checks and approval of the rules. Working with a consultant does not transfer these responsibilities to the supplier. Agree the required participation and timing before starting.
What does it cost, and how long does it take?
That depends on the variant, systems, organisational coverage and work required. The L1 — Align page describes the offer. The confirmed proposal defines price, timing, formats, support and participation. Savings or return on investment cannot be responsibly guaranteed without understanding your baseline.
Is an AI policy or training certificate enough?
A policy helps when it reflects actual practice and people understand it. A training record documents a particular activity; it does not certify the whole organisation’s compliance. Further measures depend on the systems, roles and risks. See training and records.
Do we need a lawyer or auditor?
Legal assessment, practical implementation and independent verification can complement each other. If you already have a specialist, work can be coordinated with them and existing evidence reused. A legal opinion or certification audit requires an agreed scope and an appropriately qualified specialist.
Must we buy every NATIVE layer?
No. Choose the work that addresses your need. Learning, governance, change leadership and technical implementation are different engagements. Existing policies and capabilities should be used where suitable, rather than recreated unnecessarily.
Does the AI Act apply just because we use an ordinary AI tool?
Assess the organisation’s role and actual use. Another supplier’s API may form part of your own AI system, and deployer duties differ from provider duties. Not every high-risk system requirement applies to ordinary office use. See the AI Act overview and current application dates.
Must we address every regulation at once?
Establish scope first. Some evidence can support several areas, but a general governance engagement does not itself provide full compliance with the AI Act, GDPR, NIS2, DORA and Data Act. Overlaps and differences help identify what can be shared and what needs separate assessment.