Where is AI already running in your company?

An AI audit makes sense when the board cannot answer a simple question: how many artificial intelligence systems are running in the organisation today, and which of them needs formal classification under Regulation (EU) 2024/1689?

The question sounds simple, but the answer is rarely obvious, because AI systems reach companies by two routes at once: through a board decision, and through teams that pick up tools on their own, without IT knowing.

We offer two audits under one name. The exposure audit answers whether, and how far, your organisation is subject to the obligations of the Regulation. It covers an inventory of systems, classification against Article 5, Article 6 read with Annex III and Article 50, and a written classification assessment: an assessment of each system against Article 6 and Annex III and, where your organisation acts as a provider, in the form required by Article 6(4).

The readiness audit answers a different question: what is actually deployed, often without IT knowing, and where the widest gap lies between what the board believes is happening and what is actually happening in the organisation.

The Regulation entered into force on 1 August 2024 and has introduced its obligations in phases. The prohibition of unacceptable practices and the AI literacy duty have applied since 2 February 2025, whatever the risk level of the system. For high-risk systems under Annex III the date has moved to 2 December 2027, and for high-risk AI embedded in the regulated products of Annex I to 2 August 2028. Some obligations have therefore not yet arrived, but the classification that decides them is worth doing now.

The work starts with a conversation with the operational point of contact, usually in IT or compliance, or directly with the COO, and with a list of the tools and systems the organisation already knows about. The kick-off meeting usually lasts an hour and a half to two hours. It covers a review of the organisational structure, a map of the departments that use digital tools and a first list of systems reported by IT. In parallel we check which AI systems teams may have deployed locally, without a central board decision. That source of exposure is the one a standard IT review most often misses.

We classify each system identified article by article against the Regulation: whether it falls within the prohibited practices of Article 5, whether it qualifies as a high-risk system under Annex III, and whether it carries the transparency obligations of Article 50. Classification rests directly on the text of the Regulation as amended by Regulation (EU) 2026/1744. We document every classification decision with its reasoning, so that the result can be reproduced and defended before an internal audit or an external review. We build our own AI products, Hadar and Operark, and test our methods on them before we advise you.

The outcome goes into a written classification assessment, covering each system against Article 6 and Annex III and, for systems where your organisation acts as a provider, prepared in the form required by Article 6(4), and into a risk table ordered by urgency. Article 6(4) places the duty to document the assessment on the provider, so your role for each system is established before the assessment is issued. The work ends with a recommendation for the next step, not with an automatic move into a further engagement.

You receive a written report, not a slide deck. It contains the inventory of systems, classification against specific articles, the classification assessment and a risk table with priorities. The risk table orders systems along two axes: urgency, which follows from the regulatory date, and weight, which follows from the scale of a potential breach. We add a recommendation on whether the next step should be building governance, automating a specific process, or neither.

Without a board-level sponsor, an audit ends in a document that nobody implements. In every engagement we therefore assume from the start the involvement of a decision-maker on your side, alongside the operational point of contact.

We do not issue a certificate of compliance, and we do not promise compliance: the regulator decides that, not us. The audit gives a classification and a reasoned view, not a legal opinion. If the result shows no material exposure, we say so plainly and do not widen the scope of work artificially. We move on to governance or automation only when the audit's clear recommendation points there, because without priorities neither has a point of reference.

The right next step is a 30-minute diagnostic, requested through the contact form. It is at no charge, and most of the half hour is us listening: what AI you actually run, who touches it and on whose authority, and what you could evidence tomorrow morning. You leave with a straight answer on whether your exposure is material. The fee for the audit is fixed and agreed on that call, before anything is written, depending on the number of systems and the size of the organisation.