EU AI Act: prohibited practices and the AI literacy duty already apply. High-risk obligations apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).

Find verified AI talent→Run a system analysis→Get your board report→

AI governance

One operating system for the EU AI Act and ISO 42001.

Most teams arrive here with one of two questions. What does the law ask of us, and how do we run this properly? Start with the one in front of you, and we will connect the rest.

Choose the question you are trying to answer.

The law

What does the EU AI Act ask of us?

Find your role, classify your systems, plan AI literacy and know what evidence to keep.

Read the EU AI Act guide

The standard

How do we run AI properly, day to day?

Scope a management system, name owners, set controls and prepare for certification.

Read the ISO 42001 guide

Not sure which comes first? Take the maturity assessment and we will point to your next step.

The same six layers serve both, so you only build it once.

The Act sets what you owe. The standard gives you a way to run it. Both draw on the same owners and evidence, which is why we treat them as one system rather than two programmes.

Inventory

Every AI system you build, buy or embed, with an owner.

Risk

Role, risk class and impact, written down once.

Controls

Oversight, data, supplier and change safeguards.

Evidence

Documents mapped to requirements and traceable to source.

Actions

Gaps ranked by what they put at risk.

Review

A steady cadence, so the picture stays current.

Alive AssistAlive StandardsResponsible AI governance

And when you are ready, here is who can do the work.

Alive structures the system and matches mandates to specialists. Certification and legal opinions stay with independent bodies and advisers.

Where AI governance meets sustainability reporting.

The same owners and evidence can support the wider accountability work shaped by the CSRD and its amendments. Check the current scope on EUR-Lex before relying on any threshold, and see our sustainability reporting use case.

Sources

Inside Alive Assist

Nine layers in every report, one structure across EU AI Act, ISO/IEC 42001 and NIST

Each assessment opens as a summary and goes down layer by layer: requirement coverage, gaps with their sources, prioritised actions, a control matrix, a risk register, evidence confidence, exposure scenarios and a board decision pack. Because the structure is identical for every framework, results line up side by side.

NIST AI RMF 1.0

NIST AI RMF mapping

13%

readiness in this sample run

Reflects the evidence supplied, so it rises as gaps are closed.

The nine layers

  • Executive summary
  • Requirement coverage
  • Gap analysis with sources
  • Prioritised actions
  • Control matrix
  • Risk registerShown
  • Evidence confidence
  • Exposure scenarios
  • Board decision pack
Alive Assist NIST AI RMF mapping report showing 13% readiness and nine collapsed report layers
NIST AI RMF risk register listing eight risks with likelihood, impact, rating and treatment

Risk register, layer by layer. Evidence is mapped to the Govern, Map, Measure and Manage functions. The risk register ranks eight gaps, led by metrics and testing, intended use and context, risk identification and risk prioritisation, each with a treatment.

Screens are from Alive Assist sample runs. Readiness reflects the evidence supplied in that run and is not an assessment of any organisation. Alive does not give legal advice or certify compliance.

Continue with the connected guides