Compliance · A few weeks
AI Act & ISO/IEC 42001 readiness, know where you stand.
An inventory of your AI systems, your role and risk level under the EU AI Act, and the gaps to close for ISO/IEC 42001, presented to your leadership with a prioritized action plan.
For whom
- European companiesProviders or users of AI, including everyday tools.
- Companies working with EuropeSelling AI, or AI outputs, to European clients.
- Organizations aiming for ISO/IEC 42001Preparing an AI management system.
Since Feb. 2025AI literacy and prohibited practices apply
2 Dec. 2027new date for high-risk uses in Annex III
GDPR and Law 09-08covered in the same assessment
Why it concerns you
In the Union, or working with it.
If your organization is established in the European Union, the AI Act applies as soon as you provide or use AI systems in a professional context. Using AI tools at work makes you a deployer, with obligations that already apply.
The regulation also reaches beyond the Union’s borders. It covers providers that place an AI system on the EU market, wherever they are established, and providers and deployers outside the Union whose AI outputs are used in it. A company in Morocco or elsewhere can be in scope if it sells software that includes AI to European customers, provides them with AI-generated outputs, or is required by contract to meet a client’s obligations.
ISO/IEC 42001, the international standard for AI management systems, gives a structure to answer these questions once, and evidence to show your clients.
Timeline
What applies, and when.
Since February 2025
Prohibited practices and AI literacy
Organizations using AI must take measures to develop the skills of the people who use it.
Since August 2025
General-purpose AI models
Obligations for the providers of general-purpose AI models.
Since August 2026
Transparency
Telling people they are interacting with an AI system, and labeling generated content. Generative systems already on the market have until 2 December 2026 for machine-readable marking.
2027 and 2028
High-risk systems
Postponed by Regulation (EU) 2026/1744: 2 December 2027 for uses listed in Annex III, such as recruitment, education or access to credit, and 2 August 2028 for AI embedded in regulated products.
How it works
From inventory to action plan.
Inventory
Every AI system you use or provide, including the consumer tools your teams rely on.
Qualify
For each system, your role, provider or deployer, and its risk level. The obligations depend on both.
Gap analysis
Against the AI Act obligations that apply to you and the requirements of ISO/IEC 42001: policy, roles, risk and impact assessment, data, suppliers, monitoring.
Action plan
Prioritized actions with owners and dates, presented to your leadership.
What you leave with
Clear answers, and evidence to show.
- A register of your AI systems, with your role and the risk level of each
- A gap analysis against the AI Act and ISO/IEC 42001
- A prioritized action plan, with owners
- A draft AI usage policy and data classification rules
- A record of your AI literacy measures: the first evidence you will be asked for
- A presentation to your leadership
Most companies do not need a heavy audit. They need to know which systems they use, and in which role.
Our position
What we do, and what we do not.
We prepare you for the audit
We are not a certification body: ISO/IEC 42001 certification is granted by an accredited body. This assessment is not legal advice either: the interpretation of your situation is a matter for your legal counsel. Our role is to make the work concrete and get you ready.
Train the people who use AI
The AI literacy obligation already applies. Our training programs, from executive committees to business teams, are documented and give you that evidence.
FAQ
Good to know
We are in the EU and only use AI tools. Does this concern us?
Yes. Using AI systems at work makes you a deployer. The AI literacy obligation already applies, and other obligations depend on what you use the tools for.
We are outside the EU. Does this concern us?
If none of your AI systems or outputs reach the European Union, the AI Act may not apply to you. Local law still does, such as Law 09-08 in Morocco, and European clients increasingly ask their suppliers for these guarantees by contract.
Is ISO/IEC 42001 mandatory?
No. It is a voluntary international standard. It gives your AI governance a structure, and evidence your clients and partners can check.
Do you certify organizations?
No. We prepare you. Certification is granted by an accredited certification body after an audit.
How long does it take?
A few weeks, depending on the number of AI systems and teams involved. We agree on the timeline in the written scope.
How is the price set?
Every engagement starts with a written scope and a fixed price, set after our first conversation.
Based between Tangier and Paris
Let’s talk about your project.
A first 30-minute conversation, with no commitment. We work with organizations in Morocco, Europe, Africa and the Middle East.
AI advisory firm: strategy, delivery and training.
Tangier · Paris